75dce2079121ce2503db714a6c5bbad8abd18ae9e9d9deae45e08cfc66d34aac

Analysis

max time kernel
119s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 03:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

add94f02791e08687419ddea8040b180N.exe
Size

468KB
MD5

add94f02791e08687419ddea8040b180
SHA1

295483c0803a78ef9f88be5f0d14667e4eba148f
SHA256

75dce2079121ce2503db714a6c5bbad8abd18ae9e9d9deae45e08cfc66d34aac
SHA512

773e39fcfe2157c7098a434817e279a1a3ed86172577b442c3953c7e3e29365c95c15628dbf79ecf4e51f70f9d48e498c93fe629c56861685e0953e1d16329f5
SSDEEP

3072:P1D/ogLda88UnF/02z5FapwcfhzWI8JnmHe0VpSf2u3i2FN42l5:P1bo9RUnm21FapGxPDf2k1FN4

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2340	Unicorn-10484.exe
2744	Unicorn-63349.exe
1176	Unicorn-28024.exe
4280	Unicorn-7848.exe
5092	Unicorn-27714.exe
624	Unicorn-10801.exe
1920	Unicorn-4671.exe
2728	Unicorn-62418.exe
4300	Unicorn-62418.exe
3064	Unicorn-7279.exe
4784	Unicorn-13409.exe
4312	Unicorn-32169.exe
4668	Unicorn-59081.exe
1928	Unicorn-57456.exe
3804	Unicorn-43720.exe
1224	Unicorn-33602.exe
3596	Unicorn-61977.exe
3644	Unicorn-2081.exe
1292	Unicorn-2081.exe
4296	Unicorn-61104.exe
2972	Unicorn-47369.exe
4156	Unicorn-1012.exe
820	Unicorn-57619.exe
4320	Unicorn-34489.exe
3604	Unicorn-1697.exe
1912	Unicorn-1697.exe
816	Unicorn-31224.exe
552	Unicorn-61858.exe
2492	Unicorn-61858.exe
4248	Unicorn-29378.exe
4508	Unicorn-61587.exe
3824	Unicorn-47852.exe
4928	Unicorn-1915.exe
3944	Unicorn-52258.exe
4676	Unicorn-46128.exe
464	Unicorn-2097.exe
2700	Unicorn-2097.exe
1712	Unicorn-2948.exe
4488	Unicorn-48236.exe
4532	Unicorn-48236.exe
4740	Unicorn-38610.exe
2808	Unicorn-54261.exe
4260	Unicorn-51225.exe
4336	Unicorn-5288.exe
2188	Unicorn-38418.exe
1656	Unicorn-45248.exe
3320	Unicorn-34312.exe
1944	Unicorn-54178.exe
4376	Unicorn-5169.exe
2620	Unicorn-5169.exe
4960	Unicorn-12568.exe
4116	Unicorn-31903.exe
4416	Unicorn-32274.exe
1800	Unicorn-31698.exe
1428	Unicorn-50338.exe
1724	Unicorn-46617.exe
444	Unicorn-33618.exe
3856	Unicorn-65029.exe
4480	Unicorn-58899.exe
3268	Unicorn-49570.exe
916	Unicorn-49570.exe
3304	Unicorn-561.exe
1260	Unicorn-49762.exe
3140	Unicorn-23369.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
16156	9208	WerFault.exe	386
18588	9208	WerFault.exe	386

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15383.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48236.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31768.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44367.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28674.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36227.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51737.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63859.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36843.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7684.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18171.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20322.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58418.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53898.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4306.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46336.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16834.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31295.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37869.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36597.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23688.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32764.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54428.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17797.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62582.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32674.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3320.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34831.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-424.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13381.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60042.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42966.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6104.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22440.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16680	dwm.exe
Token: SeChangeNotifyPrivilege	16680	dwm.exe
Token: 33	16680	dwm.exe
Token: SeIncBasePriorityPrivilege	16680	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3956	add94f02791e08687419ddea8040b180N.exe
2340	Unicorn-10484.exe
2744	Unicorn-63349.exe
1176	Unicorn-28024.exe
5092	Unicorn-27714.exe
4280	Unicorn-7848.exe
1920	Unicorn-4671.exe
624	Unicorn-10801.exe
2728	Unicorn-62418.exe
4312	Unicorn-32169.exe
4784	Unicorn-13409.exe
4668	Unicorn-59081.exe
3064	Unicorn-7279.exe
4300	Unicorn-62418.exe
1928	Unicorn-57456.exe
1224	Unicorn-33602.exe
3596	Unicorn-61977.exe
3644	Unicorn-2081.exe
1292	Unicorn-2081.exe
4156	Unicorn-1012.exe
4296	Unicorn-61104.exe
2972	Unicorn-47369.exe
4320	Unicorn-34489.exe
816	Unicorn-31224.exe
3604	Unicorn-1697.exe
1912	Unicorn-1697.exe
820	Unicorn-57619.exe
552	Unicorn-61858.exe
2492	Unicorn-61858.exe
4676	Unicorn-46128.exe
3944	Unicorn-52258.exe
3824	Unicorn-47852.exe
4928	Unicorn-1915.exe
4248	Unicorn-29378.exe
4508	Unicorn-61587.exe
2700	Unicorn-2097.exe
464	Unicorn-2097.exe
1712	Unicorn-2948.exe
4488	Unicorn-48236.exe
4532	Unicorn-48236.exe
4740	Unicorn-38610.exe
4260	Unicorn-51225.exe
4336	Unicorn-5288.exe
2808	Unicorn-54261.exe
4960	Unicorn-12568.exe
1656	Unicorn-45248.exe
2620	Unicorn-5169.exe
2188	Unicorn-38418.exe
4116	Unicorn-31903.exe
4376	Unicorn-5169.exe
3320	Unicorn-34312.exe
1944	Unicorn-54178.exe
4416	Unicorn-32274.exe
1800	Unicorn-31698.exe
1428	Unicorn-50338.exe
4332	Unicorn-30472.exe
1724	Unicorn-46617.exe
3856	Unicorn-65029.exe
444	Unicorn-33618.exe
4480	Unicorn-58899.exe
3140	Unicorn-23369.exe
2012	Unicorn-23634.exe
3304	Unicorn-561.exe
2084	Unicorn-19720.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 2340	3956	add94f02791e08687419ddea8040b180N.exe	87
PID 3956 wrote to memory of 2340	3956	add94f02791e08687419ddea8040b180N.exe	87
PID 3956 wrote to memory of 2340	3956	add94f02791e08687419ddea8040b180N.exe	87
PID 2340 wrote to memory of 2744	2340	Unicorn-10484.exe	88
PID 2340 wrote to memory of 2744	2340	Unicorn-10484.exe	88
PID 2340 wrote to memory of 2744	2340	Unicorn-10484.exe	88
PID 3956 wrote to memory of 1176	3956	add94f02791e08687419ddea8040b180N.exe	89
PID 3956 wrote to memory of 1176	3956	add94f02791e08687419ddea8040b180N.exe	89
PID 3956 wrote to memory of 1176	3956	add94f02791e08687419ddea8040b180N.exe	89
PID 2340 wrote to memory of 4280	2340	Unicorn-10484.exe	90
PID 2340 wrote to memory of 4280	2340	Unicorn-10484.exe	90
PID 2340 wrote to memory of 4280	2340	Unicorn-10484.exe	90
PID 2744 wrote to memory of 5092	2744	Unicorn-63349.exe	91
PID 2744 wrote to memory of 5092	2744	Unicorn-63349.exe	91
PID 2744 wrote to memory of 5092	2744	Unicorn-63349.exe	91
PID 1176 wrote to memory of 624	1176	Unicorn-28024.exe	92
PID 1176 wrote to memory of 624	1176	Unicorn-28024.exe	92
PID 1176 wrote to memory of 624	1176	Unicorn-28024.exe	92
PID 3956 wrote to memory of 1920	3956	add94f02791e08687419ddea8040b180N.exe	93
PID 3956 wrote to memory of 1920	3956	add94f02791e08687419ddea8040b180N.exe	93
PID 3956 wrote to memory of 1920	3956	add94f02791e08687419ddea8040b180N.exe	93
PID 4280 wrote to memory of 2728	4280	Unicorn-7848.exe	94
PID 4280 wrote to memory of 2728	4280	Unicorn-7848.exe	94
PID 4280 wrote to memory of 2728	4280	Unicorn-7848.exe	94
PID 5092 wrote to memory of 4300	5092	Unicorn-27714.exe	95
PID 5092 wrote to memory of 4300	5092	Unicorn-27714.exe	95
PID 5092 wrote to memory of 4300	5092	Unicorn-27714.exe	95
PID 2340 wrote to memory of 3064	2340	Unicorn-10484.exe	96
PID 2340 wrote to memory of 3064	2340	Unicorn-10484.exe	96
PID 2340 wrote to memory of 3064	2340	Unicorn-10484.exe	96
PID 624 wrote to memory of 4784	624	Unicorn-10801.exe	97
PID 624 wrote to memory of 4784	624	Unicorn-10801.exe	97
PID 624 wrote to memory of 4784	624	Unicorn-10801.exe	97
PID 3956 wrote to memory of 4312	3956	add94f02791e08687419ddea8040b180N.exe	98
PID 3956 wrote to memory of 4312	3956	add94f02791e08687419ddea8040b180N.exe	98
PID 3956 wrote to memory of 4312	3956	add94f02791e08687419ddea8040b180N.exe	98
PID 1176 wrote to memory of 4668	1176	Unicorn-28024.exe	99
PID 1176 wrote to memory of 4668	1176	Unicorn-28024.exe	99
PID 1176 wrote to memory of 4668	1176	Unicorn-28024.exe	99
PID 2744 wrote to memory of 1928	2744	Unicorn-63349.exe	104
PID 2744 wrote to memory of 1928	2744	Unicorn-63349.exe	104
PID 2744 wrote to memory of 1928	2744	Unicorn-63349.exe	104
PID 1920 wrote to memory of 3804	1920	Unicorn-4671.exe	105
PID 1920 wrote to memory of 3804	1920	Unicorn-4671.exe	105
PID 1920 wrote to memory of 3804	1920	Unicorn-4671.exe	105
PID 2728 wrote to memory of 1224	2728	Unicorn-62418.exe	106
PID 2728 wrote to memory of 1224	2728	Unicorn-62418.exe	106
PID 2728 wrote to memory of 1224	2728	Unicorn-62418.exe	106
PID 4280 wrote to memory of 3596	4280	Unicorn-7848.exe	107
PID 4280 wrote to memory of 3596	4280	Unicorn-7848.exe	107
PID 4280 wrote to memory of 3596	4280	Unicorn-7848.exe	107
PID 4784 wrote to memory of 1292	4784	Unicorn-13409.exe	109
PID 4784 wrote to memory of 1292	4784	Unicorn-13409.exe	109
PID 4784 wrote to memory of 1292	4784	Unicorn-13409.exe	109
PID 4668 wrote to memory of 3644	4668	Unicorn-59081.exe	108
PID 4668 wrote to memory of 3644	4668	Unicorn-59081.exe	108
PID 4668 wrote to memory of 3644	4668	Unicorn-59081.exe	108
PID 1176 wrote to memory of 4296	1176	Unicorn-28024.exe	110
PID 1176 wrote to memory of 4296	1176	Unicorn-28024.exe	110
PID 1176 wrote to memory of 4296	1176	Unicorn-28024.exe	110
PID 624 wrote to memory of 2972	624	Unicorn-10801.exe	111
PID 624 wrote to memory of 2972	624	Unicorn-10801.exe	111
PID 624 wrote to memory of 2972	624	Unicorn-10801.exe	111
PID 4300 wrote to memory of 4156	4300	Unicorn-62418.exe	112

C:\Users\Admin\AppData\Local\Temp\add94f02791e08687419ddea8040b180N.exe
"C:\Users\Admin\AppData\Local\Temp\add94f02791e08687419ddea8040b180N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10484.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10484.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63349.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63349.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27714.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62418.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1012.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2948.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40162.exe
        8⤵
        
        PID:3840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60533.exe
        9⤵
        
        PID:60
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35298.exe
        10⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32063.exe
        11⤵
        
        PID:9872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        11⤵
        
        PID:620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29509.exe
        10⤵
        
        PID:10424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45225.exe
        9⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        10⤵
        
        PID:17284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17500.exe
        9⤵
        
        PID:12660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5317.exe
        9⤵
        
        PID:15300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32508.exe
        9⤵
        
        PID:13388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
        9⤵
        
        PID:11472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4175.exe
        8⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48399.exe
        9⤵
        
        PID:10016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6104.exe
        9⤵
        
        PID:14736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38534.exe
        8⤵
        
        PID:10908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40114.exe
        8⤵
        
        PID:14488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
        8⤵
        
        PID:11024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54697.exe
        7⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40181.exe
        8⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31679.exe
        9⤵
        
        PID:10212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        9⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29509.exe
        8⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        8⤵
        
        PID:15480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17055.exe
        7⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62463.exe
        8⤵
        
        PID:13172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13701.exe
        8⤵
        
        PID:17332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62950.exe
        7⤵
        
        PID:11948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48236.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-120.exe
        7⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15816.exe
        8⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34437.exe
        9⤵
        
        PID:9344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6469.exe
        9⤵
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
        9⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40925.exe
        8⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34927.exe
        7⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16127.exe
        8⤵
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55259.exe
        8⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe
        7⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44037.exe
        7⤵
        
        PID:13124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
        7⤵
        
        PID:12248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3663.exe
        6⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47202.exe
        7⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
        8⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        8⤵
        
        PID:13820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20457.exe
        8⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34472.exe
        7⤵
        
        PID:9232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        7⤵
        
        PID:15876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13880.exe
        6⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2405.exe
        7⤵
        
        PID:10676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        7⤵
        
        PID:15368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49861.exe
        6⤵
        
        PID:12008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64243.exe
        6⤵
        
        PID:14952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31224.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54178.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58418.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56226.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24437.exe
        9⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29909.exe
        9⤵
        
        PID:14020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6104.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        8⤵
        
        PID:10024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23247.exe
        9⤵
        
        PID:12904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        9⤵
        
        PID:17432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34812.exe
        8⤵
        
        PID:13476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
        7⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58975.exe
        8⤵
        
        PID:11400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        8⤵
        
        PID:15416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63997.exe
        7⤵
        
        PID:11728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37024.exe
        6⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19346.exe
        7⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7595.exe
        8⤵
        
        PID:12932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55497.exe
        8⤵
        
        PID:14616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57190.exe
        7⤵
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        7⤵
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65209.exe
        6⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23247.exe
        7⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        7⤵
        
        PID:17212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14700.exe
        6⤵
        
        PID:12588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31903.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42357.exe
        6⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21442.exe
        7⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15313.exe
        8⤵
        
        PID:8540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13262.exe
        9⤵
        
        PID:12700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18335.exe
        9⤵
        
        PID:15324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12218.exe
        9⤵
        
        PID:19560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3381.exe
        8⤵
        
        PID:12964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61961.exe
        7⤵
        
        PID:9248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1948.exe
        7⤵
        
        PID:13576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        7⤵
        
        PID:15688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30984.exe
        6⤵
        
        PID:864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
        7⤵
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58294.exe
        8⤵
        
        PID:13464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16501.exe
        8⤵
        
        PID:17088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        7⤵
        
        PID:13764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65431.exe
        7⤵
        
        PID:13712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54765.exe
        6⤵
        
        PID:9452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
        6⤵
        
        PID:14704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40940.exe
        5⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39890.exe
        6⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31733.exe
        7⤵
        
        PID:8428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27871.exe
        8⤵
        
        PID:14560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17687.exe
        8⤵
        
        PID:17272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18284.exe
        7⤵
        
        PID:4636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62921.exe
        6⤵
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11932.exe
        6⤵
        
        PID:12840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        6⤵
        
        PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15599.exe
        5⤵
        
        PID:7604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-350.exe
        6⤵
        
        PID:10384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        6⤵
        
        PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40738.exe
        5⤵
        
        PID:11068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36507.exe
        5⤵
        
        PID:14640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57456.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31698.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35362.exe
        7⤵
        
        PID:3288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64389.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39346.exe
        9⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31746.exe
        9⤵
        
        PID:13456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20457.exe
        9⤵
        
        PID:15408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48697.exe
        8⤵
        
        PID:9876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18335.exe
        9⤵
        
        PID:14596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
        8⤵
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31768.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11397.exe
        8⤵
        
        PID:14412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        8⤵
        
        PID:17132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21724.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        7⤵
        
        PID:14784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64889.exe
        6⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7684.exe
        7⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34338.exe
        8⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9899.exe
        9⤵
        
        PID:13132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13701.exe
        9⤵
        
        PID:17016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36053.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60573.exe
        8⤵
        
        PID:13680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
        8⤵
        
        PID:2404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40232.exe
        7⤵
        
        PID:9160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11932.exe
        7⤵
        
        PID:12848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59658.exe
        7⤵
        
        PID:15472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37424.exe
        6⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23055.exe
        7⤵
        
        PID:12944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52856.exe
        7⤵
        
        PID:17780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37756.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46617.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19794.exe
        6⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7684.exe
        7⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24437.exe
        8⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        9⤵
        
        PID:17260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29909.exe
        8⤵
        
        PID:13692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53898.exe
        8⤵
        
        PID:15812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        7⤵
        
        PID:10064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50110.exe
        7⤵
        
        PID:14068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        7⤵
        
        PID:13072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64329.exe
        7⤵
        
        PID:17176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46422.exe
        6⤵
        
        PID:11720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        6⤵
        
        PID:14516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        6⤵
        
        PID:15900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30466.exe
        5⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3761.exe
        6⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        7⤵
        
        PID:12816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        7⤵
        
        PID:15464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39109.exe
        6⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10508.exe
        6⤵
        
        PID:15108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        6⤵
        
        PID:15648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52604.exe
        5⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60911.exe
        6⤵
        
        PID:12264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20841.exe
        6⤵
        
        PID:12596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18924.exe
        5⤵
        
        PID:12220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1915.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49570.exe
        5⤵
        Executes dropped EXE
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60066.exe
        6⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8385.exe
        7⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5713.exe
        8⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        8⤵
        
        PID:15752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45830.exe
        7⤵
        
        PID:10356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33372.exe
        7⤵
        
        PID:13876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
        7⤵
        
        PID:15608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3320.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57085.exe
        6⤵
        
        PID:11908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5538.exe
        6⤵
        
        PID:15104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        6⤵
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18680.exe
        5⤵
        
        PID:6320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        6⤵
        
        PID:9208
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9208 -s 460
        7⤵
        Program crash
        
        PID:16156
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9208 -s 460
        7⤵
        Program crash
        
        PID:18588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29909.exe
        6⤵
        
        PID:14004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20457.exe
        6⤵
        
        PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40262.exe
        5⤵
        
        PID:11072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
        5⤵
        
        PID:12284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63328.exe
      4⤵
      PID:1384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60834.exe
        5⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38562.exe
        6⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15182.exe
        7⤵
        
        PID:13484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14853.exe
        7⤵
        
        PID:17708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11445.exe
        6⤵
        
        PID:11544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        6⤵
        
        PID:12624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19864.exe
        5⤵
        
        PID:8860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35790.exe
        6⤵
        
        PID:17772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57786.exe
        5⤵
        
        PID:12344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22341.exe
        5⤵
        
        PID:14444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        5⤵
        
        PID:11992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31995.exe
      4⤵
      PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17058.exe
        5⤵
        
        PID:8536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63734.exe
        5⤵
        
        PID:12748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37362.exe
        5⤵
        
        PID:15948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8011.exe
      4⤵
      PID:10036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33707.exe
      4⤵
      PID:15012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62418.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33602.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29378.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-561.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36597.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15816.exe
        9⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17442.exe
        10⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        11⤵
        
        PID:17060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63734.exe
        10⤵
        
        PID:12092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4306.exe
        10⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64352.exe
        9⤵
        
        PID:10204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54714.exe
        9⤵
        
        PID:14536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27562.exe
        9⤵
        
        PID:15924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
        8⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16719.exe
        9⤵
        
        PID:13896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
        9⤵
        
        PID:13156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63997.exe
        8⤵
        
        PID:11744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58237.exe
        8⤵
        
        PID:17144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50860.exe
        7⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24146.exe
        8⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46303.exe
        9⤵
        
        PID:11332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13893.exe
        9⤵
        
        PID:14628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20841.exe
        9⤵
        
        PID:11008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11445.exe
        8⤵
        
        PID:11548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        8⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34450.exe
        7⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62310.exe
        8⤵
        
        PID:15100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12218.exe
        8⤵
        
        PID:19568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49510.exe
        7⤵
        
        PID:13672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59629.exe
        7⤵
        
        PID:14732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4306.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19720.exe
        6⤵
        
        PID:4192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60258.exe
        7⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32210.exe
        8⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55106.exe
        9⤵
        
        PID:10040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        9⤵
        
        PID:15796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18933.exe
        8⤵
        
        PID:11000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55497.exe
        8⤵
        
        PID:14524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23688.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49375.exe
        8⤵
        
        PID:10796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        8⤵
        
        PID:14740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11340.exe
        7⤵
        
        PID:10808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26089.exe
        7⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49328.exe
        6⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16274.exe
        7⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1451.exe
        8⤵
        
        PID:13656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47334.exe
        8⤵
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18284.exe
        7⤵
        
        PID:2080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        7⤵
        
        PID:13400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16984.exe
        6⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15759.exe
        7⤵
        
        PID:13368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        7⤵
        
        PID:17416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9132.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54054.exe
        6⤵
        
        PID:17716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47852.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49762.exe
        6⤵
        Executes dropped EXE
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12209.exe
        7⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52962.exe
        8⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17058.exe
        9⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63734.exe
        9⤵
        
        PID:12732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
        9⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62083.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
        7⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19445.exe
        8⤵
        
        PID:9752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25218.exe
        8⤵
        
        PID:14568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37349.exe
        8⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        7⤵
        
        PID:12040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
        7⤵
        
        PID:13488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5800.exe
        6⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17058.exe
        7⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24844.exe
        8⤵
        
        PID:14612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        8⤵
        
        PID:17340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63734.exe
        7⤵
        
        PID:12832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        7⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10281.exe
        6⤵
        
        PID:10020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49038.exe
        6⤵
        
        PID:17852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49216.exe
        5⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53922.exe
        6⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24437.exe
        7⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23784.exe
        8⤵
        
        PID:16724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        7⤵
        
        PID:13748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
        7⤵
        
        PID:13660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34396.exe
        6⤵
        
        PID:10944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
        6⤵
        
        PID:15528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50585.exe
        5⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
        6⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3918.exe
        7⤵
        
        PID:17872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        6⤵
        
        PID:13844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
        6⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45408.exe
        5⤵
        
        PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4974.exe
        5⤵
        
        PID:14640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36507.exe
        5⤵
        
        PID:8200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61977.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52258.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33618.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20946.exe
        7⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32210.exe
        8⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8785.exe
        9⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44511.exe
        10⤵
        
        PID:14356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13201.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:17756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29909.exe
        9⤵
        
        PID:13836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34195.exe
        9⤵
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20457.exe
        9⤵
        
        PID:15324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32764.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59658.exe
        8⤵
        
        PID:15316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
        7⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48399.exe
        8⤵
        
        PID:10072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6104.exe
        8⤵
        
        PID:4804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe
        7⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
        7⤵
        
        PID:15704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-808.exe
        6⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34421.exe
        7⤵
        
        PID:7632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        8⤵
        
        PID:12880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51254.exe
        8⤵
        
        PID:15288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1741.exe
        8⤵
        
        PID:18472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57190.exe
        7⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4306.exe
        7⤵
        
        PID:15204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25218.exe
        6⤵
        
        PID:8468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36398.exe
        7⤵
        
        PID:17804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23366.exe
        6⤵
        
        PID:12576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42477.exe
        6⤵
        
        PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3768.exe
        5⤵
        
        PID:944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52588.exe
        6⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
        7⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62191.exe
        8⤵
        
        PID:14820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42549.exe
        8⤵
        
        PID:14608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34840.exe
        8⤵
        
        PID:17240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        7⤵
        
        PID:13772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        7⤵
        
        PID:15512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24227.exe
        6⤵
        
        PID:11056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59658.exe
        6⤵
        
        PID:15600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65472.exe
        5⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64706.exe
        6⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33247.exe
        7⤵
        
        PID:13636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9274.exe
        7⤵
        
        PID:18616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3381.exe
        6⤵
        
        PID:12712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
        6⤵
        
        PID:13976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17944.exe
        5⤵
        
        PID:9496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30273.exe
        5⤵
        
        PID:11620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46128.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50338.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49669.exe
        6⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7684.exe
        7⤵
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42639.exe
        8⤵
        
        PID:10436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46461.exe
        8⤵
        
        PID:14768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        8⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14802.exe
        7⤵
        
        PID:10252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
        7⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36843.exe
        6⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9982.exe
        7⤵
        
        PID:11952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20841.exe
        7⤵
        
        PID:15328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46422.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
        6⤵
        
        PID:8316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32107.exe
        5⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62853.exe
        6⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32639.exe
        7⤵
        
        PID:10552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9653.exe
        7⤵
        
        PID:14512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        7⤵
        
        PID:15552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19612.exe
        6⤵
        
        PID:12120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        6⤵
        
        PID:15908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37507.exe
        5⤵
        
        PID:7820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63142.exe
        6⤵
        
        PID:7568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6104.exe
        6⤵
        
        PID:15576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-402.exe
        5⤵
        
        PID:10788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59658.exe
        5⤵
        
        PID:15456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23369.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52588.exe
        5⤵
        
        PID:6432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48562.exe
        6⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9899.exe
        7⤵
        
        PID:13120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4306.exe
        7⤵
        
        PID:14632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3765.exe
        6⤵
        
        PID:12616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28561.exe
        6⤵
        
        PID:16252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11119.exe
        5⤵
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22257.exe
        6⤵
        
        PID:16964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17797.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        5⤵
        
        PID:15440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62672.exe
      4⤵
      PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24437.exe
        5⤵
        
        PID:7776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29909.exe
        5⤵
        
        PID:13996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51958.exe
        5⤵
        
        PID:11372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5375.exe
        5⤵
        
        PID:13404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29640.exe
      4⤵
      PID:10048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7279.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7279.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1697.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54261.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42658.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31058.exe
        7⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24354.exe
        8⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31206.exe
        8⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6782.exe
        8⤵
        
        PID:19512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50617.exe
        7⤵
        
        PID:9424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32902.exe
        7⤵
        
        PID:15248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57309.exe
        7⤵
        
        PID:14680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33966.exe
        7⤵
        
        PID:1336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23771.exe
        6⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54875.exe
        7⤵
        
        PID:19400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37101.exe
        6⤵
        
        PID:11812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        6⤵
        
        PID:15956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
        5⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7684.exe
        6⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38277.exe
        7⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8830.exe
        8⤵
        
        PID:13160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39954.exe
        8⤵
        
        PID:14476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        7⤵
        
        PID:15932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48697.exe
        6⤵
        
        PID:9892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        6⤵
        
        PID:15768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18399.exe
        5⤵
        
        PID:7328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35589.exe
        6⤵
        
        PID:9732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33966.exe
        6⤵
        
        PID:14976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-860.exe
        5⤵
        
        PID:12016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51225.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24978.exe
        5⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41810.exe
        6⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
        7⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22887.exe
        8⤵
        
        PID:19588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        7⤵
        
        PID:13732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61234.exe
        7⤵
        
        PID:16228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50617.exe
        6⤵
        
        PID:10180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33966.exe
        6⤵
        
        PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32898.exe
        5⤵
        
        PID:7544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34870.exe
        6⤵
        
        PID:13708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51986.exe
        6⤵
        
        PID:18548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64019.exe
        5⤵
        
        PID:11824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43439.exe
        5⤵
        
        PID:540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
        5⤵
        
        PID:2512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36227.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39890.exe
        5⤵
        
        PID:6544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        6⤵
        
        PID:9164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        7⤵
        
        PID:17188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29909.exe
        6⤵
        
        PID:13976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37362.exe
        6⤵
        
        PID:15448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51385.exe
        5⤵
        
        PID:9964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37317.exe
        5⤵
        
        PID:14532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        5⤵
        
        PID:15852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40793.exe
      4⤵
      PID:7408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17058.exe
        5⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34783.exe
        6⤵
        
        PID:14304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13701.exe
        6⤵
        
        PID:17348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63734.exe
        5⤵
        
        PID:12800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38431.exe
        5⤵
        
        PID:8140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7481.exe
      4⤵
      PID:10132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36507.exe
      4⤵
      PID:14644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34489.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38418.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57349.exe
        5⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7684.exe
        6⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39346.exe
        7⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25884.exe
        7⤵
        
        PID:14760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        7⤵
        
        PID:9856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48697.exe
        6⤵
        
        PID:9924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        6⤵
        
        PID:15776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
        5⤵
        
        PID:7676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42639.exe
        6⤵
        
        PID:10296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        6⤵
        
        PID:15696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63997.exe
        5⤵
        
        PID:11752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27142.exe
        5⤵
        
        PID:13452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35401.exe
        5⤵
        
        PID:14936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40717.exe
        5⤵
        
        PID:18492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22216.exe
      4⤵
      PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49698.exe
        5⤵
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24437.exe
        6⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47583.exe
        7⤵
        
        PID:14832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13701.exe
        7⤵
        
        PID:17028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29909.exe
        6⤵
        
        PID:13716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65431.exe
        6⤵
        
        PID:14796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44502.exe
        5⤵
        
        PID:12140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
        5⤵
        
        PID:13124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21855.exe
      4⤵
      PID:7784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-913.exe
        5⤵
        
        PID:1380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        6⤵
        
        PID:18412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63734.exe
        5⤵
        
        PID:12764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22440.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15077.exe
      4⤵
      PID:10124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64243.exe
      4⤵
      PID:13728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45248.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45248.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58418.exe
      4⤵
      PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58229.exe
        5⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32885.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        7⤵
        
        PID:13144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        7⤵
        
        PID:17120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5109.exe
        6⤵
        
        PID:13292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        6⤵
        
        PID:13916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31400.exe
        5⤵
        
        PID:9528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30798.exe
        6⤵
        
        PID:17296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28631.exe
        5⤵
        
        PID:12884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
      4⤵
      PID:7648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23247.exe
        5⤵
        
        PID:12780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8559.exe
        5⤵
        
        PID:11052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63997.exe
      4⤵
      PID:11736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
      4⤵
      PID:14832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16616.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16616.exe
    3⤵
    PID:5836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41826.exe
      4⤵
      PID:7284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23055.exe
        5⤵
        
        PID:12952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4769.exe
        5⤵
        
        PID:17792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40557.exe
      4⤵
      PID:11792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30354.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30354.exe
    3⤵
    PID:7180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23247.exe
      4⤵
      PID:12804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
      4⤵
      PID:17380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48468.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48468.exe
    3⤵
    PID:11528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33469.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33469.exe
    3⤵
    PID:14828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18306.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18306.exe
    3⤵
    PID:4764
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28024.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28024.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10801.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10801.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13409.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2081.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2097.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23634.exe
        7⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36597.exe
        8⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16066.exe
        9⤵
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58178.exe
        10⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17653.exe
        11⤵
        
        PID:17724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        10⤵
        
        PID:13852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53898.exe
        10⤵
        
        PID:15940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        9⤵
        
        PID:10056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        9⤵
        
        PID:15760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
        8⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44367.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52326.exe
        9⤵
        
        PID:13488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40597.exe
        9⤵
        
        PID:13656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        9⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32668.exe
        8⤵
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1682.exe
        8⤵
        
        PID:15020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24828.exe
        8⤵
        
        PID:14524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35400.exe
        7⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37493.exe
        8⤵
        
        PID:804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56998.exe
        8⤵
        
        PID:9960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        8⤵
        
        PID:15496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16002.exe
        7⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56264.exe
        8⤵
        
        PID:18032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51347.exe
        7⤵
        
        PID:13468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28631.exe
        7⤵
        
        PID:7528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19720.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59189.exe
        7⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35090.exe
        8⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
        9⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22165.exe
        10⤵
        
        PID:19296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        9⤵
        
        PID:13780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20457.exe
        9⤵
        
        PID:15432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50617.exe
        8⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        9⤵
        
        PID:17324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
        8⤵
        
        PID:15632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8904.exe
        7⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63916.exe
        8⤵
        
        PID:12372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe
        8⤵
        
        PID:17732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9132.exe
        7⤵
        
        PID:12928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59658.exe
        7⤵
        
        PID:15680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65472.exe
        6⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22802.exe
        7⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26053.exe
        7⤵
        
        PID:11704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61645.exe
        7⤵
        
        PID:15096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5061.exe
        7⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5375.exe
        7⤵
        
        PID:14444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39465.exe
        6⤵
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13262.exe
        7⤵
        
        PID:12284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47334.exe
        7⤵
        
        PID:17388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54986.exe
        6⤵
        
        PID:12116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
        6⤵
        
        PID:11032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58899.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37474.exe
        6⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51426.exe
        7⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17058.exe
        8⤵
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63734.exe
        8⤵
        
        PID:12824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        8⤵
        
        PID:15568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62083.exe
        7⤵
        
        PID:10104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22632.exe
        8⤵
        
        PID:17980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
        7⤵
        
        PID:13316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26568.exe
        6⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10558.exe
        7⤵
        
        PID:11900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53898.exe
        7⤵
        
        PID:7240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37101.exe
        6⤵
        
        PID:11864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        6⤵
        
        PID:15836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4923.exe
        5⤵
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38562.exe
        6⤵
        
        PID:7248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13646.exe
        7⤵
        
        PID:12648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11445.exe
        6⤵
        
        PID:11584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        6⤵
        
        PID:15584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47712.exe
        5⤵
        
        PID:8812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        6⤵
        
        PID:17396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23074.exe
        5⤵
        
        PID:11896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47369.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5169.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42850.exe
        6⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22920.exe
        7⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17058.exe
        8⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30798.exe
        9⤵
        
        PID:17356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63734.exe
        8⤵
        
        PID:12756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54967.exe
        8⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10281.exe
        7⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14062.exe
        7⤵
        
        PID:19092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32898.exe
        6⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48399.exe
        7⤵
        
        PID:9912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        7⤵
        
        PID:13964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9701.exe
        6⤵
        
        PID:10236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59658.exe
        6⤵
        
        PID:15624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6847.exe
        5⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35090.exe
        6⤵
        
        PID:2788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64735.exe
        7⤵
        
        PID:9512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        7⤵
        
        PID:15804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6930.exe
        6⤵
        
        PID:10880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        6⤵
        
        PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40793.exe
        5⤵
        
        PID:7368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37810.exe
        6⤵
        
        PID:10148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38667.exe
        7⤵
        
        PID:17104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        6⤵
        
        PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56765.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60762.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6072.exe
      4⤵
      PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14513.exe
        5⤵
        
        PID:3996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32117.exe
        6⤵
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15383.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51238.exe
        6⤵
        
        PID:12364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37362.exe
        6⤵
        
        PID:14584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30632.exe
        5⤵
        
        PID:8512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11932.exe
        5⤵
        
        PID:12752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46336.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58178.exe
        5⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13262.exe
        6⤵
        
        PID:12992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        6⤵
        
        PID:17156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        5⤵
        
        PID:13812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        5⤵
        
        PID:13572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65183.exe
      4⤵
      PID:11036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53697.exe
      4⤵
      PID:15004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42562.exe
      4⤵
      PID:16288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59081.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59081.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2081.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2097.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19794.exe
        7⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15816.exe
        8⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31295.exe
        9⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38431.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60074.exe
        8⤵
        
        PID:11064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
        8⤵
        
        PID:14572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32898.exe
        7⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        8⤵
        
        PID:19580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39994.exe
        7⤵
        
        PID:13400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10789.exe
        7⤵
        
        PID:14816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37722.exe
        7⤵
        
        PID:3144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1080.exe
        6⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50549.exe
        7⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20322.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26566.exe
        8⤵
        
        PID:11476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-424.exe
        8⤵
        
        PID:14520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
        7⤵
        
        PID:12068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        7⤵
        
        PID:11980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37507.exe
        6⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17196.exe
        7⤵
        
        PID:11364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        7⤵
        
        PID:15592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42966.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33966.exe
        6⤵
        
        PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52393.exe
        5⤵
        
        PID:3340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60533.exe
        6⤵
        
        PID:4984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13009.exe
        7⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        8⤵
        
        PID:16996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50579.exe
        7⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5253.exe
        7⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19662.exe
        7⤵
        
        PID:19072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21867.exe
        6⤵
        
        PID:8716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10780.exe
        6⤵
        
        PID:13724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38502.exe
        6⤵
        
        PID:14784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20841.exe
        6⤵
        
        PID:7888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10040.exe
        5⤵
        
        PID:7552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2065.exe
        6⤵
        
        PID:9596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9378.exe
        6⤵
        
        PID:14604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42477.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23900.exe
        5⤵
        
        PID:10400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36507.exe
        5⤵
        
        PID:2240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48236.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6721.exe
        5⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30984.exe
        6⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8785.exe
        7⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        7⤵
        
        PID:13700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38431.exe
        7⤵
        
        PID:14560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65120.exe
        6⤵
        
        PID:9984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18801.exe
        7⤵
        
        PID:17836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4444.exe
        6⤵
        
        PID:14624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27562.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30984.exe
        5⤵
        
        PID:4052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34338.exe
        6⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        7⤵
        
        PID:13484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36053.exe
        6⤵
        
        PID:12864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13702.exe
        6⤵
        
        PID:17820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12079.exe
        5⤵
        
        PID:9488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36348.exe
        5⤵
        
        PID:15332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49714.exe
        5⤵
        
        PID:14508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22961.exe
        5⤵
        
        PID:16276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36227.exe
      4⤵
      PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56418.exe
        5⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49714.exe
        6⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
        7⤵
        
        PID:17424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28674.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        6⤵
        
        PID:15616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14488.exe
        5⤵
        
        PID:9580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        6⤵
        
        PID:13080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        6⤵
        
        PID:17068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1564.exe
        5⤵
        
        PID:14236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59274.exe
        5⤵
        
        PID:16216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40793.exe
      4⤵
      PID:7400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42639.exe
        5⤵
        
        PID:9256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        5⤵
        
        PID:15664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8540.exe
      4⤵
      PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61103.exe
      4⤵
      PID:15348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63859.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61104.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61104.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38610.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9025.exe
        5⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54389.exe
        6⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
        7⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63916.exe
        8⤵
        
        PID:12628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12149.exe
        8⤵
        
        PID:14740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63855.exe
        8⤵
        
        PID:18980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        7⤵
        
        PID:13788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        7⤵
        
        PID:15488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50617.exe
        6⤵
        
        PID:10216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16657.exe
        7⤵
        
        PID:16980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32136.exe
        5⤵
        
        PID:3452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11326.exe
        6⤵
        
        PID:11484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16389.exe
        6⤵
        
        PID:14520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13701.exe
        6⤵
        
        PID:17196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
        5⤵
        
        PID:10320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55465.exe
      4⤵
      PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41826.exe
        5⤵
        
        PID:7276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31295.exe
        6⤵
        
        PID:10656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22632.exe
        7⤵
        
        PID:17992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        6⤵
        
        PID:15424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46339.exe
        5⤵
        
        PID:10480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6104.exe
        5⤵
        
        PID:14608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32623.exe
      4⤵
      PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13701.exe
        5⤵
        
        PID:17252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12981.exe
      4⤵
      PID:11396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39407.exe
      4⤵
      PID:1608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
      4⤵
      PID:13116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5288.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5288.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9025.exe
      4⤵
      PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39890.exe
        5⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32818.exe
        6⤵
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57455.exe
        7⤵
        
        PID:13256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21077.exe
        6⤵
        
        PID:13448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37362.exe
        6⤵
        
        PID:15720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62083.exe
        5⤵
        
        PID:10176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
        5⤵
        
        PID:13164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54441.exe
      4⤵
      PID:7308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51266.exe
        5⤵
        
        PID:9560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41174.exe
        5⤵
        
        PID:14768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58237.exe
        5⤵
        
        PID:17204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40925.exe
      4⤵
      PID:9724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33727.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33727.exe
    3⤵
    PID:5528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47778.exe
      4⤵
      PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57410.exe
        5⤵
        
        PID:8480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30798.exe
        6⤵
        
        PID:17316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        5⤵
        
        PID:13796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4306.exe
        5⤵
        
        PID:768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50617.exe
      4⤵
      PID:9416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65378.exe
      4⤵
      PID:11536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18171.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18171.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34831.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:11828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36507.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36507.exe
    3⤵
    PID:7336
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4671.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4671.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43720.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43720.exe
    3⤵
    - Executes dropped EXE
    PID:3804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32274.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32674.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51701.exe
        7⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16511.exe
        8⤵
        
        PID:10344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        8⤵
        
        PID:14536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29509.exe
        7⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        7⤵
        
        PID:1864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56.exe
        6⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-382.exe
        7⤵
        
        PID:13948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39954.exe
        7⤵
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23519.exe
        7⤵
        
        PID:17744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21371.exe
        6⤵
        
        PID:720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15496.exe
        5⤵
        
        PID:1856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59817.exe
        6⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46303.exe
        7⤵
        
        PID:9820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20841.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37101.exe
        6⤵
        
        PID:11856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        6⤵
        
        PID:15820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36656.exe
        5⤵
        
        PID:7516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34668.exe
        6⤵
        
        PID:10280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3701.exe
        6⤵
        
        PID:15340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6104.exe
        6⤵
        
        PID:14440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-101.exe
        5⤵
        
        PID:9644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60042.exe
        5⤵
        
        PID:2200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30472.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33525.exe
        5⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16834.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-913.exe
        7⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        8⤵
        
        PID:13032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55497.exe
        8⤵
        
        PID:15148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63734.exe
        7⤵
        
        PID:14320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22970.exe
        7⤵
        
        PID:17768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61014.exe
        6⤵
        
        PID:8392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
        6⤵
        
        PID:13724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26376.exe
        5⤵
        
        PID:8104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23247.exe
        6⤵
        
        PID:12736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8559.exe
        6⤵
        
        PID:12736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56422.exe
        5⤵
        
        PID:12632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45843.exe
      4⤵
      PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63621.exe
        5⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24437.exe
        6⤵
        
        PID:6644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        6⤵
        
        PID:13756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53898.exe
        6⤵
        
        PID:15728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35240.exe
        5⤵
        
        PID:10080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        5⤵
        
        PID:15744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43372.exe
      4⤵
      PID:7864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20661.exe
        5⤵
        
        PID:10856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        5⤵
        
        PID:15504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29868.exe
      4⤵
      PID:10888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22309.exe
      4⤵
      PID:14928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32831.exe
      4⤵
      PID:14540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61587.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61587.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49570.exe
      4⤵
      Executes dropped EXE
      PID:916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36597.exe
        5⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65017.exe
        6⤵
        
        PID:4552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33039.exe
        7⤵
        
        PID:10824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54576.exe
        7⤵
        
        PID:14408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21724.exe
        6⤵
        
        PID:12240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        6⤵
        
        PID:3480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22831.exe
        5⤵
        
        PID:7124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6469.exe
        6⤵
        
        PID:13440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33966.exe
        6⤵
        
        PID:3464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4642.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61149.exe
        5⤵
        
        PID:13156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
        5⤵
        
        PID:15400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51737.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54021.exe
        5⤵
        
        PID:6160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26053.exe
        5⤵
        
        PID:10732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55213.exe
        5⤵
        
        PID:14780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        5⤵
        
        PID:14944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32530.exe
      4⤵
      PID:8896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23247.exe
        5⤵
        
        PID:12912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        5⤵
        
        PID:17308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13381.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
      4⤵
      PID:3796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6456.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6456.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61218.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35682.exe
        5⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23247.exe
        6⤵
        
        PID:13040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53898.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57190.exe
        5⤵
        
        PID:12196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        5⤵
        
        PID:2128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45609.exe
      4⤵
      PID:8400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63916.exe
        5⤵
        
        PID:12420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41677.exe
        5⤵
        
        PID:13724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45430.exe
        5⤵
        
        PID:19608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17500.exe
      4⤵
      PID:12568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48895.exe
      4⤵
      PID:13160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48531.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48531.exe
    3⤵
    PID:6700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31842.exe
      4⤵
      PID:8592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        5⤵
        
        PID:13108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30798.exe
        5⤵
        
        PID:17448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3381.exe
      4⤵
      PID:12720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65431.exe
      4⤵
      PID:14528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57746.exe
      4⤵
      PID:18580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58281.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58281.exe
    3⤵
    PID:9456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
      4⤵
      PID:17372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50607.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50607.exe
    3⤵
    PID:13284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54581.exe
    3⤵
    PID:14276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2295.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2295.exe
    3⤵
    PID:14676
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32169.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32169.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1697.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1697.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3192.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46610.exe
        5⤵
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55090.exe
        6⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44700.exe
        7⤵
        
        PID:14660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59046.exe
        7⤵
        
        PID:14592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28961.exe
        7⤵
        
        PID:17824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26053.exe
        6⤵
        
        PID:10724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38431.exe
        6⤵
        
        PID:7440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19864.exe
        5⤵
        
        PID:8868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23247.exe
        6⤵
        
        PID:12888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64859.exe
        6⤵
        
        PID:17224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57786.exe
        5⤵
        
        PID:12300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64008.exe
        5⤵
        
        PID:16708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19535.exe
      4⤵
      PID:6712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
        5⤵
        
        PID:8424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        5⤵
        
        PID:13828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37362.exe
        5⤵
        
        PID:14532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4680.exe
      4⤵
      PID:10188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32831.exe
      4⤵
      PID:2768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34312.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34312.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9793.exe
      4⤵
      PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7684.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38277.exe
        6⤵
        
        PID:8956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23247.exe
        7⤵
        
        PID:12896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        7⤵
        
        PID:17164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54428.exe
        6⤵
        
        PID:15916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48697.exe
        5⤵
        
        PID:9884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        6⤵
        
        PID:17076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
        5⤵
        
        PID:15844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21192.exe
      4⤵
      PID:7688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31103.exe
        5⤵
        
        PID:10524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34870.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1681.exe
        5⤵
        
        PID:6292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59773.exe
      4⤵
      PID:9516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59997.exe
      4⤵
      PID:4004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35952.exe
    3⤵
    PID:5820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31058.exe
      4⤵
      PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31842.exe
        5⤵
        
        PID:8584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        6⤵
        
        PID:13100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14231.exe
        6⤵
        
        PID:17040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3381.exe
        5⤵
        
        PID:12704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20457.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22936.exe
      4⤵
      PID:8660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62703.exe
        5⤵
        
        PID:17052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10780.exe
      4⤵
      PID:13708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53853.exe
      4⤵
      PID:14764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
      4⤵
      PID:15536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43372.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43372.exe
    3⤵
    PID:7836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18210.exe
      4⤵
      PID:9480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-424.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61744.exe
    3⤵
    PID:9268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4974.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4974.exe
    3⤵
    PID:14588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15217.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15217.exe
    3⤵
    PID:16196
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57619.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57619.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5169.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5169.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42658.exe
      4⤵
      PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59817.exe
        5⤵
        
        PID:8016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60143.exe
        6⤵
        
        PID:10348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47334.exe
        6⤵
        
        PID:16736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56422.exe
        5⤵
        
        PID:12640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23712.exe
        5⤵
        
        PID:16264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36843.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60511.exe
        5⤵
        
        PID:9704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38667.exe
        6⤵
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        5⤵
        
        PID:15672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48621.exe
      4⤵
      PID:10668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38063.exe
      4⤵
      PID:3432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64994.exe
      4⤵
      PID:15560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21339.exe
    3⤵
    PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56309.exe
      4⤵
      PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
        5⤵
        
        PID:8364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62582.exe
        5⤵
        
        PID:13740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19662.exe
        5⤵
        
        PID:19100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34472.exe
      4⤵
      PID:9244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32897.exe
      4⤵
      PID:15860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3023.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3023.exe
    3⤵
    PID:7208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
      4⤵
      PID:11588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18746.exe
      4⤵
      PID:19144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2322.exe
    3⤵
    PID:9680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59658.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59658.exe
    3⤵
    PID:15712
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12568.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12568.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57733.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57733.exe
    3⤵
    PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31250.exe
      4⤵
      PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31295.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
        5⤵
        
        PID:15520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52566.exe
      4⤵
      PID:10916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41645.exe
      4⤵
      PID:14936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
      4⤵
      PID:15544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8312.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8312.exe
    3⤵
    PID:7900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31295.exe
      4⤵
      PID:10584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62518.exe
      4⤵
      PID:14900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3922.exe
      4⤵
      PID:15656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60074.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60074.exe
    3⤵
    PID:10632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9862.exe
    3⤵
    PID:19120
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32805.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32805.exe
  2⤵
  PID:5772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41826.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41826.exe
    3⤵
    PID:7268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31295.exe
      4⤵
      PID:10560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37362.exe
      4⤵
      PID:15892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46339.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46339.exe
    3⤵
    PID:10664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3234.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3234.exe
    3⤵
    PID:14144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40597.exe
    3⤵
    PID:11300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
    3⤵
    PID:4240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8823.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8823.exe
  2⤵
  PID:6132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8270.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8270.exe
    3⤵
    PID:1956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22367.exe
    3⤵
    PID:17364
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43517.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43517.exe
  2⤵
  PID:11392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33707.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33707.exe
  2⤵
  PID:14460

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 9208 -ip 9208
1⤵
PID:18644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1012.exe

Filesize
468KB

MD5
a8f961442cb8da9ef205b04f8ccebf39

SHA1
506ed28024ae4e04823eec8294ded09ab900814b

SHA256
6cdb8a59a0880d45f612d2a3a5cd7215e7bb5d33355d1357b6bf9129df46592e

SHA512
1fd1b3a73d6d981d291d7dd1dc74c1441a97056cf7e4dbbfdba8a6aa18c191515be6c8661830c5c7078169a86b235e5f1dc247efb0bab9b06b3655ca8fdad05a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10484.exe

Filesize
468KB

MD5
fa2dce84431f104c1ce1e1819c8cc2b1

SHA1
5b446dc3b0d7412a248feaeebc88cbc53c210ca5

SHA256
43fe6456a050807b75b24678bd8db63cae20844ec7d0c9285d33ffbbd11e0dae

SHA512
d50e21d2c8b14c5cf4b04768af529bc2a0bce662b76cfc83a563a96080eeb50169db6a6a0d737ff368d47a6b34262c5a00b718574a28570159dc83a3536b3dba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10801.exe

Filesize
468KB

MD5
629f0553bc75e0bd83f18beb7c651d6e

SHA1
f978217afc81d951571daab3abbb62a70efb5acb

SHA256
49397f6739eb7f08b63cde178f5030a822b786cbb45485079b9dec3ba0c7b8ba

SHA512
ba515135bf2ddca50195d2762e69ebd4b62629de3ac4e6cf03afab8c93c450821fbdaf7476e00810d0a8a7a3389702c325fc4454fffb475fb66fc31363e480a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13409.exe

Filesize
468KB

MD5
a9b2ae8a28f51f13bf20039f6f84e7e9

SHA1
4680ab23b0d20ead77283c9dd7aa832482b2af77

SHA256
50d76d2e39df703f19305e744a02f8d0225a85388afd94990d395ccb53fba069

SHA512
24bec82885174ff5714f1112dffa82243ef278e5dc0979c85dd9a58f39aa5b51a54b13d93ca2bb3185f9f39bcc3ae431255b8481dfbbba148b6451a85192f6d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1697.exe

Filesize
468KB

MD5
89093e518a83210d1fdfb3fea7719692

SHA1
ced0cc845c84658204c367d5617e3d7707431fec

SHA256
95d77050ba23a00d0c08cd1930bf7e263d760747f661d83346b2435f8a4e4861

SHA512
d664452c3b1e6418f5b0400a23f07d183f34de5e9d81c64b9e861547ad3a259143fa1ee0b8e0b00131ee67e7bdf16467a02f61e72ad1db96e51240180f49307d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1915.exe

Filesize
468KB

MD5
497c19e20cc2c8ed560b5fa69139fcd8

SHA1
e692ff42d5af782dd10cb3929a598f48b33110f4

SHA256
48b01589ec5df77398ea2a666097049ae6c4a12c8d4cc811e0af1919d3d5fbdb

SHA512
b81cb0b6b7db2f5bad8c8de0af0be018856b676bd4dfeffa0e6cab96ee445db56aefdeff1d30445cff8ca0ef51a03d86a521e83fc92ba3b7c8430283e87a70d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2081.exe

Filesize
468KB

MD5
ef83bf9b1f0286548d5ec1260f97c151

SHA1
d80dee72f6a9d837a536bd59de04d4f6fdbd483d

SHA256
7286f7b6cf24b82a403c4e910ee67ee3908311479551a13d1d1084ad1798a511

SHA512
c0c010ea220005df4a7dc4fb135921d5231493db391b6a06d8e483545deccbfb8e365e0f302d0256a66ed403b44d558e25993001342323602099d1a8f99f43ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27714.exe

Filesize
468KB

MD5
97fc3b31b021a9e6c2553f75b8291409

SHA1
54b2f3b9a09f6f01d3bc16deef47c2cfd0574d6b

SHA256
57ed88341b956c61fd48bb23644c18707500226ce804888fc568648ed42da1c9

SHA512
66d046dd41cf034ceef112445b70cafc9f9db00f083e65f84e20e2e3c84e4611144afada44d6645da83f0893f2a8823d3c9e998e7a90d19d5026317df96ff211

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28024.exe

Filesize
468KB

MD5
a49c01e14efcc8f376de2f8d223b407a

SHA1
eb3eda2c5a240e8e25939d82385a88a2b071918f

SHA256
c64853fb3f4e757f00b1c7badacc37f9dafe0d2ce537adbbca790903543910a3

SHA512
3b9083b149f578a54b88095d79c253be56cccb9a9f37fffffc13ea4babedd5bb1b72318ec8fe19effacef2ca949e6acdc0be6bf1a1bc24c31646a1ec70d9afc9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29378.exe

Filesize
468KB

MD5
9181403ca098930784007def099ff6e2

SHA1
5a0f7d8d250abc072c9f90b54265a0d720a231d3

SHA256
5eee6d66f6ccee26545bc66e725172687d7af8636b563ba3d4836d8b345f141f

SHA512
8c9830eace1c5b1e2578fff0b6235984e1b9e7236d1f33f1427c95bb2ea7994da2ef37a3a778f4527a4dcde8bc5103d79976835c00e18b6b4b92714951651580

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31224.exe

Filesize
468KB

MD5
7bdaa03d7f3b75fc60177105c26bc9c8

SHA1
4d5f78f3a0bdb0607066c779938349e475f872dc

SHA256
29baa45b4daf593a7fdfa050220b6efc1560e8c6a021b112687184e0e7dc61dc

SHA512
61353fe2bbadcb53b9f2e6a60ed6a628c4a82b7a6ef24d48d5a59020e22d7a44daa432f5aa30f5e26317a919de078b62443492275a6965b644afea030eb42e0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32169.exe

Filesize
468KB

MD5
dcbb3ab74895b55cef7069af9adad7f2

SHA1
0891d10d5a024d8c7255d171612ec29e06dc2eee

SHA256
6788d02c4ddfcb34100a411342ac74e88c70302d6842c2dc077b9e09034f6ee3

SHA512
9cdba7a41ddf67cce48ebe6ff6ea386e50798b632450b1aeedd1ef58da0b221cb9f6fd2d06bff4ad2c5fefca8954ae2926cd6b20759b22d7aec97c27d10e163c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33602.exe

Filesize
468KB

MD5
10dc754513eeb0e1b7d5ae62b88fcfe9

SHA1
f7edeb619790441528a092b27d2c05e44b7d2785

SHA256
190a265885953cd0468b626df4b6c6c6521cb5f1053129a4d28e637c977eb728

SHA512
90f452f2ace577898c9cc2c20caa73a4808665c81a5d9fc69cb1ee8a9ef5c1569f874978a500890d728eedaa39c49a32c48de0cef3b03357110d41bd8151356f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34489.exe

Filesize
468KB

MD5
406d90dd416fad450f0b97505bd7327d

SHA1
ccd9a1fea16e82d8229f4e1c58810789ae9bd3c3

SHA256
f78e42be2fc7a628555d816615520ec2985cd92ccf2561ba7403a8318afe6c2e

SHA512
1e78c7c110cd1659eb44fd25dd4f3122605f91ee0b2ee3860ef11cfa590f1e529cca85db81791bf570cd123412d4c606cd16b07c6d02cc6c784c77e1ed1539cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43720.exe

Filesize
468KB

MD5
34328b48a26ca8e21ecf75c6ab3ce082

SHA1
958a73706342cfc13c708a4cb13bc447e4724f0c

SHA256
ee08abb1c9fa20a7015449213e4f6268646412934a5dc3c5deefa2e20463dddc

SHA512
a13d8b0dae2d32e789b27ba16eb80288db66f947a819f7f522139d752662d5b712f4eff443b4ad185503e51a885dd2fa745b20c2216e30838a0e6d15da236fa6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44646.exe

Filesize
468KB

MD5
2cb7618d3c6652aee204895adeda51c0

SHA1
0719a1cf812d458a676b6e8da0f9a07881ab4fc4

SHA256
f3202273ff2b6613cbeb3b9e2926ca7ca0d3457b70d29290e5aa038c8a75f244

SHA512
a874b5235ed273ebb38bdc9ba07073733b1b25de889c1db7951ae2c529b125da33d815ae933c1b7d92ef8b99096d72db6e72d649d037ec32808771dc0e4971fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4671.exe

Filesize
468KB

MD5
cc874140e752270a7235464d4b628122

SHA1
1f569ca4c8e7cd2bb8f372663a6f73f407e33de6

SHA256
868316e4235db3e9650d09780c24303110e2b048e1bf688db72b86ef911b5d8c

SHA512
5f466cf8c664dad351991856e1697dd983f192c2690752bfab7aab05d17c9785b15fe937c95b6ba8d3bac7b63c363e8aaf50e1845449865ef96907d75a1c8d7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47369.exe

Filesize
468KB

MD5
32f2ae2524b568e92e75142df472af51

SHA1
b0e1f7a6bbc9a5184c97b56574c71b41c96e3b6f

SHA256
53c002b69fdfe001a5fb8b82e5f11385c76729c24c80c1ea92ee33a51884f676

SHA512
1d31d70b2a8f7048bca67b84fe410ab59506d6d9c2c2bee1b06649e794565d73508a24d95071e8ee45f46a051a7a4966f3b3d98a1f74f3a82449687a58d16956

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47852.exe

Filesize
468KB

MD5
453865cd11055f35c8b2c3345ea5dff5

SHA1
4c3d255309627019c4b603f0ba5e797a885e35ef

SHA256
996ebfd956f1555ed1eaeffef53828abc370622121af57f415ed83a72f13fc28

SHA512
5955b4b0616240e766504a5d4fdfd08deeb374c24fe861f1c2fdd3beb0765316125e3a2bb7ba65d0749a3a2d64323f98991abb9ae03462012084e442d1d5d83d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54196.exe

Filesize
1B

MD5
93b885adfe0da089cdf634904fd59f71

SHA1
5ba93c9db0cff93f52b521d7420e43f6eda2784f

SHA256
6e340b9cffb37a989ca544e6bb780a2c78901d3fb33738768511a30617afa01d

SHA512
b8244d028981d693af7b456af8efa4cad63d282e19ff14942c246e50d9351d22704a802a71c3580b6370de4ceb293c324a8423342557d4e5c38438f0e36910ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57456.exe

Filesize
468KB

MD5
55cef136970f54a975e500422d0e89a2

SHA1
6729890aaf54081842685733e2e773a343537b27

SHA256
eda52bbc87e9fb0acb0e408fa02b7ad80cb3a62100380909b1694dcc8cf7ddcf

SHA512
fe472bc6ea9577cf793a33b950837d57f064cac8639af80d2c7c8cbb4a7404ac0a28e0640201c1ced5a426bc9bd85427728da449b0d57c6edcad6964cf79a76a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57619.exe

Filesize
468KB

MD5
29672d478434873829cdb29a38981e29

SHA1
53dbccd6fdd0475c305ba8214290c25a5d06f4da

SHA256
75f19eac8fce4af63cd8717d1a4e9b3edd02c19390294b1e17c5219a505bb0ff

SHA512
b3501c0a7954f9be8bace17179d6f39a78decbd8f87cf4113443e6f9402278cc0574e5172ced7194285849f40df7a608405f22b39482d558f1c8393b2e098452

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59081.exe

Filesize
468KB

MD5
8e1e89d3f2e3e7041cdc3747fc11b3b6

SHA1
7e222469eec5db57bdf7293fa4c7038881ee0ff1

SHA256
93eccffcf8193fdbee3100932e1511a081254300c405fd4c247a82f43779b2c9

SHA512
efeb138b5340a458ffd2ff34dc25569006c9ad7d3f111e8c8f3b1e1553b7615ad1052cdd7388edd78699ccf966a8a3ffb8088f41220a527ce7cc5b406717bc62

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61104.exe

Filesize
468KB

MD5
51483951925baaa56aa6d6ab99a3773e

SHA1
763c3d4154a57d6ce8c3f5726d14576f2bcec909

SHA256
2bf6e69bb6e72c0874f2ee3243e532a65b86da3b00a9cba93f60d52f29d52d4e

SHA512
a1b97932b6c7b920ebe3ad8c4be64f92296f0b518ebab27d6a2db14fc0a0ad14563d9610be4ebeb6cc94d6f782b9de0b1a5515f6786728ca1ec32ed4330d1d71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61587.exe

Filesize
468KB

MD5
cd301693e8e050aeb9186342485ac98b

SHA1
8958c15d7b7100cfc8a540b8bc142c51ea3184f9

SHA256
a03e6878983deb26106f3ba7e659e0e43f91015072b06bf43dcaff973bbdd729

SHA512
e5e977358eb661e619ec3a5301b0c2d9f837d62b5b3f3221dd400a602602672c182647f8e645e13174eed9d4549f3b746113ee5ec2d3204638d29f6560f69644

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exe

Filesize
468KB

MD5
199b91db8ac08d5a1f073c7369748acf

SHA1
28030e1852e89bf5367ecc88c60657f015499dcc

SHA256
08adf7b3e10335d5be286300483c51d80eccadbfc97b44d55ba0469fc3b4576e

SHA512
5eb59d7634a49ac701666d4be158f2c64327f72e779c2d9bd716e1f056d2ff212b31e9c70d4d8436a258d15bbcafbd183d30b9ce05b7de71c726bc07f1c8f01d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61977.exe

Filesize
468KB

MD5
c43ac738e681e3f65344fa94023bd3a0

SHA1
0f5a920bdd648759a7e10bd4ebdedb9e54b2990e

SHA256
41d7011966f90cbed7750dcd55c00333d94a791ff45be1239c1766039f902fac

SHA512
160fb08411c4cd9635e0bb1265a6bc66842530f628262f449d19bdbdaa95b472beaca3ec035d5f126a81fa49bed6a2a8fd43c524ff6f092a06b3c712666013da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62418.exe

Filesize
468KB

MD5
f2cd7f3a12945af08bb54d98a8ae6bff

SHA1
8ea6e7b6bc1d929477c44b9264162ab9d52fc8fb

SHA256
529b665e3aa642a4114905ead896cb681c71eaca516f80606162baf8eda4374e

SHA512
868ce3cb91dd561e53bbf2ed53403be3f20424e360501f8034b4836809e7ae9776112b586d45735e569f4508a351e2040cae860af2a8719055955a0c49eb7652

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63349.exe

Filesize
468KB

MD5
e6c344f46bbd3556b9509ca7a8fe68c5

SHA1
fd492aec929e444bedc88ecf4c1231f510731a81

SHA256
242b6f66496da7421ddcc170d690d4dcc1e7e0aa9d7bc94d16ba39cd71fef9c1

SHA512
48cc4d0c3ec59fe6f598f11b38d2f2b0946e9fe62df1cbb33e81e0f69a6273e8af0074d8037169a1920941d254d0c22a16b7b09ad0f7e469fc0394ff444b680f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7279.exe

Filesize
468KB

MD5
03852ac6a606f3cb9ef75fc140f99372

SHA1
8094c5c70e97789db8ff41d7ee0dde2612d7600a

SHA256
f3b8a587ddac708b7d5c3013fe98d06e71d65ff614ff5260e2a29ed402ef1d24

SHA512
750f49fdffc9f8f8692a5f910ffe2fb5237ff2205a15903ec4fe03efa05a298eead4141518754b7b7b462b348f8c950a8f5146e69844bd6cd9c9437314f70669

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe

Filesize
468KB

MD5
21d7cdc85a75f5632b6f3284f7db6ded

SHA1
11baad974d77740ac4d0380e879aeeec3eea3260

SHA256
ee468315c05059d71fadcbd547f465616d656962e3f38aebad2de19865dc9479

SHA512
44c4253154eaabe39b61d79ae7ba4355e44d2818caf21a6bcddb54ca4c67a341737a668725b177ef5924816879168167493f4380ea042584156b3b7c68bd330c

Download Submit
memory/408-419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/444-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/552-192-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/624-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/816-169-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/820-166-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/916-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/944-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1176-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1224-110-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1260-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1384-460-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1428-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1656-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1712-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1724-340-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1792-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1800-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1856-561-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1912-3010-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1920-46-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1928-101-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1928-2269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1944-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2012-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2084-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2188-289-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2340-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2620-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2700-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2728-58-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2744-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2808-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2972-164-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3064-81-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3140-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3268-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3288-560-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3304-363-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3320-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3340-463-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3596-117-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3604-168-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3644-128-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3804-103-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3824-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3840-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3856-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3944-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3956-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4116-313-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4156-165-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4192-438-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4248-219-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4260-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4280-32-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4296-163-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4312-83-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4320-167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4332-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4336-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4376-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4416-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4480-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4488-251-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4508-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4668-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4676-235-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4740-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4784-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4928-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4960-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5092-33-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5124-559-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5132-426-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5160-427-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5232-428-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5300-432-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5308-464-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5344-437-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5460-465-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5468-473-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5528-474-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5548-466-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5576-485-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5592-486-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5624-487-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5636-488-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5648-489-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5668-490-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5676-497-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5720-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5764-505-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5772-506-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5780-507-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5820-508-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5836-509-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5852-510-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14900-3071-0x00007FF857F10000-0x00007FF858105000-memory.dmp

Filesize
2.0MB

Download
memory/15104-2761-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads