a56ff5c701ea6ca2aaaa688155d266b0e55daa51aa3c3c2ebed584e24a1fb74a

Analysis

max time kernel
120s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2024, 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

954538efc491d0b2cb33717ff3b54a10N.exe
Size

468KB
MD5

954538efc491d0b2cb33717ff3b54a10
SHA1

9eba89684fd3281639071dc08b966fbcdec16e24
SHA256

a56ff5c701ea6ca2aaaa688155d266b0e55daa51aa3c3c2ebed584e24a1fb74a
SHA512

870e017166b03ba66c376eac8c50e355ff516fe972efee7441b2ff7d4d6eb06e556576ca17982613cf796057cf081d8aa13eb67ce4df1c0bb9980c47f78a190c
SSDEEP

3072:vbUFogVd6z5ytbYEPYzhff8gg4bMW3pCnmHeVVVwGmiVbU/u6elf:vbuoXdytHP+hffTZoaGmO4/u6

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1304	Unicorn-675.exe
2104	Unicorn-50172.exe
4784	Unicorn-54811.exe
4572	Unicorn-10203.exe
2076	Unicorn-10203.exe
1128	Unicorn-20409.exe
3616	Unicorn-6674.exe
1796	Unicorn-62004.exe
4276	Unicorn-50499.exe
1616	Unicorn-29332.exe
2976	Unicorn-44708.exe
2020	Unicorn-16674.exe
4652	Unicorn-60779.exe
3440	Unicorn-61044.exe
4948	Unicorn-5905.exe
4328	Unicorn-4643.exe
744	Unicorn-61820.exe
1348	Unicorn-25618.exe
3916	Unicorn-30497.exe
1396	Unicorn-22708.exe
3376	Unicorn-817.exe
4728	Unicorn-63164.exe
1456	Unicorn-38660.exe
3880	Unicorn-54731.exe
1944	Unicorn-51275.exe
3920	Unicorn-5603.exe
4016	Unicorn-38468.exe
4204	Unicorn-24169.exe
5088	Unicorn-26770.exe
2024	Unicorn-51851.exe
840	Unicorn-25396.exe
2588	Unicorn-38394.exe
1852	Unicorn-7243.exe
372	Unicorn-35618.exe
4224	Unicorn-55292.exe
2324	Unicorn-22620.exe
2784	Unicorn-57906.exe
4804	Unicorn-39532.exe
2296	Unicorn-32514.exe
208	Unicorn-54451.exe
3292	Unicorn-7554.exe
4788	Unicorn-48660.exe
3620	Unicorn-24732.exe
2184	Unicorn-16180.exe
2136	Unicorn-8011.exe
2864	Unicorn-42914.exe
3532	Unicorn-34820.exe
4704	Unicorn-26652.exe
1520	Unicorn-42988.exe
4244	Unicorn-42988.exe
1476	Unicorn-1763.exe
4636	Unicorn-63771.exe
4692	Unicorn-48011.exe
1292	Unicorn-2074.exe
3604	Unicorn-61746.exe
2488	Unicorn-64347.exe
2632	Unicorn-9745.exe
676	Unicorn-60668.exe
3988	Unicorn-32634.exe
2308	Unicorn-44332.exe
2060	Unicorn-55114.exe
2132	Unicorn-35588.exe
2264	Unicorn-48203.exe
3972	Unicorn-51732.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1468	1616	WerFault.exe	103

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55604.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21632.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7931.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57851.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46291.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14993.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33242.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51443.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55114.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27866.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7600.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47755.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5104.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64932.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51851.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30768.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19219.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2793.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62764.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43796.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45260.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26736.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38394.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43242.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45604.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41299.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24240.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52644.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31034.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51955.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31956.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17660	dwm.exe
Token: SeChangeNotifyPrivilege	17660	dwm.exe
Token: 33	17660	dwm.exe
Token: SeIncBasePriorityPrivilege	17660	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4904	954538efc491d0b2cb33717ff3b54a10N.exe
1304	Unicorn-675.exe
2104	Unicorn-50172.exe
4784	Unicorn-54811.exe
4572	Unicorn-10203.exe
2076	Unicorn-10203.exe
1128	Unicorn-20409.exe
3616	Unicorn-6674.exe
1796	Unicorn-62004.exe
4276	Unicorn-50499.exe
4652	Unicorn-60779.exe
1616	Unicorn-29332.exe
4948	Unicorn-5905.exe
2976	Unicorn-44708.exe
2020	Unicorn-16674.exe
3440	Unicorn-61044.exe
4328	Unicorn-4643.exe
744	Unicorn-61820.exe
1348	Unicorn-25618.exe
3916	Unicorn-30497.exe
1396	Unicorn-22708.exe
3376	Unicorn-817.exe
1456	Unicorn-38660.exe
4728	Unicorn-63164.exe
3920	Unicorn-5603.exe
4204	Unicorn-24169.exe
3880	Unicorn-54731.exe
1944	Unicorn-51275.exe
2024	Unicorn-51851.exe
4016	Unicorn-38468.exe
5088	Unicorn-26770.exe
840	Unicorn-25396.exe
2588	Unicorn-38394.exe
1852	Unicorn-7243.exe
372	Unicorn-35618.exe
4224	Unicorn-55292.exe
2324	Unicorn-22620.exe
2784	Unicorn-57906.exe
4804	Unicorn-39532.exe
2296	Unicorn-32514.exe
208	Unicorn-54451.exe
3292	Unicorn-7554.exe
4788	Unicorn-48660.exe
3620	Unicorn-24732.exe
2864	Unicorn-42914.exe
2184	Unicorn-16180.exe
2136	Unicorn-8011.exe
4704	Unicorn-26652.exe
3532	Unicorn-34820.exe
4244	Unicorn-42988.exe
1520	Unicorn-42988.exe
1476	Unicorn-1763.exe
1292	Unicorn-2074.exe
4692	Unicorn-48011.exe
2488	Unicorn-64347.exe
3604	Unicorn-61746.exe
2632	Unicorn-9745.exe
3988	Unicorn-32634.exe
2308	Unicorn-44332.exe
676	Unicorn-60668.exe
2060	Unicorn-55114.exe
4228	Unicorn-5145.exe
2132	Unicorn-35588.exe
2264	Unicorn-48203.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4904 wrote to memory of 1304	4904	954538efc491d0b2cb33717ff3b54a10N.exe	91
PID 4904 wrote to memory of 1304	4904	954538efc491d0b2cb33717ff3b54a10N.exe	91
PID 4904 wrote to memory of 1304	4904	954538efc491d0b2cb33717ff3b54a10N.exe	91
PID 1304 wrote to memory of 2104	1304	Unicorn-675.exe	93
PID 1304 wrote to memory of 2104	1304	Unicorn-675.exe	93
PID 1304 wrote to memory of 2104	1304	Unicorn-675.exe	93
PID 4904 wrote to memory of 4784	4904	954538efc491d0b2cb33717ff3b54a10N.exe	94
PID 4904 wrote to memory of 4784	4904	954538efc491d0b2cb33717ff3b54a10N.exe	94
PID 4904 wrote to memory of 4784	4904	954538efc491d0b2cb33717ff3b54a10N.exe	94
PID 4784 wrote to memory of 4572	4784	Unicorn-54811.exe	97
PID 2104 wrote to memory of 2076	2104	Unicorn-50172.exe	98
PID 4784 wrote to memory of 4572	4784	Unicorn-54811.exe	97
PID 2104 wrote to memory of 2076	2104	Unicorn-50172.exe	98
PID 4784 wrote to memory of 4572	4784	Unicorn-54811.exe	97
PID 2104 wrote to memory of 2076	2104	Unicorn-50172.exe	98
PID 4904 wrote to memory of 1128	4904	954538efc491d0b2cb33717ff3b54a10N.exe	99
PID 4904 wrote to memory of 1128	4904	954538efc491d0b2cb33717ff3b54a10N.exe	99
PID 4904 wrote to memory of 1128	4904	954538efc491d0b2cb33717ff3b54a10N.exe	99
PID 1304 wrote to memory of 3616	1304	Unicorn-675.exe	100
PID 1304 wrote to memory of 3616	1304	Unicorn-675.exe	100
PID 1304 wrote to memory of 3616	1304	Unicorn-675.exe	100
PID 2076 wrote to memory of 1796	2076	Unicorn-10203.exe	101
PID 2076 wrote to memory of 1796	2076	Unicorn-10203.exe	101
PID 2076 wrote to memory of 1796	2076	Unicorn-10203.exe	101
PID 2104 wrote to memory of 4276	2104	Unicorn-50172.exe	102
PID 2104 wrote to memory of 4276	2104	Unicorn-50172.exe	102
PID 2104 wrote to memory of 4276	2104	Unicorn-50172.exe	102
PID 4572 wrote to memory of 1616	4572	Unicorn-10203.exe	103
PID 4572 wrote to memory of 1616	4572	Unicorn-10203.exe	103
PID 4572 wrote to memory of 1616	4572	Unicorn-10203.exe	103
PID 1128 wrote to memory of 2976	1128	Unicorn-20409.exe	104
PID 1128 wrote to memory of 2976	1128	Unicorn-20409.exe	104
PID 1128 wrote to memory of 2976	1128	Unicorn-20409.exe	104
PID 4784 wrote to memory of 2020	4784	Unicorn-54811.exe	105
PID 4784 wrote to memory of 2020	4784	Unicorn-54811.exe	105
PID 4784 wrote to memory of 2020	4784	Unicorn-54811.exe	105
PID 4904 wrote to memory of 4652	4904	954538efc491d0b2cb33717ff3b54a10N.exe	106
PID 4904 wrote to memory of 4652	4904	954538efc491d0b2cb33717ff3b54a10N.exe	106
PID 4904 wrote to memory of 4652	4904	954538efc491d0b2cb33717ff3b54a10N.exe	106
PID 3616 wrote to memory of 3440	3616	Unicorn-6674.exe	107
PID 3616 wrote to memory of 3440	3616	Unicorn-6674.exe	107
PID 3616 wrote to memory of 3440	3616	Unicorn-6674.exe	107
PID 1304 wrote to memory of 4948	1304	Unicorn-675.exe	108
PID 1304 wrote to memory of 4948	1304	Unicorn-675.exe	108
PID 1304 wrote to memory of 4948	1304	Unicorn-675.exe	108
PID 1796 wrote to memory of 4328	1796	Unicorn-62004.exe	109
PID 1796 wrote to memory of 4328	1796	Unicorn-62004.exe	109
PID 1796 wrote to memory of 4328	1796	Unicorn-62004.exe	109
PID 4652 wrote to memory of 744	4652	Unicorn-60779.exe	110
PID 4652 wrote to memory of 744	4652	Unicorn-60779.exe	110
PID 4652 wrote to memory of 744	4652	Unicorn-60779.exe	110
PID 2076 wrote to memory of 1348	2076	Unicorn-10203.exe	111
PID 2076 wrote to memory of 1348	2076	Unicorn-10203.exe	111
PID 2076 wrote to memory of 1348	2076	Unicorn-10203.exe	111
PID 4904 wrote to memory of 3916	4904	954538efc491d0b2cb33717ff3b54a10N.exe	112
PID 4904 wrote to memory of 3916	4904	954538efc491d0b2cb33717ff3b54a10N.exe	112
PID 4904 wrote to memory of 3916	4904	954538efc491d0b2cb33717ff3b54a10N.exe	112
PID 4276 wrote to memory of 1396	4276	Unicorn-50499.exe	113
PID 4276 wrote to memory of 1396	4276	Unicorn-50499.exe	113
PID 4276 wrote to memory of 1396	4276	Unicorn-50499.exe	113
PID 2104 wrote to memory of 3376	2104	Unicorn-50172.exe	114
PID 2104 wrote to memory of 3376	2104	Unicorn-50172.exe	114
PID 2104 wrote to memory of 3376	2104	Unicorn-50172.exe	114
PID 4948 wrote to memory of 4728	4948	Unicorn-5905.exe	115

C:\Users\Admin\AppData\Local\Temp\954538efc491d0b2cb33717ff3b54a10N.exe
"C:\Users\Admin\AppData\Local\Temp\954538efc491d0b2cb33717ff3b54a10N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Users\Admin\AppData\Local\Temp\Unicorn-675.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-675.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50172.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50172.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10203.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62004.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4643.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60668.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27716.exe
        9⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47628.exe
        10⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43117.exe
        11⤵
        
        PID:13572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15291.exe
        11⤵
        
        PID:17868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24240.exe
        11⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8627.exe
        10⤵
        
        PID:10168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45260.exe
        10⤵
        
        PID:14540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23936.exe
        10⤵
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32370.exe
        9⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6986.exe
        9⤵
        
        PID:10920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28348.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:14892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61700.exe
        9⤵
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59739.exe
        8⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3066.exe
        9⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46291.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36796.exe
        9⤵
        
        PID:14164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11160.exe
        9⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25545.exe
        8⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8020.exe
        9⤵
        
        PID:11648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9323.exe
        9⤵
        
        PID:15652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9331.exe
        9⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43884.exe
        8⤵
        
        PID:10072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19474.exe
        8⤵
        
        PID:14212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57164.exe
        8⤵
        
        PID:16652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32634.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11571.exe
        8⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46948.exe
        9⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40885.exe
        10⤵
        
        PID:11716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33442.exe
        10⤵
        
        PID:3904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29722.exe
        10⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
        9⤵
        
        PID:10728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46195.exe
        9⤵
        
        PID:14448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44675.exe
        8⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32146.exe
        8⤵
        
        PID:11524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4940.exe
        8⤵
        
        PID:14772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16968.exe
        8⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13521.exe
        7⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13139.exe
        8⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24003.exe
        8⤵
        
        PID:12820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28730.exe
        8⤵
        
        PID:15088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65274.exe
        8⤵
        
        PID:17680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36507.exe
        7⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65300.exe
        7⤵
        
        PID:12584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42221.exe
        7⤵
        
        PID:14640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38394.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44332.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19932.exe
        8⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44291.exe
        9⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54165.exe
        10⤵
        
        PID:13776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24729.exe
        10⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22362.exe
        9⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28426.exe
        9⤵
        
        PID:14688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55834.exe
        9⤵
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54658.exe
        8⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21965.exe
        9⤵
        
        PID:12224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35363.exe
        9⤵
        
        PID:15876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17992.exe
        9⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
        8⤵
        
        PID:10692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe
        8⤵
        
        PID:14456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2666.exe
        7⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29284.exe
        8⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53516.exe
        8⤵
        
        PID:13012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28730.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4321.exe
        7⤵
        
        PID:8964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33132.exe
        7⤵
        
        PID:12568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
        7⤵
        
        PID:15552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26449.exe
        7⤵
        
        PID:8592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55114.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36268.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12874.exe
        8⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25818.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53236.exe
        8⤵
        
        PID:14776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64777.exe
        8⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29978.exe
        7⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63884.exe
        7⤵
        
        PID:11368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48603.exe
        7⤵
        
        PID:15956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38153.exe
        7⤵
        
        PID:7352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51099.exe
        6⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62340.exe
        7⤵
        
        PID:8224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13530.exe
        7⤵
        
        PID:13636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32588.exe
        7⤵
        
        PID:16736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62473.exe
        7⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44178.exe
        6⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15611.exe
        6⤵
        
        PID:11568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4644.exe
        6⤵
        
        PID:15660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25618.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55292.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2915.exe
        7⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44156.exe
        8⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62597.exe
        9⤵
        
        PID:8672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64476.exe
        9⤵
        
        PID:13632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20858.exe
        9⤵
        
        PID:17892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13769.exe
        9⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
        8⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-74.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-74.exe
        8⤵
        
        PID:11900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63900.exe
        8⤵
        
        PID:15556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
        7⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
        8⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61653.exe
        9⤵
        
        PID:14100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62764.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:17292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24432.exe
        9⤵
        
        PID:15612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61004.exe
        8⤵
        
        PID:11668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8938.exe
        8⤵
        
        PID:16004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64506.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54674.exe
        7⤵
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8627.exe
        7⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6138.exe
        7⤵
        
        PID:15000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24082.exe
        6⤵
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13107.exe
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        8⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58788.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48995.exe
        8⤵
        
        PID:14424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55443.exe
        7⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42731.exe
        7⤵
        
        PID:11348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46412.exe
        7⤵
        
        PID:15264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31912.exe
        7⤵
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30433.exe
        6⤵
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28708.exe
        7⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13059.exe
        7⤵
        
        PID:13128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34506.exe
        7⤵
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15497.exe
        7⤵
        
        PID:17876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53803.exe
        6⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14186.exe
        6⤵
        
        PID:11520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31403.exe
        6⤵
        
        PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57906.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1291.exe
        6⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45972.exe
        7⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10819.exe
        8⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58788.exe
        8⤵
        
        PID:10876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46987.exe
        8⤵
        
        PID:14556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63354.exe
        8⤵
        
        PID:17260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30938.exe
        7⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18610.exe
        7⤵
        
        PID:11168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11627.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61321.exe
        7⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10834.exe
        6⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63034.exe
        7⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41020.exe
        7⤵
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31706.exe
        7⤵
        
        PID:16512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54106.exe
        7⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44482.exe
        6⤵
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41388.exe
        6⤵
        
        PID:10784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5266.exe
        6⤵
        
        PID:15176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55834.exe
        6⤵
        
        PID:7952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50035.exe
        5⤵
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61867.exe
        6⤵
        
        PID:4188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8020.exe
        7⤵
        
        PID:11676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33442.exe
        7⤵
        
        PID:15688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5601.exe
        7⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20338.exe
        6⤵
        
        PID:9348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44083.exe
        6⤵
        
        PID:14052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18745.exe
        6⤵
        
        PID:18024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29849.exe
        5⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6204.exe
        6⤵
        
        PID:11980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44300.exe
        6⤵
        
        PID:15540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48849.exe
        6⤵
        
        PID:8664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22266.exe
        5⤵
        
        PID:8896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8572.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2922.exe
        5⤵
        
        PID:16776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50499.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22708.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24274.exe
        6⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46932.exe
        7⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46948.exe
        8⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41461.exe
        9⤵
        
        PID:11240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8171.exe
        9⤵
        
        PID:15080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58833.exe
        9⤵
        
        PID:17596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20658.exe
        8⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10842.exe
        8⤵
        
        PID:760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56900.exe
        8⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54305.exe
        8⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13626.exe
        7⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28493.exe
        8⤵
        
        PID:9516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17195.exe
        8⤵
        
        PID:14208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54609.exe
        8⤵
        
        PID:1200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47915.exe
        7⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52172.exe
        7⤵
        
        PID:13992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59785.exe
        7⤵
        
        PID:18052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16209.exe
        6⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17748.exe
        7⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43796.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39011.exe
        7⤵
        
        PID:14800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5601.exe
        7⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28339.exe
        6⤵
        
        PID:964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64819.exe
        6⤵
        
        PID:11488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28419.exe
        6⤵
        
        PID:15300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54451.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8115.exe
        6⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6579.exe
        7⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe
        8⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22274.exe
        8⤵
        
        PID:14228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8659.exe
        8⤵
        
        PID:16704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57851.exe
        7⤵
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
        7⤵
        
        PID:13232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65068.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42985.exe
        7⤵
        
        PID:8628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2193.exe
        6⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe
        7⤵
        
        PID:9328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12674.exe
        7⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34892.exe
        7⤵
        
        PID:17848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59129.exe
        7⤵
        
        PID:7936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11019.exe
        6⤵
        
        PID:10032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43979.exe
        6⤵
        
        PID:14168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57164.exe
        6⤵
        
        PID:17492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64731.exe
        6⤵
        
        PID:17668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2561.exe
        5⤵
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29844.exe
        6⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3227.exe
        7⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31477.exe
        8⤵
        
        PID:11976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12971.exe
        8⤵
        
        PID:16072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44564.exe
        7⤵
        
        PID:10840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46987.exe
        7⤵
        
        PID:14568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13385.exe
        7⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25074.exe
        6⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34946.exe
        6⤵
        
        PID:11544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12779.exe
        6⤵
        
        PID:14360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29608.exe
        6⤵
        
        PID:1084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
        5⤵
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13340.exe
        6⤵
        
        PID:14816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21169.exe
        6⤵
        
        PID:8412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35794.exe
        5⤵
        
        PID:9592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44355.exe
        5⤵
        
        PID:13980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33197.exe
        5⤵
        
        PID:4348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-817.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39532.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25988.exe
        6⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39444.exe
        7⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62916.exe
        8⤵
        
        PID:9136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14787.exe
        8⤵
        
        PID:12716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        8⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4449.exe
        8⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57851.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
        7⤵
        
        PID:13212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40372.exe
        7⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23744.exe
        7⤵
        
        PID:7476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-378.exe
        6⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61269.exe
        7⤵
        
        PID:12768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40371.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2040.exe
        7⤵
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63091.exe
        6⤵
        
        PID:10788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51388.exe
        6⤵
        
        PID:14940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38602.exe
        5⤵
        
        PID:1312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5619.exe
        6⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51188.exe
        7⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19098.exe
        7⤵
        
        PID:12592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50356.exe
        7⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7600.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56123.exe
        6⤵
        
        PID:8940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51387.exe
        6⤵
        
        PID:12372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34596.exe
        6⤵
        
        PID:15392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5488.exe
        6⤵
        
        PID:17416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32841.exe
        5⤵
        
        PID:6976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15332.exe
        6⤵
        
        PID:12072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
        6⤵
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65273.exe
        6⤵
        
        PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48427.exe
        5⤵
        
        PID:9388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10538.exe
        5⤵
        
        PID:13340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56204.exe
        5⤵
        
        PID:16748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7554.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-523.exe
        5⤵
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54628.exe
        6⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18988.exe
        7⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28611.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31034.exe
        7⤵
        
        PID:14756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22129.exe
        7⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
        6⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51091.exe
        6⤵
        
        PID:11688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45644.exe
        6⤵
        
        PID:15588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21056.exe
        6⤵
        
        PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27082.exe
        5⤵
        
        PID:7080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14180.exe
        6⤵
        
        PID:11764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33442.exe
        6⤵
        
        PID:15296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5601.exe
        6⤵
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41602.exe
        5⤵
        
        PID:8936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16707.exe
        5⤵
        
        PID:2384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33242.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50882.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21868.exe
        5⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54068.exe
        6⤵
        
        PID:8728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61004.exe
        6⤵
        
        PID:11728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8938.exe
        6⤵
        
        PID:16068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37890.exe
        6⤵
        
        PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51411.exe
        5⤵
        
        PID:9068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28522.exe
        5⤵
        
        PID:12736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65068.exe
        5⤵
        
        PID:14860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23744.exe
        5⤵
        
        PID:17892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8026.exe
      4⤵
      PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22541.exe
        5⤵
        
        PID:12124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19219.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36325.exe
      4⤵
      PID:9600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24130.exe
      4⤵
      PID:14040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56683.exe
      4⤵
      PID:17404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6674.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6674.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61044.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38468.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1763.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34732.exe
        7⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65292.exe
        8⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43020.exe
        9⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53884.exe
        9⤵
        
        PID:11504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47755.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30298.exe
        9⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64675.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51387.exe
        8⤵
        
        PID:12356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14803.exe
        8⤵
        
        PID:16060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5187.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35442.exe
        7⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58181.exe
        8⤵
        
        PID:10636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59292.exe
        8⤵
        
        PID:15128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15688.exe
        8⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21299.exe
        7⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9874.exe
        7⤵
        
        PID:13568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1523.exe
        7⤵
        
        PID:17984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8618.exe
        6⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38204.exe
        7⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7467.exe
        8⤵
        
        PID:9276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54860.exe
        8⤵
        
        PID:13116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        8⤵
        
        PID:16428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15497.exe
        8⤵
        
        PID:17016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18162.exe
        7⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34876.exe
        7⤵
        
        PID:13556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18058.exe
        7⤵
        
        PID:17876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55533.exe
        7⤵
        
        PID:224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36682.exe
        6⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-428.exe
        7⤵
        
        PID:11056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57564.exe
        7⤵
        
        PID:15036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40769.exe
        7⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19571.exe
        6⤵
        
        PID:9520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42635.exe
        6⤵
        
        PID:13844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8731.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48011.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12339.exe
        6⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46948.exe
        7⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49245.exe
        8⤵
        
        PID:11616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9515.exe
        8⤵
        
        PID:14420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24048.exe
        8⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45332.exe
        7⤵
        
        PID:10720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62531.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36314.exe
        6⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47605.exe
        7⤵
        
        PID:10200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41315.exe
        7⤵
        
        PID:12452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        7⤵
        
        PID:17588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45611.exe
        6⤵
        
        PID:10016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52644.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8162.exe
        6⤵
        
        PID:17004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54834.exe
        5⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14275.exe
        6⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13340.exe
        7⤵
        
        PID:15368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48194.exe
        7⤵
        
        PID:8200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44395.exe
        6⤵
        
        PID:9240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10842.exe
        6⤵
        
        PID:1832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48156.exe
        6⤵
        
        PID:17308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31411.exe
        5⤵
        
        PID:7260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24165.exe
        6⤵
        
        PID:11416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34019.exe
        6⤵
        
        PID:15340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56529.exe
        6⤵
        
        PID:2304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42811.exe
        5⤵
        
        PID:9992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27443.exe
        5⤵
        
        PID:14176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8692.exe
        5⤵
        
        PID:2708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26770.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8011.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9651.exe
        6⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14467.exe
        7⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47621.exe
        8⤵
        
        PID:11608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37003.exe
        8⤵
        
        PID:15048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28826.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37651.exe
        7⤵
        
        PID:13496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15867.exe
        7⤵
        
        PID:16724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5104.exe
        7⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11810.exe
        6⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58181.exe
        7⤵
        
        PID:10860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57179.exe
        7⤵
        
        PID:16104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7905.exe
        7⤵
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36204.exe
        6⤵
        
        PID:10404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54747.exe
        6⤵
        
        PID:7560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10577.exe
        6⤵
        
        PID:13160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16978.exe
        5⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11234.exe
        6⤵
        
        PID:7788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38699.exe
        6⤵
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37948.exe
        6⤵
        
        PID:13656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59785.exe
        6⤵
        
        PID:13180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35530.exe
        5⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23781.exe
        6⤵
        
        PID:11112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17299.exe
        6⤵
        
        PID:14724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25968.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11787.exe
        5⤵
        
        PID:9572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28410.exe
        5⤵
        
        PID:13916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24299.exe
        5⤵
        
        PID:17480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65307.exe
        5⤵
        
        PID:7812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51763.exe
      4⤵
      PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23108.exe
        5⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20732.exe
        6⤵
        
        PID:9196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53516.exe
        6⤵
        
        PID:13020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26338.exe
        6⤵
        
        PID:15516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30106.exe
        6⤵
        
        PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57851.exe
        5⤵
        
        PID:8608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1138.exe
        5⤵
        
        PID:13272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15867.exe
        5⤵
        
        PID:16828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23936.exe
        5⤵
        
        PID:5844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7073.exe
      4⤵
      PID:6224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41651.exe
      4⤵
      PID:9476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51525.exe
      4⤵
      PID:13764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1770.exe
      4⤵
      PID:17100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5905.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63164.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42988.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3211.exe
        6⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31956.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31491.exe
        7⤵
        
        PID:9428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21890.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15867.exe
        7⤵
        
        PID:16764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21632.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28146.exe
        6⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8596.exe
        7⤵
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56988.exe
        7⤵
        
        PID:14968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26736.exe
        7⤵
        
        PID:17528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36204.exe
        6⤵
        
        PID:10412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54747.exe
        6⤵
        
        PID:14236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3561.exe
        6⤵
        
        PID:17784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9578.exe
        5⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46948.exe
        6⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5420.exe
        7⤵
        
        PID:9416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40931.exe
        7⤵
        
        PID:13928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30768.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45355.exe
        6⤵
        
        PID:2656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10842.exe
        6⤵
        
        PID:12992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8083.exe
        6⤵
        
        PID:17088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
        6⤵
        
        PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24969.exe
        5⤵
        
        PID:7964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54045.exe
        6⤵
        
        PID:8600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40931.exe
        6⤵
        
        PID:13948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22586.exe
        6⤵
        
        PID:18068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15196.exe
        6⤵
        
        PID:9124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52156.exe
        5⤵
        
        PID:1428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28130.exe
        5⤵
        
        PID:14032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51802.exe
        5⤵
        
        PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4865.exe
      4⤵
      PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe
        5⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3227.exe
        6⤵
        
        PID:7424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44564.exe
        6⤵
        
        PID:10828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
        6⤵
        
        PID:14628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6626.exe
        5⤵
        
        PID:7292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2082.exe
        5⤵
        
        PID:11456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46412.exe
        5⤵
        
        PID:15240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42985.exe
        5⤵
        
        PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38515.exe
      4⤵
      PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13715.exe
        5⤵
        
        PID:9180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14787.exe
        5⤵
        
        PID:12696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        5⤵
        
        PID:15076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55330.exe
      4⤵
      PID:9228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57044.exe
      4⤵
      PID:13152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49341.exe
      4⤵
      PID:16708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54731.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54731.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34820.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34924.exe
        5⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15708.exe
        6⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30052.exe
        7⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14787.exe
        7⤵
        
        PID:12704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10002.exe
        7⤵
        
        PID:16808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38378.exe
        7⤵
        
        PID:8348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50259.exe
        6⤵
        
        PID:9144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21402.exe
        6⤵
        
        PID:12796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34596.exe
        6⤵
        
        PID:14648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19106.exe
        5⤵
        
        PID:6964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16957.exe
        6⤵
        
        PID:10712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
        6⤵
        
        PID:15256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32216.exe
        6⤵
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29468.exe
        5⤵
        
        PID:7748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55124.exe
        5⤵
        
        PID:13860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21586.exe
        5⤵
        
        PID:2764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33506.exe
      4⤵
      PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39268.exe
        5⤵
        
        PID:7820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10636.exe
        6⤵
        
        PID:13468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15291.exe
        6⤵
        
        PID:17840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7520.exe
        6⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32555.exe
        5⤵
        
        PID:10288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45260.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61321.exe
        5⤵
        
        PID:6568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43714.exe
      4⤵
      PID:7736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31684.exe
      4⤵
      PID:11256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44571.exe
      4⤵
      PID:14740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55258.exe
      4⤵
      PID:7384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9745.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9745.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4171.exe
      4⤵
      PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55604.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29189.exe
        6⤵
        
        PID:15384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32555.exe
        5⤵
        
        PID:10280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13154.exe
        5⤵
        
        PID:15156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48241.exe
        5⤵
        
        PID:17472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24010.exe
      4⤵
      PID:7444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58299.exe
      4⤵
      PID:10848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52852.exe
      4⤵
      PID:14544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5488.exe
      4⤵
      PID:17376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37226.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37226.exe
    3⤵
    PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38706.exe
      4⤵
      PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16957.exe
        5⤵
        
        PID:10760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51124.exe
        5⤵
        
        PID:15148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57489.exe
        5⤵
        
        PID:7996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13706.exe
      4⤵
      PID:9528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51300.exe
      4⤵
      PID:13872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17098.exe
      4⤵
      PID:17340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45937.exe
      4⤵
      PID:18412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58340.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58340.exe
    3⤵
    PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11346.exe
      4⤵
      PID:17884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55442.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55442.exe
    3⤵
    PID:9536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16299.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16299.exe
    3⤵
    PID:13852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17355.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17355.exe
    3⤵
    PID:17284
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54811.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54811.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10203.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10203.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29332.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1616
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1616 -s 724
        5⤵
        Program crash
        
        PID:1468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51851.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16180.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19164.exe
        6⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23300.exe
        7⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49821.exe
        8⤵
        
        PID:11376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
        8⤵
        
        PID:15232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9331.exe
        8⤵
        
        PID:1284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8650.exe
        7⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1138.exe
        7⤵
        
        PID:13280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15867.exe
        7⤵
        
        PID:16788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59129.exe
        7⤵
        
        PID:9296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61675.exe
        6⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31373.exe
        7⤵
        
        PID:10628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56988.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64697.exe
        7⤵
        
        PID:436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11786.exe
        6⤵
        
        PID:9492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59660.exe
        6⤵
        
        PID:13756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22770.exe
        6⤵
        
        PID:17132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13177.exe
        6⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55323.exe
        5⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55692.exe
        6⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50501.exe
        7⤵
        
        PID:12144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20274.exe
        6⤵
        
        PID:8232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59851.exe
        6⤵
        
        PID:12908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64492.exe
        6⤵
        
        PID:17020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24969.exe
        5⤵
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21884.exe
        6⤵
        
        PID:9104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14787.exe
        6⤵
        
        PID:12600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        6⤵
        
        PID:16440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22514.exe
        6⤵
        
        PID:7832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18803.exe
        5⤵
        
        PID:9688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36962.exe
        5⤵
        
        PID:14084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16131.exe
        5⤵
        
        PID:17296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61746.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53372.exe
        5⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53196.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46388.exe
        7⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14787.exe
        7⤵
        
        PID:12712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        7⤵
        
        PID:16820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48170.exe
        7⤵
        
        PID:7552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51411.exe
        6⤵
        
        PID:9016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28522.exe
        6⤵
        
        PID:12672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56900.exe
        6⤵
        
        PID:16476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe
        6⤵
        
        PID:8140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62635.exe
        5⤵
        
        PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28612.exe
        5⤵
        
        PID:10224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11602.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2793.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22162.exe
      4⤵
      PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56979.exe
        5⤵
        
        PID:8376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43412.exe
        5⤵
        
        PID:12856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25930.exe
        5⤵
        
        PID:15356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14993.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43026.exe
      4⤵
      PID:7016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54724.exe
      4⤵
      PID:10688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2916.exe
      4⤵
      PID:14916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50024.exe
      4⤵
      PID:7416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16674.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16674.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5603.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59812.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30124.exe
        7⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18988.exe
        8⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58788.exe
        8⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46987.exe
        8⤵
        
        PID:14596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12892.exe
        8⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25074.exe
        7⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34946.exe
        7⤵
        
        PID:11552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20755.exe
        7⤵
        
        PID:15396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13080.exe
        7⤵
        
        PID:1076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2578.exe
        6⤵
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3819.exe
        7⤵
        
        PID:8308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21419.exe
        7⤵
        
        PID:13092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34506.exe
        7⤵
        
        PID:16500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30298.exe
        7⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16905.exe
        6⤵
        
        PID:9260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8923.exe
        6⤵
        
        PID:13220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48235.exe
        6⤵
        
        PID:16412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32162.exe
        5⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20834.exe
        6⤵
        
        PID:460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49821.exe
        7⤵
        
        PID:11320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59868.exe
        7⤵
        
        PID:15204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7027.exe
        7⤵
        
        PID:16220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-953.exe
        6⤵
        
        PID:9332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19203.exe
        6⤵
        
        PID:13364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48235.exe
        6⤵
        
        PID:16404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45164.exe
        6⤵
        
        PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8337.exe
        5⤵
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4076.exe
        6⤵
        
        PID:9412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33147.exe
        6⤵
        
        PID:12756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30562.exe
        6⤵
        
        PID:18380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62882.exe
        6⤵
        
        PID:17304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20802.exe
        5⤵
        
        PID:10080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35715.exe
        5⤵
        
        PID:14036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51955.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63771.exe
      4⤵
      Executes dropped EXE
      PID:4636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45898.exe
      4⤵
      PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46652.exe
        5⤵
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60212.exe
        6⤵
        
        PID:7464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28611.exe
        6⤵
        
        PID:11192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31034.exe
        6⤵
        
        PID:14764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63354.exe
        6⤵
        
        PID:8016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8162.exe
        5⤵
        
        PID:8452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64651.exe
        5⤵
        
        PID:12052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30642.exe
        5⤵
        
        PID:15536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46875.exe
      4⤵
      PID:6936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39762.exe
      4⤵
      PID:8508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10147.exe
      4⤵
      PID:13516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7732.exe
      4⤵
      PID:17008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21984.exe
      4⤵
      PID:6536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24169.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24169.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26652.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11955.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45604.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22268.exe
        7⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
        7⤵
        
        PID:13260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59203.exe
        7⤵
        
        PID:16396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64506.exe
        7⤵
        
        PID:7584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43242.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28522.exe
        6⤵
        
        PID:12724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56900.exe
        6⤵
        
        PID:16572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5266.exe
        5⤵
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24933.exe
        6⤵
        
        PID:4748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57564.exe
        6⤵
        
        PID:15016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7027.exe
        6⤵
        
        PID:17852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30426.exe
        5⤵
        
        PID:9648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4019.exe
        5⤵
        
        PID:13972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32666.exe
        5⤵
        
        PID:17388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48883.exe
      4⤵
      PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14467.exe
        5⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32141.exe
        6⤵
        
        PID:11156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17299.exe
        6⤵
        
        PID:14704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23602.exe
        5⤵
        
        PID:9224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18539.exe
        5⤵
        
        PID:13268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2691.exe
        5⤵
        
        PID:17908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36019.exe
      4⤵
      PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4186.exe
      4⤵
      PID:10904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27651.exe
      4⤵
      PID:14600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59659.exe
      4⤵
      PID:816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2074.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2074.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27908.exe
      4⤵
      PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21100.exe
        5⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9579.exe
        6⤵
        
        PID:7892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28611.exe
        6⤵
        
        PID:11184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31034.exe
        6⤵
        
        PID:14712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37890.exe
        6⤵
        
        PID:4076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8546.exe
        5⤵
        
        PID:8204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51091.exe
        5⤵
        
        PID:11696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30642.exe
        5⤵
        
        PID:14796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5842.exe
      4⤵
      PID:7208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24933.exe
        5⤵
        
        PID:11008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57564.exe
        5⤵
        
        PID:15028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16264.exe
        5⤵
        
        PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4770.exe
      4⤵
      PID:9672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45628.exe
      4⤵
      PID:14076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32666.exe
      4⤵
      PID:17352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44826.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44826.exe
    3⤵
    PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38780.exe
      4⤵
      PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29987.exe
        5⤵
        
        PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14474.exe
      4⤵
      PID:7592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18539.exe
      4⤵
      PID:13324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18058.exe
      4⤵
      PID:17952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65203.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65203.exe
    3⤵
    PID:7020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31669.exe
      4⤵
      PID:11576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60740.exe
      4⤵
      PID:15952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28157.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28157.exe
    3⤵
    PID:9636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35427.exe
    3⤵
    PID:2148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62154.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62154.exe
    3⤵
    PID:6000
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20409.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20409.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44708.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44708.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38660.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42988.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25826.exe
        6⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51660.exe
        7⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58788.exe
        7⤵
        
        PID:10804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24788.exe
        7⤵
        
        PID:15928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5104.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4025.exe
        6⤵
        
        PID:804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7947.exe
        6⤵
        
        PID:11472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44955.exe
        6⤵
        
        PID:15316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37769.exe
        6⤵
        
        PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17938.exe
        5⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39268.exe
        6⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44.exe
        7⤵
        
        PID:11740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exe
        7⤵
        
        PID:15604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7904.exe
        7⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32555.exe
        6⤵
        
        PID:10264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30930.exe
        6⤵
        
        PID:12852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2913.exe
        6⤵
        
        PID:18056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29769.exe
        5⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21005.exe
        6⤵
        
        PID:14120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6355.exe
        6⤵
        
        PID:15596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12851.exe
        5⤵
        
        PID:10884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44187.exe
        5⤵
        
        PID:14616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54106.exe
        5⤵
        
        PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64347.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27908.exe
        5⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18900.exe
        6⤵
        
        PID:8164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60324.exe
        6⤵
        
        PID:10700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5186.exe
        6⤵
        
        PID:14932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14153.exe
        6⤵
        
        PID:17436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4706.exe
        5⤵
        
        PID:7692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57531.exe
        5⤵
        
        PID:10464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44876.exe
        5⤵
        
        PID:14808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29608.exe
        5⤵
        
        PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47626.exe
      4⤵
      PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63580.exe
        5⤵
        
        PID:7612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21789.exe
        6⤵
        
        PID:15168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41299.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20947.exe
        5⤵
        
        PID:14472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12888.exe
        5⤵
        
        PID:5144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43803.exe
      4⤵
      PID:7336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4186.exe
      4⤵
      PID:10812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27651.exe
      4⤵
      PID:14588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7938.exe
      4⤵
      PID:4220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51275.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51275.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24732.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57155.exe
        5⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38604.exe
        6⤵
        
        PID:8760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
        6⤵
        
        PID:13252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        6⤵
        
        PID:15024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46978.exe
        5⤵
        
        PID:7700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40812.exe
        5⤵
        
        PID:11588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20450.exe
        5⤵
        
        PID:14408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22969.exe
        5⤵
        
        PID:7492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39370.exe
      4⤵
      PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28692.exe
        5⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19284.exe
        6⤵
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35819.exe
        6⤵
        
        PID:10752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5186.exe
        6⤵
        
        PID:14960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27146.exe
        6⤵
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49195.exe
        5⤵
        
        PID:8468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15642.exe
        5⤵
        
        PID:12040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6723.exe
        5⤵
        
        PID:15568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54689.exe
        5⤵
        
        PID:7864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27361.exe
      4⤵
      PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24380.exe
        5⤵
        
        PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46883.exe
        5⤵
        
        PID:14096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22617.exe
        5⤵
        
        PID:18428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6832.exe
        5⤵
        
        PID:17108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44460.exe
      4⤵
      PID:9768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43979.exe
      4⤵
      PID:14184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57164.exe
      4⤵
      PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59659.exe
      4⤵
      PID:15556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42914.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42914.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59236.exe
      4⤵
      PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37628.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64932.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20267.exe
        6⤵
        
        PID:12616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2499.exe
        6⤵
        
        PID:18016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18162.exe
        5⤵
        
        PID:8840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44859.exe
        5⤵
        
        PID:12480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56900.exe
        5⤵
        
        PID:16420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23168.exe
        5⤵
        
        PID:7648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46875.exe
      4⤵
      PID:6468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24165.exe
        5⤵
        
        PID:11336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43147.exe
        5⤵
        
        PID:15276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9632.exe
        5⤵
        
        PID:7984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11891.exe
      4⤵
      PID:9668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12370.exe
      4⤵
      PID:13388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3561.exe
      4⤵
      PID:572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2946.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2946.exe
    3⤵
    PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32444.exe
      4⤵
      PID:8092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23996.exe
        5⤵
        
        PID:9300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65140.exe
        5⤵
        
        PID:13376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51035.exe
        5⤵
        
        PID:14644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40770.exe
        5⤵
        
        PID:1316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50708.exe
      4⤵
      PID:10172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22658.exe
      4⤵
      PID:14324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35276.exe
      4⤵
      PID:17652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29904.exe
      4⤵
      PID:5156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41298.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41298.exe
    3⤵
    PID:7848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23011.exe
    3⤵
    PID:11172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28765.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28765.exe
    3⤵
    PID:14696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-632.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-632.exe
    3⤵
    PID:17928
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60779.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60779.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7243.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35588.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12915.exe
        6⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63860.exe
        7⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53331.exe
        7⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13338.exe
        7⤵
        
        PID:13328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56900.exe
        7⤵
        
        PID:14928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6832.exe
        7⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54658.exe
        6⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12851.exe
        6⤵
        
        PID:10796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46195.exe
        6⤵
        
        PID:14436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10834.exe
        5⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43404.exe
        6⤵
        
        PID:8072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60324.exe
        6⤵
        
        PID:10740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5186.exe
        6⤵
        
        PID:14976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13385.exe
        6⤵
        
        PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe
        5⤵
        
        PID:8396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4979.exe
        5⤵
        
        PID:12024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63595.exe
        5⤵
        
        PID:15524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48203.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14067.exe
        5⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47524.exe
        6⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54068.exe
        7⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61004.exe
        7⤵
        
        PID:11712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8938.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32410.exe
        7⤵
        
        PID:1468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26522.exe
        6⤵
        
        PID:9152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28522.exe
        6⤵
        
        PID:12256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65068.exe
        6⤵
        
        PID:16248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29608.exe
        6⤵
        
        PID:6656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44675.exe
        5⤵
        
        PID:7272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32146.exe
        5⤵
        
        PID:11560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53116.exe
        5⤵
        
        PID:14476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6018.exe
        5⤵
        
        PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21497.exe
      4⤵
      PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38780.exe
        5⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17829.exe
        6⤵
        
        PID:12880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14995.exe
        6⤵
        
        PID:15792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27866.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10842.exe
        5⤵
        
        PID:12972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48348.exe
        5⤵
        
        PID:17244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24867.exe
      4⤵
      PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8124.exe
        5⤵
        
        PID:12524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30755.exe
        5⤵
        
        PID:15068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2040.exe
        5⤵
        
        PID:17556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27626.exe
      4⤵
      PID:9624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28595.exe
      4⤵
      PID:14024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17820.exe
      4⤵
      PID:4584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35618.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35618.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51732.exe
      4⤵
      Executes dropped EXE
      PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29444.exe
        5⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25044.exe
        6⤵
        
        PID:7896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32555.exe
        6⤵
        
        PID:10272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45260.exe
        6⤵
        
        PID:14500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61897.exe
        6⤵
        
        PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48322.exe
        5⤵
        
        PID:8512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38228.exe
        5⤵
        
        PID:12180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54659.exe
        5⤵
        
        PID:15848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48241.exe
        5⤵
        
        PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35146.exe
      4⤵
      PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30436.exe
        5⤵
        
        PID:8680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
        5⤵
        
        PID:13140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34506.exe
        5⤵
        
        PID:16488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51650.exe
        5⤵
        
        PID:8660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4321.exe
      4⤵
      PID:8888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17179.exe
      4⤵
      PID:12292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41691.exe
      4⤵
      PID:2056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5145.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5145.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:4228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52059.exe
      4⤵
      PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56979.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        5⤵
        
        PID:11956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30642.exe
        5⤵
        
        PID:14788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5097.exe
        5⤵
        
        PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38810.exe
      4⤵
      PID:7628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32634.exe
      4⤵
      PID:12608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25155.exe
      4⤵
      PID:14888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63299.exe
      4⤵
      PID:3644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38411.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38411.exe
    3⤵
    PID:5728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29733.exe
      4⤵
      PID:7604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64476.exe
      4⤵
      PID:13384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20858.exe
      4⤵
      PID:17884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1521.exe
    3⤵
    PID:9008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7931.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7931.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:12556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26461.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26461.exe
    3⤵
    PID:1972
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30497.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30497.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22620.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22620.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9459.exe
      4⤵
      PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62988.exe
        5⤵
        
        PID:6012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17364.exe
        6⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41653.exe
        7⤵
        
        PID:10472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15954.exe
        7⤵
        
        PID:14492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30298.exe
        7⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12083.exe
        6⤵
        
        PID:11244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31034.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13769.exe
        6⤵
        
        PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8162.exe
        5⤵
        
        PID:8444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64651.exe
        5⤵
        
        PID:12016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30642.exe
        5⤵
        
        PID:15696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35442.exe
      4⤵
      PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61461.exe
        5⤵
        
        PID:14300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54596.exe
        5⤵
        
        PID:16756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26736.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4194.exe
      4⤵
      PID:9400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43516.exe
      4⤵
      PID:13484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7010.exe
      4⤵
      PID:17120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5097.exe
      4⤵
      PID:5648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38602.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38602.exe
    3⤵
    PID:4724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5619.exe
      4⤵
      PID:2836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16957.exe
        5⤵
        
        PID:11096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59868.exe
        5⤵
        
        PID:15196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43073.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47763.exe
      4⤵
      PID:8916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13900.exe
        5⤵
        
        PID:14388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51387.exe
      4⤵
      PID:12364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34596.exe
      4⤵
      PID:4428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21632.exe
      4⤵
      PID:5740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32841.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32841.exe
    3⤵
    PID:6956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41845.exe
      4⤵
      PID:10496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42955.exe
      4⤵
      PID:15104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58641.exe
      4⤵
      PID:7520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48427.exe
    3⤵
    PID:4832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8042.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:13052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22955.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22955.exe
    3⤵
    PID:17264
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32514.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32514.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-139.exe
    3⤵
    PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62988.exe
      4⤵
      PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54068.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61004.exe
        5⤵
        
        PID:11752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8938.exe
        5⤵
        
        PID:15584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65082.exe
        5⤵
        
        PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55931.exe
      4⤵
      PID:8904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51387.exe
      4⤵
      PID:12380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34596.exe
      4⤵
      PID:14672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5104.exe
      4⤵
      PID:3512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35442.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35442.exe
    3⤵
    PID:6988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24165.exe
      4⤵
      PID:11404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
      4⤵
      PID:15248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61929.exe
      4⤵
      PID:2280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42562.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42562.exe
    3⤵
    PID:8708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16707.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16707.exe
    3⤵
    PID:12996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39299.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39299.exe
    3⤵
    PID:16992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26449.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26449.exe
    3⤵
    PID:6576
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe
  2⤵
  PID:1812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38292.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38292.exe
    3⤵
    PID:6296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47045.exe
      4⤵
      PID:12132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27387.exe
      4⤵
      PID:15816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24240.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9610.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9610.exe
    3⤵
    PID:8160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1714.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1714.exe
    3⤵
    PID:13004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34596.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34596.exe
    3⤵
    PID:14664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64777.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64777.exe
    3⤵
    PID:17816
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8849.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8849.exe
  2⤵
  PID:7132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43316.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43316.exe
    3⤵
    PID:9076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7667.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7667.exe
    3⤵
    PID:12784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28730.exe
    3⤵
    PID:14348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14153.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14153.exe
    3⤵
    PID:7668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12466.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12466.exe
  2⤵
  PID:8924
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51443.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51443.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:13084
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63900.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63900.exe
  2⤵
  PID:16448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 1616 -ip 1616
1⤵
PID:3236

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10203.exe

Filesize
468KB

MD5
6ecfaae30037ea86b34ee4a26463b532

SHA1
e474ce5d2a34867605c1666fb989cb0d4c33792a

SHA256
ef73a70f2824e6c1a82b6f9ec6b5891046bada7c2bc60e247020961948ad3bba

SHA512
fc575c9c75557f072e5f95be850126b5d8747bcfff1416e8f29b63cff5e380bd54dda66ef4b48598363b43ae703cf50151b62f6f5e1185d75a12346fb699c858

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16674.exe

Filesize
468KB

MD5
1e542c0f77f2caa0914bdbbbe2c52d7f

SHA1
b55e3dbaceb035d8d6f204b801dce6e199611229

SHA256
24cf3cf945e290790930b36c790bf0590a85cae128cde6daff7ae6214c7d083f

SHA512
67767d255bea2df61374be5ba3408524cdb796b9808fb1e93c207e98a5a631f93dc504e539e8cbf4d6915d5d2bd50eeb44e4b48b51633008b93fbf01ed123f57

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20409.exe

Filesize
468KB

MD5
21e131f99b159a20917a7e4109f7d6c4

SHA1
e7c9825cd7e95475ef5a27ec9defc93f3ec058c1

SHA256
b1ef4c3907cf766ce59b154a0ad173f01f3493facc744e4ee1af9c9f607c64e4

SHA512
47c98be59eea3022e906848b932aed292a29d75336355d261b5d3f48b7f390176b7790ac22787a36333c5907fcd001b944dc8daf242e617775b0a61f71a2a472

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22708.exe

Filesize
468KB

MD5
bd428ccda75fc1d08b8dde5ec5010764

SHA1
36ed9b3b15f65f3026688f8b8c3e7b1ce9011fe1

SHA256
226854c9b19e0e6f33b5c5153f7c6e87567e4e401cbeb9c9d7f73ac3f10842ee

SHA512
75e77b99b72b7236f1a2fe900d843b75d2ccc4bc6bcfe1fc03989ec165aa046412b11dd5c811b5c5dfeb13603a6c6c7bbd6809f7c24373f910431dc1d1544f54

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24169.exe

Filesize
468KB

MD5
92fcfb9e4a6d6f0015e5a862da960f62

SHA1
dac6aa61eeb376d012a61a08aedc2bbc5c37613e

SHA256
adbb36f3748f6388781d57895d2e086a46ff9cb977cd322588f8cb8cb85eb3af

SHA512
0a1f14b156270db26f22ffaef4f7e4fab9b3b6b9585d3eaa6e3869ee5c41affec221c30b2fe681e15881af27b3d381de54b3574caf1801bc79d6cbee6d0a1d79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe

Filesize
468KB

MD5
4479ce338dce395ea710a51eaafe72b1

SHA1
847da21108a9769e178a98cd3b6b47d931031d00

SHA256
4a1badcff9b873773b5efb014e499688a6f29fb70e398c21d30f9001b29f9aa3

SHA512
3cb1c49e6ed9b80be1395c81654189013c8556045d434de810179989e1caa4a42d0284ff24e2f63bec4fe973893ce6d5d5983d45bd0da3a0400c68502c384aef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25618.exe

Filesize
468KB

MD5
7ff62b8122792ecee356800e9af42123

SHA1
d86c36c79ca98e80fbb3a5e56419abc9ab8d3b13

SHA256
a193525a074e7e94691edce545a4d8712476b36f3b128e15295105b53c3b9973

SHA512
c20266d6b30870ccbdd59f381bfc9207e1acb18caa9cefe5bd35892bc4b96a34fb6205113cf499b9fc4009fbcb670998bf71b0b5886ffa6dfbc30e3e99a9cb43

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26770.exe

Filesize
468KB

MD5
d187e4da452810e37f72efa961ecf207

SHA1
91d75bb3acc94c37bcb811f2f806c8fa2c3b1456

SHA256
d28acc74dbd4752de5699fa365a4d8eb2c09ff396fcfc3b71f41cf1ac06e98d5

SHA512
6af0637df558f0970095b80d41433a8f389a297becf0bf3f994e26682951743488471903f5cabf721f6b633e4a4ceb18270b23bbaf0c9a04d2af2b7dd6634570

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29332.exe

Filesize
468KB

MD5
56bf67df271893fd7bba5e4dbda6a081

SHA1
c553a88c633bdd98ed6405b14e036b0a9032236e

SHA256
62e09bddaf2af0455eb7133184cc57442a8599a5521ef183d83f135f519d9d37

SHA512
88ecc8dd42ee4c326650e3c251b61c26a086ad203078eac2ef723cb59252da7d95cd4d6e0152c95c82ff532576f5e1a5cfdb0b0d0bba1df60d97919e233d5cac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30497.exe

Filesize
468KB

MD5
3074bf8f633f08c0b448359f53aa61fc

SHA1
379cbfbc8efc59c5497df27bda5766ed9f96472b

SHA256
1bb1dad64f7cd94ede7fb5f9574ebe7676319e10bdf8683b576de730a6f0dcff

SHA512
0274ede782ed9602c456072a3d2b6324e4d6022457d423b28ac52a2bab8e38bd3f179818dde592fb0d8bfc3e6dffd0ac3ea4290f66c5938bda9a8116b7dfccb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38394.exe

Filesize
468KB

MD5
ce3aa3bf54241e01f3046292ed549171

SHA1
01591b1c998ddc562c031fa376f1c918ff0530d5

SHA256
38febaf1a42d5a86dd94bf7a2b8a8020386995b1a8dc89e73de0477d3e93f753

SHA512
375fa0f3936a62a5261fb3cb326982fc8a336758da452aee12741e42c6779c3c1349fe6fab9eaa72664efe8c69cac9b93467df86e267dd93c7660b2c8491793f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38468.exe

Filesize
468KB

MD5
f622353ee457843640b23feea70f1a36

SHA1
edd60f13563d50ee15bdfea21a7884915532007c

SHA256
9b859f790089e5adee953c8b22f049bbd97d75b6e64df51f44e20892a2bf819c

SHA512
6b6c5111661e18c2f369e652f6ceccfafe096b705825f17d5195c4aa7490f290135dd5b06d6c234889ed27875c569e8b702a58e6ddde9c4169a12e3843665caf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38660.exe

Filesize
468KB

MD5
d32684742a70e5c20ab41520b4734214

SHA1
78a2f0616996722548b6022f25f7635653af73c1

SHA256
aa5842698b50ecca4fb2917871a6a88ce9b46b516e4229aecb281b38cf6d2b81

SHA512
70afb1bb0ddb5d438d9f205154754686f9b4d2a9654359b7e64f98428df42806db779a7b9b1c424b896330e5a24fe84bf446334380497c6db1a750bbac2ede92

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44708.exe

Filesize
468KB

MD5
6c49e5f3aae2be509010deb7c0922853

SHA1
25bbeb5493791641bcf0fbed240a0b2faa9afef1

SHA256
be1f84916700d94b0fd020102066814db5570f7d0449d094a7289143e14367d3

SHA512
e772b94b5cd5b5d6b8f92db0eb2893fc12b120c5f50237683270a8aab67987d9c9198079cd0e32779b477d0fdb20176bb7b3c9382bd16cbc0ae562b7b459dea2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4643.exe

Filesize
468KB

MD5
f16e6358f5c44212ccaead32e496938d

SHA1
f9195ae9327df0bf894cb24fa5121b97fb6b83cc

SHA256
597fbda655c19c663b29af0d8cc325add7b31eae3ba8a945e183733a84a301a7

SHA512
e58d94f3540be8cfb551ddfeaae23cc9a25788830df3f44ab066ebdb1923c6ead3b6fe6dfda4987cd34b3a2d00f26b544e21b1a2d8c6b4c2c9729f7e93a7fc26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50172.exe

Filesize
468KB

MD5
e66b6995057e5af79c0670fbed021c8f

SHA1
2b3c289c4865e8a2ecbf88d217b17fa9b778ac74

SHA256
8c48afb6b9369a03d8c27662a6350a01a6baf1467314d405a792c38efcf21ebb

SHA512
1b93bbc234ae34a750f4ad96b5b761258085fbf7759fcbefec144a693fbc58e35009d55d1e81af89414fb2802d4421e8f8a651c64ff7f2de640d60fac8ccee4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50499.exe

Filesize
468KB

MD5
e0893f588faac1cc657ffb5a586ae90c

SHA1
a45b4f46e50de19b8eb55f6901816dad3cd55985

SHA256
61f30145d3ef3f58ae6db124e0ce02774fd191b2d861b9fa63e9f1fc26d7a09c

SHA512
4a4b42556756d6d257a00844fb4107f75a5764ca6d2cae6d1518c2497c37795d8135a9b9b1c238b7ba5ae41d2c99849bb475d0ecbdca1c51e6abc30d36fb400c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51275.exe

Filesize
468KB

MD5
a64997a9f6d6e3613cf589877466a553

SHA1
2d32f45fe0e958431ec68080adccced484586b6e

SHA256
1771f8c99071aa859c5ed5d5f4ed65bc9b570b9052a17ceacad9689c8618eaad

SHA512
4629fd5b1ca77dc68a51ac2d050aa01edc6102a32fe7009ec95562b3d9df7e05bb3fbe9bd96157c9827128f55337f99b0712b33c488af591e73840364ef2e781

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51851.exe

Filesize
468KB

MD5
be1bbee433c8781d95913f3d6813cef8

SHA1
739cbd2238a16d4b8db8bf9fd024fea6ffb34dae

SHA256
7cec40662c6e0d9293e7ce8332fcff13caae3a5c3464abd23c07110fee92696b

SHA512
51c5696039e24315dc13d8ff18743e9aa1da938692890dbb0eaa0a3191dc4a7b50dba9764586f4fb6661eebc307755278be138ed8be4c390741f5e22f45ad1a3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54731.exe

Filesize
468KB

MD5
854478e5116e25c7a42df5cb5bd9d18a

SHA1
b834ab9d44bb0aa1cb5fdf5d04ea98f798d05c2c

SHA256
6d46a565bd59b2574db6afeacaf935ac51fcaf3025b434c2de27b0479ce8248d

SHA512
7c121795dbbf1bffa5978da0e1cf21335bc655f9eba416cd16041ccf2ad8fe663538296fc5c7db82725549a1c26a3226a0b43d8de763cd94496a90f6b11f82b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54811.exe

Filesize
468KB

MD5
607c58a41bea66805de78d88f61ac30d

SHA1
9f8e377092bbaf577d125dff02c0ac923b20710b

SHA256
d24c108142fa310f3e28b8e4c909d49c731fd98d4ecb2c8e50163643fc9482cf

SHA512
402dbab4e2dc307f0fc380ec470089e377f9c49fc541e8b52b8d8738e83c2f192180ee0d9617fbe23d870cac3cc1a1f85d14621282cfe9b8223b5cf7e413681a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5603.exe

Filesize
468KB

MD5
84420f34400c32cea8fcf51eee957ee5

SHA1
3fb02b8acbbd1b01632a101280dcd5fbcdf44da2

SHA256
a150280c4d28a5e4c98abf3c1362bb7687464cfba9aa976e95618b2736e279de

SHA512
814a354ee818ff2ef250daf1c390bf1de7cceb8fc06dbc6d438b77e8a18ee443135c51f8a5a3dbbaf17d5beddbc51fd6ec3d852f628c2cb19f29d2b38b0fb1be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5905.exe

Filesize
468KB

MD5
4cc916888a800832edbe850e4e7cdb7e

SHA1
826f8de0aa4f9f12a78bb503cf2ea30f195e7510

SHA256
e88d4f0bed4f19a82cbb74ad019a2870f25b105d6a77f3915e9f562e477e50ae

SHA512
1058a208d1f2ec9bf16dc1c0cdb6287d54ccefc21d7669538b8258bfb20d0291fe525a742d1058019db92c154eb214b085b088a3e87f8f7d1fd90c7593a938f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59812.exe

Filesize
468KB

MD5
fc0c48af50c42c37eb3d86fb7b01492d

SHA1
3de2f463f00e1e0cca949c7f4e10f6e12d876b91

SHA256
ad25c0c88e2122ebc3b9a6847eeba476794a6958911d0d4eb43ad072364a204d

SHA512
c866e0e09d7a79acaeff3d594a560410373f11d45e32a8b17fb9908270aca7f53d43eefba8f4bd6e8c4178524384ac29d3c096ddaf967958fddc8cb25889e283

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60779.exe

Filesize
468KB

MD5
3052d988109a981fd7d83639f7c5fbff

SHA1
609cd6eb68f5c18bbc81afbe6cecca1515c810ae

SHA256
8ce05e2f015e4c9c687ebd7642e286e710c68c097a692d9a6e38a12bd7a77dde

SHA512
67934e69218497c89ac44217c5c4af45798d11fd9eb93478b2f2ae7d61cb448fababe6bddad67dd42ee599fc4b30eed9687ab75f815f1b5d85aef9746e414b09

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61044.exe

Filesize
468KB

MD5
aba7262dbc3895b8d8e1572b81f344fc

SHA1
20518b57562967a28a5ee8b3d867d2f78c73a77f

SHA256
6e495084f48eca42e11c223ca628afd3c9f1cd5dec205abdea74de130efc2a25

SHA512
8b961d3b87ec3df467b6f6e109dcf588d5b36e5a28a3f79c990b68eb6e19a06d8399318964069b6acf4118f9928bf6174c051f8e976ceecea98c5414d3425907

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61820.exe

Filesize
468KB

MD5
3a5b3abd01194b3b00c86a82823fd705

SHA1
b46a197ed7d7964374c6b0c769682b011e9a5a22

SHA256
af82ef76e18a5c0e0eb59f025edd513be50b2c9314367847d1e065cc83fb415f

SHA512
15212a6585414266ba0b082e1ca25811a99369db23c01db607489cd87393cf76d7eecd06bdee03be114573e8e8c6f89b5faa827f607c15035f27e5317be5e7b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62004.exe

Filesize
468KB

MD5
2b9cd9043c8e3d81200ba8d98f996dcf

SHA1
dd8d67e303c6de638ca053229376dcdcb8fe27d8

SHA256
5655d423454c3215578a6b0290d485d3bced27eda01df25f75a55f2cf3c775ac

SHA512
506725472866c27832297d3a4f218e4bd86a82b1a5fd95ab98d7d0d3434b9bf83a352de4b27bc2e08804642b2bc2b6d25844586796790167cfa8a6c12c3ea806

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63164.exe

Filesize
468KB

MD5
b0e13e422c697be82340f2f36df38a19

SHA1
5c51d146062e94a2bd1ae4976cbe62d0848f18c3

SHA256
43dee1afc17185abec933f689cb3cbfcbf444c4c20ddac36b323ed50583155cd

SHA512
6fcccc2da869a49e03f11bc6e6b45015fd65a40f68259282147cbea23b7762e2de29ae227af6501f8212199ff6fecf55c35ab51ae2f6b97757799303213072c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6674.exe

Filesize
468KB

MD5
1cd21eddaaf30fd3fa09c9fd406b003a

SHA1
fa980f53379ed7ce2520335c392171bea87fd5cc

SHA256
9d2de8df858c9dfb50ef6090e7570886b0b0ad05b6499ad043881ed619c14f6a

SHA512
e43f556240a22042f8852d9563c8690208755b0cb60ed81391abd34dec94a9a68a8130739b8640f83f5c15608b8f35f4b97a75b2e9dbb15b988345754a702747

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-675.exe

Filesize
468KB

MD5
f97071d0cb313a8c75ae9861eaa0571b

SHA1
74435afe702be48ce6f04061c9714c6c777fd06d

SHA256
584b51c6264ae5b8494afa223acd64de58671f7b8122a483ebe12d30ede380d9

SHA512
b46460f0b918da829bef1c38dabade860eef91029df0bc134119f434d314c1850fdc144d53a188d7d75b2bd70fdea1b1141142f0e346dc764273d63a83cd0172

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7243.exe

Filesize
468KB

MD5
e1f9b870f44afcaec7947ff90bc104d4

SHA1
78b85898bc83bb974d929ba989d70b59c1cf6465

SHA256
711d9fb706f87cf7c15480c11b198fef0361c489a023e052faeae19d30f582ef

SHA512
c9d40dd0d475ada5c726f0475d326e326adb46ad5e44aaef3fd71af62fc02c1e64f4a2fb9361faf83660f2b85a587da249d80574a19e383de991c221244e8af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-817.exe

Filesize
468KB

MD5
c8b4686a9e40c8bff2442b0d88d14a56

SHA1
9dc7e528ac9cec24bfa42870a81970e08663e746

SHA256
1b64f8706e9b606f62300d640b46596ebda938385076f323f72d3dfb940e30c9

SHA512
f2475cf61273c2753fe616df95ed5fff5b58b6cbb71b2b1634c62a0b5d35990a75d217773695d01f1c26072226223706f8bf5017c5290945e7f212bfc4492a30

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads