ccc86f6d0719d3769c8c731ba2cf07bc94bbff57f811820f4380c560770c7ef0

Analysis

max time kernel
120s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 06:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ef276fe7a3eff9fadaa8eabd799b3f0N.exe
Size

468KB
MD5

4ef276fe7a3eff9fadaa8eabd799b3f0
SHA1

7ba7b18e901f1297ae089a2ab068ad37519babd5
SHA256

ccc86f6d0719d3769c8c731ba2cf07bc94bbff57f811820f4380c560770c7ef0
SHA512

ed65c5d09ad50b9bbee82cf976eb3ab89255d4236711b689ccec96eeef8ce486ccfa3f53b7c7cde81e3b9ff9deaee51c5f3f1ae488fb1c5657313591ab710622
SSDEEP

3072:eCmCogKOjZ8UFbYlPz3yqf+/Iphm4XpTGmHxqlFm40k512tN0zlX:eCro+KUFGPDyqf75f140IstN0

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4592	Unicorn-60086.exe
4084	Unicorn-27710.exe
3516	Unicorn-57429.exe
4252	Unicorn-5997.exe
1280	Unicorn-18996.exe
4948	Unicorn-32731.exe
4072	Unicorn-43989.exe
3504	Unicorn-15037.exe
4792	Unicorn-29080.exe
2596	Unicorn-9479.exe
1804	Unicorn-29345.exe
3560	Unicorn-24283.exe
2968	Unicorn-23214.exe
3800	Unicorn-49948.exe
3756	Unicorn-34567.exe
4880	Unicorn-54625.exe
4136	Unicorn-19492.exe
3468	Unicorn-245.exe
1992	Unicorn-19195.exe
4492	Unicorn-821.exe
2608	Unicorn-21988.exe
3268	Unicorn-41854.exe
2304	Unicorn-8035.exe
1144	Unicorn-629.exe
4004	Unicorn-41397.exe
2232	Unicorn-3701.exe
4756	Unicorn-7380.exe
1492	Unicorn-27246.exe
2484	Unicorn-58776.exe
116	Unicorn-37452.exe
4248	Unicorn-43582.exe
2656	Unicorn-8600.exe
3460	Unicorn-8408.exe
4872	Unicorn-50593.exe
2992	Unicorn-29195.exe
1352	Unicorn-15460.exe
4008	Unicorn-55232.exe
5036	Unicorn-35710.exe
3124	Unicorn-51589.exe
2740	Unicorn-49825.exe
2360	Unicorn-59062.exe
3304	Unicorn-63509.exe
4204	Unicorn-17838.exe
2960	Unicorn-39004.exe
4168	Unicorn-12283.exe
408	Unicorn-59446.exe
860	Unicorn-34942.exe
2268	Unicorn-50324.exe
2988	Unicorn-25620.exe
1120	Unicorn-14884.exe
4404	Unicorn-59254.exe
2572	Unicorn-36286.exe
5060	Unicorn-18532.exe
984	Unicorn-38782.exe
4752	Unicorn-38590.exe
4188	Unicorn-21102.exe
4376	Unicorn-12171.exe
3496	Unicorn-28393.exe
2764	Unicorn-12056.exe
2092	Unicorn-58413.exe
4108	Unicorn-57536.exe
3436	Unicorn-62518.exe
1660	Unicorn-28512.exe
1156	Unicorn-22646.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5980	3304	WerFault.exe	135
6224	2176	WerFault.exe	166

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9435.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43852.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6491.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37452.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39570.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10934.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17991.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38919.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62583.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21102.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4589.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11617.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24310.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64127.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47095.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26814.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53833.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8408.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37342.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23214.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1104.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44953.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45510.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31943.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2689.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38590.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27764.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53110.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46284.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4ef276fe7a3eff9fadaa8eabd799b3f0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50965.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48741.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21067.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15556	dwm.exe
Token: SeChangeNotifyPrivilege	15556	dwm.exe
Token: 33	15556	dwm.exe
Token: SeIncBasePriorityPrivilege	15556	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3188	4ef276fe7a3eff9fadaa8eabd799b3f0N.exe
4592	Unicorn-60086.exe
3516	Unicorn-57429.exe
4084	Unicorn-27710.exe
4252	Unicorn-5997.exe
4948	Unicorn-32731.exe
1280	Unicorn-18996.exe
4072	Unicorn-43989.exe
3504	Unicorn-15037.exe
2596	Unicorn-9479.exe
1804	Unicorn-29345.exe
4792	Unicorn-29080.exe
3560	Unicorn-24283.exe
2968	Unicorn-23214.exe
3800	Unicorn-49948.exe
3756	Unicorn-34567.exe
4880	Unicorn-54625.exe
4136	Unicorn-19492.exe
3468	Unicorn-245.exe
1992	Unicorn-19195.exe
4492	Unicorn-821.exe
2304	Unicorn-8035.exe
2608	Unicorn-21988.exe
4004	Unicorn-41397.exe
1144	Unicorn-629.exe
3268	Unicorn-41854.exe
2232	Unicorn-3701.exe
2484	Unicorn-58776.exe
1492	Unicorn-27246.exe
4756	Unicorn-7380.exe
4248	Unicorn-43582.exe
116	Unicorn-37452.exe
2656	Unicorn-8600.exe
3460	Unicorn-8408.exe
4872	Unicorn-50593.exe
1352	Unicorn-15460.exe
2992	Unicorn-29195.exe
4008	Unicorn-55232.exe
5036	Unicorn-35710.exe
3124	Unicorn-51589.exe
4204	Unicorn-17838.exe
4168	Unicorn-12283.exe
3304	Unicorn-63509.exe
2360	Unicorn-59062.exe
2960	Unicorn-39004.exe
408	Unicorn-59446.exe
2268	Unicorn-50324.exe
1120	Unicorn-14884.exe
2740	Unicorn-49825.exe
860	Unicorn-34942.exe
4404	Unicorn-59254.exe
2572	Unicorn-36286.exe
5060	Unicorn-18532.exe
984	Unicorn-38782.exe
4376	Unicorn-12171.exe
4752	Unicorn-38590.exe
2092	Unicorn-58413.exe
4188	Unicorn-21102.exe
2764	Unicorn-12056.exe
3496	Unicorn-28393.exe
4108	Unicorn-57536.exe
1156	Unicorn-22646.exe
3436	Unicorn-62518.exe
1660	Unicorn-28512.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 4592	3188	4ef276fe7a3eff9fadaa8eabd799b3f0N.exe	89
PID 3188 wrote to memory of 4592	3188	4ef276fe7a3eff9fadaa8eabd799b3f0N.exe	89
PID 3188 wrote to memory of 4592	3188	4ef276fe7a3eff9fadaa8eabd799b3f0N.exe	89
PID 4592 wrote to memory of 4084	4592	Unicorn-60086.exe	93
PID 4592 wrote to memory of 4084	4592	Unicorn-60086.exe	93
PID 4592 wrote to memory of 4084	4592	Unicorn-60086.exe	93
PID 3188 wrote to memory of 3516	3188	4ef276fe7a3eff9fadaa8eabd799b3f0N.exe	94
PID 3188 wrote to memory of 3516	3188	4ef276fe7a3eff9fadaa8eabd799b3f0N.exe	94
PID 3188 wrote to memory of 3516	3188	4ef276fe7a3eff9fadaa8eabd799b3f0N.exe	94
PID 3516 wrote to memory of 4252	3516	Unicorn-57429.exe	97
PID 3516 wrote to memory of 4252	3516	Unicorn-57429.exe	97
PID 3516 wrote to memory of 4252	3516	Unicorn-57429.exe	97
PID 4592 wrote to memory of 1280	4592	Unicorn-60086.exe	99
PID 4592 wrote to memory of 1280	4592	Unicorn-60086.exe	99
PID 4592 wrote to memory of 1280	4592	Unicorn-60086.exe	99
PID 3188 wrote to memory of 4948	3188	4ef276fe7a3eff9fadaa8eabd799b3f0N.exe	98
PID 3188 wrote to memory of 4948	3188	4ef276fe7a3eff9fadaa8eabd799b3f0N.exe	98
PID 3188 wrote to memory of 4948	3188	4ef276fe7a3eff9fadaa8eabd799b3f0N.exe	98
PID 4084 wrote to memory of 4072	4084	Unicorn-27710.exe	100
PID 4084 wrote to memory of 4072	4084	Unicorn-27710.exe	100
PID 4084 wrote to memory of 4072	4084	Unicorn-27710.exe	100
PID 4252 wrote to memory of 3504	4252	Unicorn-5997.exe	101
PID 4252 wrote to memory of 3504	4252	Unicorn-5997.exe	101
PID 4252 wrote to memory of 3504	4252	Unicorn-5997.exe	101
PID 3188 wrote to memory of 4792	3188	4ef276fe7a3eff9fadaa8eabd799b3f0N.exe	102
PID 3188 wrote to memory of 4792	3188	4ef276fe7a3eff9fadaa8eabd799b3f0N.exe	102
PID 3188 wrote to memory of 4792	3188	4ef276fe7a3eff9fadaa8eabd799b3f0N.exe	102
PID 3516 wrote to memory of 2596	3516	Unicorn-57429.exe	103
PID 3516 wrote to memory of 2596	3516	Unicorn-57429.exe	103
PID 3516 wrote to memory of 2596	3516	Unicorn-57429.exe	103
PID 1280 wrote to memory of 1804	1280	Unicorn-18996.exe	104
PID 1280 wrote to memory of 1804	1280	Unicorn-18996.exe	104
PID 1280 wrote to memory of 1804	1280	Unicorn-18996.exe	104
PID 4592 wrote to memory of 3560	4592	Unicorn-60086.exe	105
PID 4592 wrote to memory of 3560	4592	Unicorn-60086.exe	105
PID 4592 wrote to memory of 3560	4592	Unicorn-60086.exe	105
PID 4072 wrote to memory of 2968	4072	Unicorn-43989.exe	106
PID 4072 wrote to memory of 2968	4072	Unicorn-43989.exe	106
PID 4072 wrote to memory of 2968	4072	Unicorn-43989.exe	106
PID 4084 wrote to memory of 3800	4084	Unicorn-27710.exe	107
PID 4084 wrote to memory of 3800	4084	Unicorn-27710.exe	107
PID 4084 wrote to memory of 3800	4084	Unicorn-27710.exe	107
PID 4948 wrote to memory of 3756	4948	Unicorn-32731.exe	108
PID 4948 wrote to memory of 3756	4948	Unicorn-32731.exe	108
PID 4948 wrote to memory of 3756	4948	Unicorn-32731.exe	108
PID 3504 wrote to memory of 4880	3504	Unicorn-15037.exe	109
PID 3504 wrote to memory of 4880	3504	Unicorn-15037.exe	109
PID 3504 wrote to memory of 4880	3504	Unicorn-15037.exe	109
PID 4252 wrote to memory of 4136	4252	Unicorn-5997.exe	110
PID 4252 wrote to memory of 4136	4252	Unicorn-5997.exe	110
PID 4252 wrote to memory of 4136	4252	Unicorn-5997.exe	110
PID 2596 wrote to memory of 3468	2596	Unicorn-9479.exe	111
PID 2596 wrote to memory of 3468	2596	Unicorn-9479.exe	111
PID 2596 wrote to memory of 3468	2596	Unicorn-9479.exe	111
PID 3516 wrote to memory of 1992	3516	Unicorn-57429.exe	112
PID 3516 wrote to memory of 1992	3516	Unicorn-57429.exe	112
PID 3516 wrote to memory of 1992	3516	Unicorn-57429.exe	112
PID 1804 wrote to memory of 4492	1804	Unicorn-29345.exe	113
PID 1804 wrote to memory of 4492	1804	Unicorn-29345.exe	113
PID 1804 wrote to memory of 4492	1804	Unicorn-29345.exe	113
PID 1280 wrote to memory of 2608	1280	Unicorn-18996.exe	114
PID 1280 wrote to memory of 2608	1280	Unicorn-18996.exe	114
PID 1280 wrote to memory of 2608	1280	Unicorn-18996.exe	114
PID 4792 wrote to memory of 3268	4792	Unicorn-29080.exe	115

C:\Users\Admin\AppData\Local\Temp\4ef276fe7a3eff9fadaa8eabd799b3f0N.exe
"C:\Users\Admin\AppData\Local\Temp\4ef276fe7a3eff9fadaa8eabd799b3f0N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60086.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60086.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27710.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27710.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43989.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3701.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36286.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47246.exe
        8⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41014.exe
        9⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38726.exe
        10⤵
        
        PID:8720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44437.exe
        10⤵
        
        PID:12360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29748.exe
        10⤵
        
        PID:16244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50163.exe
        10⤵
        
        PID:18184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19143.exe
        9⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe
        9⤵
        
        PID:13324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31248.exe
        9⤵
        
        PID:16660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5300.exe
        8⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-389.exe
        9⤵
        
        PID:9840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60213.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57445.exe
        9⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44228.exe
        8⤵
        
        PID:9636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14660.exe
        8⤵
        
        PID:13664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29143.exe
        8⤵
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
        7⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18430.exe
        8⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51033.exe
        9⤵
        
        PID:12076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1884.exe
        9⤵
        
        PID:15544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23308.exe
        9⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30667.exe
        9⤵
        
        PID:18392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17991.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe
        8⤵
        
        PID:13420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5365.exe
        8⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38724.exe
        7⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe
        8⤵
        
        PID:11164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61452.exe
        8⤵
        
        PID:13796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5591.exe
        8⤵
        
        PID:17024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65168.exe
        7⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58364.exe
        8⤵
        
        PID:4616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18854.exe
        8⤵
        
        PID:18052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13779.exe
        7⤵
        
        PID:13956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        7⤵
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57892.exe
        7⤵
        
        PID:17968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18532.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30334.exe
        7⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6312.exe
        8⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13069.exe
        9⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64140.exe
        9⤵
        
        PID:12808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43590.exe
        9⤵
        
        PID:16232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26038.exe
        9⤵
        
        PID:17340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20012.exe
        8⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57701.exe
        8⤵
        
        PID:12984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38919.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5492.exe
        7⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62574.exe
        8⤵
        
        PID:12024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26293.exe
        8⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60162.exe
        8⤵
        
        PID:11280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44996.exe
        7⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10515.exe
        7⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16428.exe
        7⤵
        
        PID:16696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63996.exe
        6⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10749.exe
        7⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8365.exe
        8⤵
        
        PID:9820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65036.exe
        9⤵
        
        PID:18324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36647.exe
        8⤵
        
        PID:14876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36619.exe
        8⤵
        
        PID:17132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30876.exe
        7⤵
        
        PID:10400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7534.exe
        7⤵
        
        PID:13600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5712.exe
        7⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2804.exe
        6⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10088.exe
        7⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24364.exe
        7⤵
        
        PID:14608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44407.exe
        7⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26814.exe
        6⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7244.exe
        6⤵
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1104.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7380.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14957.exe
        7⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34081.exe
        8⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43150.exe
        9⤵
        
        PID:9956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59528.exe
        9⤵
        
        PID:13648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8015.exe
        9⤵
        
        PID:968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27228.exe
        8⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe
        8⤵
        
        PID:13408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32174.exe
        8⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6535.exe
        7⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe
        8⤵
        
        PID:11156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35879.exe
        8⤵
        
        PID:13744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29174.exe
        8⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58047.exe
        8⤵
        
        PID:11940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44420.exe
        7⤵
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15511.exe
        7⤵
        
        PID:13708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12999.exe
        7⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55051.exe
        7⤵
        
        PID:11636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43327.exe
        6⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23852.exe
        7⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29614.exe
        7⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17068.exe
        7⤵
        
        PID:15220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22582.exe
        7⤵
        
        PID:9388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62476.exe
        6⤵
        
        PID:7408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35480.exe
        6⤵
        
        PID:10616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23779.exe
        6⤵
        
        PID:13508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45434.exe
        6⤵
        
        PID:16992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22646.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5165.exe
        6⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58393.exe
        7⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6829.exe
        8⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2267.exe
        8⤵
        
        PID:14000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22010.exe
        8⤵
        
        PID:17304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17991.exe
        7⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe
        7⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31824.exe
        7⤵
        
        PID:17320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16820.exe
        6⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40545.exe
        7⤵
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2267.exe
        7⤵
        
        PID:14160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63310.exe
        7⤵
        
        PID:880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59303.exe
        6⤵
        
        PID:10044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3691.exe
        6⤵
        
        PID:14504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13338.exe
        6⤵
        
        PID:11120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5476.exe
        5⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54169.exe
        6⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40108.exe
        6⤵
        
        PID:10640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38100.exe
        6⤵
        
        PID:14616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21242.exe
        6⤵
        
        PID:17108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38244.exe
        5⤵
        
        PID:7380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7653.exe
        6⤵
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18854.exe
        6⤵
        
        PID:18060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42287.exe
        5⤵
        
        PID:12156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13349.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48106.exe
        5⤵
        
        PID:6780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49948.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27246.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12056.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14957.exe
        7⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18430.exe
        8⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14525.exe
        9⤵
        
        PID:12040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10149.exe
        9⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62484.exe
        8⤵
        
        PID:10800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48485.exe
        8⤵
        
        PID:14116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13383.exe
        8⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4231.exe
        7⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37020.exe
        7⤵
        
        PID:10040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38973.exe
        7⤵
        
        PID:13616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16243.exe
        7⤵
        
        PID:8756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41708.exe
        6⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44953.exe
        7⤵
        
        PID:7796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50965.exe
        7⤵
        
        PID:11524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6491.exe
        7⤵
        
        PID:15320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30480.exe
        7⤵
        
        PID:17060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64588.exe
        6⤵
        
        PID:2432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55180.exe
        6⤵
        
        PID:11340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20200.exe
        6⤵
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57536.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46006.exe
        6⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53593.exe
        7⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        7⤵
        
        PID:10732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54135.exe
        7⤵
        
        PID:14716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54792.exe
        7⤵
        
        PID:16984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-692.exe
        6⤵
        
        PID:8184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30382.exe
        6⤵
        
        PID:11772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12356.exe
        6⤵
        
        PID:13036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11617.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57063.exe
        5⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28897.exe
        6⤵
        
        PID:2364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23964.exe
        6⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38100.exe
        6⤵
        
        PID:14644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21335.exe
        5⤵
        
        PID:7436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58823.exe
        5⤵
        
        PID:12164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61821.exe
        5⤵
        
        PID:15504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5278.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12734.exe
        5⤵
        
        PID:18740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58776.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38782.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15533.exe
        6⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30734.exe
        7⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38726.exe
        8⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11956.exe
        8⤵
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31943.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20012.exe
        7⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55479.exe
        7⤵
        
        PID:12636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19277.exe
        7⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24310.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44688.exe
        6⤵
        
        PID:7964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52693.exe
        6⤵
        
        PID:14244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41753.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27764.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
        6⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41070.exe
        7⤵
        
        PID:12408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30671.exe
        7⤵
        
        PID:17436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46165.exe
        6⤵
        
        PID:9976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19459.exe
        6⤵
        
        PID:13584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46590.exe
        6⤵
        
        PID:9036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12974.exe
        5⤵
        
        PID:8076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34269.exe
        6⤵
        
        PID:2972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33545.exe
        6⤵
        
        PID:11688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21556.exe
        5⤵
        
        PID:11556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3691.exe
        5⤵
        
        PID:14568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63115.exe
        5⤵
        
        PID:17292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12171.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15533.exe
        5⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18430.exe
        6⤵
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29916.exe
        6⤵
        
        PID:10060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe
        6⤵
        
        PID:13444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9239.exe
        6⤵
        
        PID:16860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-100.exe
        5⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41614.exe
        6⤵
        
        PID:8464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59144.exe
        6⤵
        
        PID:14016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48927.exe
        6⤵
        
        PID:17016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57981.exe
        5⤵
        
        PID:10952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
        5⤵
        
        PID:14324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53833.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30700.exe
        5⤵
        
        PID:18272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47244.exe
      4⤵
      PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18430.exe
        5⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37849.exe
        6⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35391.exe
        6⤵
        
        PID:12412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62613.exe
        6⤵
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51808.exe
        6⤵
        
        PID:18292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
        5⤵
        
        PID:10808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65013.exe
        5⤵
        
        PID:14148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13345.exe
        5⤵
        
        PID:16692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56729.exe
      4⤵
      PID:7608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5677.exe
        5⤵
        
        PID:11704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58293.exe
        5⤵
        
        PID:14840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27494.exe
        5⤵
        
        PID:10660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20427.exe
      4⤵
      PID:10264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19431.exe
      4⤵
      PID:13936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40677.exe
      4⤵
      PID:8512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18996.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18996.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-821.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49825.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46369.exe
        7⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64366.exe
        8⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13069.exe
        9⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54903.exe
        9⤵
        
        PID:12780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19277.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43143.exe
        9⤵
        
        PID:18336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
        8⤵
        
        PID:8952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14638.exe
        8⤵
        
        PID:12500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11109.exe
        8⤵
        
        PID:2512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1150.exe
        8⤵
        
        PID:9328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46997.exe
        7⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34702.exe
        8⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53768.exe
        8⤵
        
        PID:15208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43029.exe
        8⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-507.exe
        7⤵
        
        PID:9380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59433.exe
        8⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25185.exe
        8⤵
        
        PID:18400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22445.exe
        7⤵
        
        PID:12372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63423.exe
        7⤵
        
        PID:16652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25351.exe
        6⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30817.exe
        7⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13736.exe
        8⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2267.exe
        8⤵
        
        PID:13800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31248.exe
        8⤵
        
        PID:9300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40685.exe
        7⤵
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33187.exe
        7⤵
        
        PID:13536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6973.exe
        7⤵
        
        PID:7848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38724.exe
        6⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56297.exe
        7⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20124.exe
        7⤵
        
        PID:11432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39645.exe
        7⤵
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24144.exe
        7⤵
        
        PID:17880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63549.exe
        6⤵
        
        PID:9508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5611.exe
        6⤵
        
        PID:12516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64342.exe
        6⤵
        
        PID:7924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39004.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2840.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15934.exe
        7⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7677.exe
        8⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47120.exe
        8⤵
        
        PID:11312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45510.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41498.exe
        8⤵
        
        PID:18192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20095.exe
        7⤵
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58172.exe
        7⤵
        
        PID:12352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11109.exe
        7⤵
        
        PID:16280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40559.exe
        7⤵
        
        PID:18068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44688.exe
        6⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39798.exe
        7⤵
        
        PID:12388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32349.exe
        7⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44298.exe
        7⤵
        
        PID:18172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37020.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe
        6⤵
        
        PID:13268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10612.exe
        6⤵
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24962.exe
        6⤵
        
        PID:18216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22667.exe
        5⤵
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40822.exe
        6⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39969.exe
        7⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2267.exe
        7⤵
        
        PID:14144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38731.exe
        7⤵
        
        PID:17472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27228.exe
        6⤵
        
        PID:9356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe
        6⤵
        
        PID:13436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24006.exe
        6⤵
        
        PID:7832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64864.exe
        5⤵
        
        PID:7588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32865.exe
        6⤵
        
        PID:11180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22828.exe
        6⤵
        
        PID:13824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14417.exe
        6⤵
        
        PID:17248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41428.exe
        5⤵
        
        PID:10336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13772.exe
        5⤵
        
        PID:13608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24648.exe
        5⤵
        
        PID:17832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21988.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17838.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53110.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6504.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16718.exe
        8⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25599.exe
        8⤵
        
        PID:12528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62613.exe
        8⤵
        
        PID:16352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64195.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1467.exe
        7⤵
        
        PID:10200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14276.exe
        7⤵
        
        PID:12764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18739.exe
        7⤵
        
        PID:7640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31043.exe
        6⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62937.exe
        7⤵
        
        PID:9640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2267.exe
        7⤵
        
        PID:13992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22854.exe
        7⤵
        
        PID:8552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57981.exe
        6⤵
        
        PID:11000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56732.exe
        6⤵
        
        PID:14308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37029.exe
        6⤵
        
        PID:8
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16584.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34588.exe
        5⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29665.exe
        6⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29804.exe
        6⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34653.exe
        7⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34422.exe
        7⤵
        
        PID:18416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60564.exe
        6⤵
        
        PID:8140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13591.exe
        6⤵
        
        PID:13656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15916.exe
        6⤵
        
        PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12020.exe
        5⤵
        
        PID:7944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26293.exe
        6⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60847.exe
        6⤵
        
        PID:17804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58807.exe
        5⤵
        
        PID:10860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23092.exe
        5⤵
        
        PID:14176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38839.exe
        5⤵
        
        PID:8392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12283.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28990.exe
        5⤵
        
        PID:2176
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2176 -s 716
        6⤵
        Program crash
        
        PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43540.exe
        5⤵
        
        PID:6456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13069.exe
        6⤵
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39549.exe
        6⤵
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54224.exe
        6⤵
        
        PID:15628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33830.exe
        5⤵
        
        PID:8848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39725.exe
        5⤵
        
        PID:11440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45013.exe
        5⤵
        
        PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39591.exe
        5⤵
        
        PID:18408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53037.exe
      4⤵
      PID:720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-920.exe
        5⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53806.exe
        6⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42796.exe
        6⤵
        
        PID:11584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6491.exe
        6⤵
        
        PID:13352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26061.exe
        6⤵
        
        PID:8776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26260.exe
        5⤵
        
        PID:8252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8203.exe
        5⤵
        
        PID:11848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59621.exe
        5⤵
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39570.exe
        5⤵
        
        PID:18012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9883.exe
      4⤵
      PID:6232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51033.exe
        5⤵
        
        PID:12032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1884.exe
        5⤵
        
        PID:15524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48389.exe
        5⤵
        
        PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65067.exe
        5⤵
        
        PID:18836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21628.exe
      4⤵
      PID:9344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52363.exe
      4⤵
      PID:14580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26890.exe
      4⤵
      PID:17072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24283.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24283.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-629.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59062.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55030.exe
        6⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9389.exe
        7⤵
        
        PID:2044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38150.exe
        8⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13678.exe
        8⤵
        
        PID:12856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43782.exe
        8⤵
        
        PID:16132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41498.exe
        8⤵
        
        PID:18144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34127.exe
        7⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9547.exe
        7⤵
        
        PID:11320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37534.exe
        7⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16054.exe
        7⤵
        
        PID:18040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3188.exe
        6⤵
        
        PID:7516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26814.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22703.exe
        6⤵
        
        PID:13756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28484.exe
        6⤵
        
        PID:17144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51885.exe
        5⤵
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59270.exe
        6⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62937.exe
        7⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2844.exe
        7⤵
        
        PID:13968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8015.exe
        7⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17991.exe
        6⤵
        
        PID:9440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe
        6⤵
        
        PID:13380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59278.exe
        6⤵
        
        PID:8104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45460.exe
        5⤵
        
        PID:7704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41894.exe
        6⤵
        
        PID:17084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25589.exe
        5⤵
        
        PID:9540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45959.exe
        5⤵
        
        PID:13624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60619.exe
        5⤵
        
        PID:17224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63509.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3304
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3304 -s 720
        5⤵
        Program crash
        
        PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8443.exe
      4⤵
      PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6312.exe
        5⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28321.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        6⤵
        
        PID:10584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22339.exe
        6⤵
        
        PID:14696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-596.exe
        6⤵
        
        PID:16716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33363.exe
        5⤵
        
        PID:8456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40109.exe
        5⤵
        
        PID:12276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51069.exe
        5⤵
        
        PID:8380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36421.exe
      4⤵
      PID:6952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33057.exe
        5⤵
        
        PID:11124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62984.exe
        5⤵
        
        PID:13772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-494.exe
        5⤵
        
        PID:16632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56503.exe
      4⤵
      PID:10028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53544.exe
      4⤵
      PID:13340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13107.exe
      4⤵
      PID:17156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41397.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41397.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34942.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55414.exe
        5⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15742.exe
        6⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6141.exe
        7⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15657.exe
        8⤵
        
        PID:9808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60213.exe
        8⤵
        
        PID:1148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62930.exe
        8⤵
        
        PID:17308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53840.exe
        7⤵
        
        PID:10980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50295.exe
        7⤵
        
        PID:14296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33744.exe
        7⤵
        
        PID:17684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44133.exe
        6⤵
        
        PID:8332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7243.exe
        6⤵
        
        PID:12184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19277.exe
        6⤵
        
        PID:960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63698.exe
        6⤵
        
        PID:17820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-100.exe
        5⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8189.exe
        6⤵
        
        PID:11304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51528.exe
        6⤵
        
        PID:17036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2427.exe
        5⤵
        
        PID:9624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54240.exe
        5⤵
        
        PID:12508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18780.exe
        5⤵
        
        PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39570.exe
        5⤵
        
        PID:17928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6312.exe
        5⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13069.exe
        6⤵
        
        PID:2756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54903.exe
        6⤵
        
        PID:12772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60118.exe
        6⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43143.exe
        6⤵
        
        PID:18352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28948.exe
        5⤵
        
        PID:8856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38470.exe
        6⤵
        
        PID:15668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32157.exe
        6⤵
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3950.exe
        6⤵
        
        PID:11176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33859.exe
        5⤵
        
        PID:12868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40651.exe
        5⤵
        
        PID:17012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30555.exe
      4⤵
      PID:6960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23358.exe
        5⤵
        
        PID:9064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2267.exe
        5⤵
        
        PID:14092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5482.exe
        5⤵
        
        PID:16672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64976.exe
      4⤵
      PID:10120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52693.exe
      4⤵
      PID:14272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41369.exe
      4⤵
      PID:18044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50324.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50324.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57360.exe
      4⤵
      PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54662.exe
        5⤵
        
        PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15220.exe
        5⤵
        
        PID:10356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42039.exe
        5⤵
        
        PID:14252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46398.exe
        5⤵
        
        PID:9188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49020.exe
      4⤵
      PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65214.exe
        5⤵
        
        PID:7812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58330.exe
        5⤵
        
        PID:17884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61328.exe
      4⤵
      PID:11904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27318.exe
      4⤵
      PID:12576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22349.exe
      4⤵
      PID:8920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46284.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46284.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18430.exe
      4⤵
      PID:7104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1261.exe
        5⤵
        
        PID:11104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62984.exe
        5⤵
        
        PID:13696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60076.exe
        5⤵
        
        PID:8924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33155.exe
      4⤵
      PID:7892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49043.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49043.exe
    3⤵
    PID:7352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13280.exe
      4⤵
      PID:13948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51878.exe
      4⤵
      PID:8472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23255.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23255.exe
    3⤵
    PID:11204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61789.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61789.exe
    3⤵
    PID:14828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52856.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52856.exe
    3⤵
    PID:17192
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57429.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57429.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5997.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5997.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15037.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54625.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8600.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62518.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64070.exe
        8⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32020.exe
        9⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29614.exe
        9⤵
        
        PID:10600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8132.exe
        9⤵
        
        PID:14100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38885.exe
        9⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48741.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41158.exe
        9⤵
        
        PID:13788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48072.exe
        9⤵
        
        PID:18944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29614.exe
        8⤵
        
        PID:10452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32445.exe
        8⤵
        
        PID:392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22198.exe
        8⤵
        
        PID:16864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61413.exe
        7⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exe
        8⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
        8⤵
        
        PID:12336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37508.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9435.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45200.exe
        7⤵
        
        PID:13028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12724.exe
        7⤵
        
        PID:14400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57163.exe
        7⤵
        
        PID:18752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58797.exe
        6⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43540.exe
        7⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38150.exe
        8⤵
        
        PID:3640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13678.exe
        8⤵
        
        PID:12848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43782.exe
        8⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41991.exe
        8⤵
        
        PID:18372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33747.exe
        7⤵
        
        PID:9180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29549.exe
        7⤵
        
        PID:12592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35116.exe
        7⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39570.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9611.exe
        6⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50350.exe
        7⤵
        
        PID:8948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65480.exe
        7⤵
        
        PID:12840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
        7⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50163.exe
        7⤵
        
        PID:18156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14615.exe
        6⤵
        
        PID:8188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35382.exe
        6⤵
        
        PID:12704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10413.exe
        6⤵
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26377.exe
        6⤵
        
        PID:17444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15460.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4485.exe
        6⤵
        
        PID:4936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26494.exe
        7⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13069.exe
        8⤵
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48848.exe
        8⤵
        
        PID:11548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19277.exe
        8⤵
        
        PID:2328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55442.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4636.exe
        7⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33859.exe
        7⤵
        
        PID:9620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe
        7⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16054.exe
        7⤵
        
        PID:17924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64485.exe
        6⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48686.exe
        7⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-961.exe
        7⤵
        
        PID:17844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40964.exe
        6⤵
        
        PID:9312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13207.exe
        6⤵
        
        PID:14788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54645.exe
        6⤵
        
        PID:7928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5563.exe
        5⤵
        
        PID:3248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41102.exe
        6⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53806.exe
        7⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42796.exe
        7⤵
        
        PID:11592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6491.exe
        7⤵
        
        PID:14476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-212.exe
        7⤵
        
        PID:8268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58248.exe
        6⤵
        
        PID:8196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62583.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26756.exe
        6⤵
        
        PID:2624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24962.exe
        6⤵
        
        PID:18208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39213.exe
        5⤵
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46318.exe
        6⤵
        
        PID:1140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41364.exe
        6⤵
        
        PID:11756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27446.exe
        6⤵
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56106.exe
        6⤵
        
        PID:18004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6635.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60648.exe
        5⤵
        
        PID:12552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29207.exe
        5⤵
        
        PID:4560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19492.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8408.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28777.exe
        6⤵
        
        PID:3592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46198.exe
        7⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54662.exe
        8⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15220.exe
        8⤵
        
        PID:10252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51639.exe
        8⤵
        
        PID:14468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24582.exe
        8⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1735.exe
        7⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61623.exe
        7⤵
        
        PID:12176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21484.exe
        7⤵
        
        PID:15476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26948.exe
        7⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22658.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18740.exe
        6⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29198.exe
        7⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39532.exe
        7⤵
        
        PID:11132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46652.exe
        7⤵
        
        PID:15180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63118.exe
        7⤵
        
        PID:16704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41044.exe
        6⤵
        
        PID:7344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1951.exe
        6⤵
        
        PID:12200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55372.exe
        6⤵
        
        PID:12344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45005.exe
        6⤵
        
        PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64852.exe
        5⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9000.exe
        6⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32985.exe
        7⤵
        
        PID:13468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30671.exe
        7⤵
        
        PID:17152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17991.exe
        6⤵
        
        PID:9432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe
        6⤵
        
        PID:13396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37508.exe
        6⤵
        
        PID:1488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33069.exe
        5⤵
        
        PID:7540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43830.exe
        6⤵
        
        PID:184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24364.exe
        6⤵
        
        PID:14652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18716.exe
        6⤵
        
        PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57764.exe
        5⤵
        
        PID:8616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53928.exe
        5⤵
        
        PID:13640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4100.exe
        5⤵
        
        PID:4996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29195.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43022.exe
        5⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4589.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54662.exe
        7⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63129.exe
        8⤵
        
        PID:9480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60213.exe
        8⤵
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24004.exe
        8⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23943.exe
        7⤵
        
        PID:10604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9454.exe
        7⤵
        
        PID:13812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37508.exe
        7⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64317.exe
        6⤵
        
        PID:9192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4542.exe
        6⤵
        
        PID:14520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47079.exe
        6⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19591.exe
        5⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37273.exe
        6⤵
        
        PID:8224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7623.exe
        6⤵
        
        PID:11816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27254.exe
        6⤵
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41498.exe
        6⤵
        
        PID:18200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38552.exe
        5⤵
        
        PID:8600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15294.exe
        5⤵
        
        PID:13272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22349.exe
        5⤵
        
        PID:8996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11620.exe
      4⤵
      PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25150.exe
        5⤵
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38150.exe
        6⤵
        
        PID:7524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41364.exe
        6⤵
        
        PID:11760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37342.exe
        6⤵
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15286.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4636.exe
        5⤵
        
        PID:8796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33965.exe
        5⤵
        
        PID:12320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62813.exe
        5⤵
        
        PID:8568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8539.exe
      4⤵
      PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52470.exe
        5⤵
        
        PID:10692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29460.exe
        5⤵
        
        PID:13776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2990.exe
        5⤵
        
        PID:17048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12391.exe
      4⤵
      PID:9256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5072.exe
      4⤵
      PID:14232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6953.exe
      4⤵
      PID:17124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9479.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9479.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-245.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50593.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18793.exe
        6⤵
        
        PID:3748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26494.exe
        7⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13069.exe
        8⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39549.exe
        8⤵
        
        PID:11872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37887.exe
        8⤵
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34386.exe
        8⤵
        
        PID:18988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4636.exe
        7⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33859.exe
        7⤵
        
        PID:12876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49888.exe
        7⤵
        
        PID:17188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3188.exe
        6⤵
        
        PID:7792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26814.exe
        6⤵
        
        PID:10464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7244.exe
        6⤵
        
        PID:14680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62993.exe
        6⤵
        
        PID:17052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22279.exe
        5⤵
        
        PID:3484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45046.exe
        6⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54662.exe
        7⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15220.exe
        7⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38292.exe
        7⤵
        
        PID:14552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27405.exe
        7⤵
        
        PID:5648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35284.exe
        6⤵
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55463.exe
        6⤵
        
        PID:11896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35984.exe
        6⤵
        
        PID:13980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62546.exe
        6⤵
        
        PID:17464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10934.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exe
        6⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
        6⤵
        
        PID:12580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25101.exe
        6⤵
        
        PID:8936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13956.exe
        5⤵
        
        PID:8664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40559.exe
        5⤵
        
        PID:12628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe
        5⤵
        
        PID:17216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55232.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1304.exe
        5⤵
        
        PID:3944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26494.exe
        6⤵
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13069.exe
        7⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32816.exe
        8⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58242.exe
        8⤵
        
        PID:17680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8884.exe
        7⤵
        
        PID:11640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35422.exe
        7⤵
        
        PID:2108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1150.exe
        7⤵
        
        PID:17104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58824.exe
        6⤵
        
        PID:8644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58172.exe
        6⤵
        
        PID:12904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60585.exe
        6⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42183.exe
        6⤵
        
        PID:11676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5003.exe
        5⤵
        
        PID:7800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32206.exe
        6⤵
        
        PID:12200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
        6⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43359.exe
        6⤵
        
        PID:18164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11364.exe
        5⤵
        
        PID:10548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6846.exe
        5⤵
        
        PID:13688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60619.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46788.exe
      4⤵
      PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26494.exe
        5⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61097.exe
        6⤵
        
        PID:8040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1956.exe
        6⤵
        
        PID:11576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6491.exe
        6⤵
        
        PID:14572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41245.exe
        6⤵
        
        PID:9124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26260.exe
        5⤵
        
        PID:8244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8203.exe
        5⤵
        
        PID:11864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36844.exe
        5⤵
        
        PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24962.exe
        5⤵
        
        PID:18224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18548.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe
        5⤵
        
        PID:11148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35988.exe
        5⤵
        
        PID:13492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3896.exe
        5⤵
        
        PID:6052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28926.exe
      4⤵
      PID:9228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62781.exe
      4⤵
      PID:13892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62993.exe
      4⤵
      PID:16972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35710.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26686.exe
        5⤵
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22462.exe
        6⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13069.exe
        7⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32816.exe
        8⤵
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18086.exe
        8⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33663.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13413.exe
        7⤵
        
        PID:16228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57362.exe
        7⤵
        
        PID:11356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33359.exe
        6⤵
        
        PID:8124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22619.exe
        6⤵
        
        PID:11920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26768.exe
        6⤵
        
        PID:16000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
        6⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64288.exe
        6⤵
        
        PID:11680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62949.exe
        5⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7213.exe
        6⤵
        
        PID:8504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2267.exe
        6⤵
        
        PID:14008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5866.exe
        6⤵
        
        PID:9320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11931.exe
        5⤵
        
        PID:9088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9268.exe
        5⤵
        
        PID:12544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62813.exe
        5⤵
        
        PID:8516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33052.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33052.exe
      4⤵
      PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40246.exe
        5⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53254.exe
        6⤵
        
        PID:11116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40029.exe
        6⤵
        
        PID:15908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61237.exe
        5⤵
        
        PID:9092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14446.exe
        5⤵
        
        PID:12560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18701.exe
        5⤵
        
        PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17377.exe
        5⤵
        
        PID:18344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38724.exe
      4⤵
      PID:7076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25909.exe
        5⤵
        
        PID:1536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2689.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:18312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63824.exe
      4⤵
      PID:9376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4542.exe
      4⤵
      PID:14512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49383.exe
      4⤵
      PID:17756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51589.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26140.exe
      4⤵
      PID:6136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44953.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8116.exe
        6⤵
        
        PID:12096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15619.exe
        6⤵
        
        PID:15532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2365.exe
        6⤵
        
        PID:11084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24310.exe
        6⤵
        
        PID:18096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42796.exe
        5⤵
        
        PID:11536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6491.exe
        5⤵
        
        PID:12520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30254.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14427.exe
      4⤵
      PID:8144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4836.exe
      4⤵
      PID:11836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3691.exe
      4⤵
      PID:13368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24687.exe
      4⤵
      PID:17348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60132.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60132.exe
    3⤵
    PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-920.exe
      4⤵
      PID:1464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37849.exe
        5⤵
        
        PID:8812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
        5⤵
        
        PID:12980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24582.exe
        5⤵
        
        PID:6676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58824.exe
      4⤵
      PID:8656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-223.exe
      4⤵
      PID:12376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28842.exe
      4⤵
      PID:6884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58885.exe
    3⤵
    PID:6444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17769.exe
      4⤵
      PID:9948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34639.exe
      4⤵
      PID:880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6946.exe
      4⤵
      PID:3924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29457.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29457.exe
    3⤵
    PID:6892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49078.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49078.exe
    3⤵
    PID:14032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10893.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10893.exe
    3⤵
    PID:5792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52714.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52714.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:18868
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32731.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32731.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34567.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34567.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43582.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38590.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15918.exe
        6⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18430.exe
        7⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16758.exe
        8⤵
        
        PID:14624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13759.exe
        8⤵
        
        PID:11096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21067.exe
        7⤵
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
        7⤵
        
        PID:14184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43752.exe
        7⤵
        
        PID:3028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13468.exe
        6⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52870.exe
        7⤵
        
        PID:11412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21388.exe
        7⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
        7⤵
        
        PID:17708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42413.exe
        6⤵
        
        PID:10832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43852.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20655.exe
        6⤵
        
        PID:17168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43327.exe
        5⤵
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61097.exe
        6⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32985.exe
        7⤵
        
        PID:14084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2602.exe
        7⤵
        
        PID:10964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1956.exe
        6⤵
        
        PID:11568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6491.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46515.exe
        6⤵
        
        PID:16640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47095.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28485.exe
        5⤵
        
        PID:11488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52764.exe
        5⤵
        
        PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8883.exe
        5⤵
        
        PID:18612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58413.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64070.exe
        5⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29281.exe
        6⤵
        
        PID:7208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        6⤵
        
        PID:10592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54135.exe
        6⤵
        
        PID:14724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5866.exe
        6⤵
        
        PID:16872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27308.exe
        5⤵
        
        PID:7316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65022.exe
        6⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43639.exe
        6⤵
        
        PID:18032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20782.exe
        5⤵
        
        PID:12052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21484.exe
        5⤵
        
        PID:15564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35116.exe
        5⤵
        
        PID:4056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7775.exe
        5⤵
        
        PID:18244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-374.exe
      4⤵
      PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe
        5⤵
        
        PID:11216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35988.exe
        5⤵
        
        PID:13516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62467.exe
        5⤵
        
        PID:16916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15300.exe
      4⤵
      PID:9100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11646.exe
      4⤵
      PID:12568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45005.exe
      4⤵
      PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58001.exe
      4⤵
      PID:18824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37452.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37452.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21102.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63385.exe
        5⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20449.exe
        6⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16973.exe
        7⤵
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31468.exe
        6⤵
        
        PID:12228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15619.exe
        6⤵
        
        PID:15460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19085.exe
        6⤵
        
        PID:15372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39194.exe
        6⤵
        
        PID:17980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33359.exe
        5⤵
        
        PID:5072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22619.exe
        5⤵
        
        PID:11472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18780.exe
        5⤵
        
        PID:516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39570.exe
        5⤵
        
        PID:17992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61413.exe
      4⤵
      PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8173.exe
        5⤵
        
        PID:9264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50976.exe
        5⤵
        
        PID:15244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33155.exe
        5⤵
        
        PID:9452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7332.exe
      4⤵
      PID:10192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45575.exe
      4⤵
      PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46010.exe
      4⤵
      PID:11144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28512.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28512.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62918.exe
      4⤵
      PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44953.exe
        5⤵
        
        PID:7760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40517.exe
        6⤵
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35746.exe
        6⤵
        
        PID:8864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50965.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6491.exe
        5⤵
        
        PID:14080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63118.exe
        5⤵
        
        PID:16684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33359.exe
      4⤵
      PID:3972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22619.exe
      4⤵
      PID:11660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36844.exe
      4⤵
      PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64480.exe
      4⤵
      PID:17840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46308.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46308.exe
    3⤵
    PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62937.exe
      4⤵
      PID:9608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2267.exe
      4⤵
      PID:13572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47584.exe
      4⤵
      PID:7688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14412.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14412.exe
    3⤵
    PID:9204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53209.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53209.exe
    3⤵
    PID:12644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24588.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24588.exe
    3⤵
    PID:6572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36402.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36402.exe
    3⤵
    PID:16712
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29080.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29080.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41854.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41854.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59254.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6213.exe
        5⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6312.exe
        6⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38150.exe
        7⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13678.exe
        7⤵
        
        PID:12832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43782.exe
        7⤵
        
        PID:15272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24310.exe
        7⤵
        
        PID:18088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20012.exe
        6⤵
        
        PID:7396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15515.exe
        6⤵
        
        PID:12616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59734.exe
        6⤵
        
        PID:4068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39194.exe
        6⤵
        
        PID:17972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24988.exe
        5⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32694.exe
        6⤵
        
        PID:12172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5674.exe
        6⤵
        
        PID:11620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59303.exe
        5⤵
        
        PID:10020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64127.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5663.exe
        5⤵
        
        PID:16928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61205.exe
      4⤵
      PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39094.exe
        5⤵
        
        PID:6432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28321.exe
        6⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65022.exe
        7⤵
        
        PID:15424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3950.exe
        7⤵
        
        PID:10536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        6⤵
        
        PID:10612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38100.exe
        6⤵
        
        PID:14636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54792.exe
        6⤵
        
        PID:17000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41340.exe
        5⤵
        
        PID:8304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
        5⤵
        
        PID:12092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61733.exe
        5⤵
        
        PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24962.exe
        5⤵
        
        PID:18232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54183.exe
      4⤵
      PID:7032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe
        5⤵
        
        PID:11244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32157.exe
        6⤵
        
        PID:1044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3950.exe
        6⤵
        
        PID:9276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35988.exe
        5⤵
        
        PID:13524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37342.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56978.exe
        5⤵
        
        PID:11932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64976.exe
      4⤵
      PID:10108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47591.exe
      4⤵
      PID:14452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12147.exe
      4⤵
      PID:17180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14884.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47246.exe
      4⤵
      PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18430.exe
        5⤵
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8557.exe
        6⤵
        
        PID:9892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60213.exe
        6⤵
        
        PID:12332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19235.exe
        6⤵
        
        PID:8968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17991.exe
        5⤵
        
        PID:9304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe
        5⤵
        
        PID:13460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-788.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13468.exe
      4⤵
      PID:7560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42382.exe
        5⤵
        
        PID:10508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61448.exe
        5⤵
        
        PID:13700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24004.exe
        5⤵
        
        PID:9052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1563.exe
      4⤵
      PID:12252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61821.exe
      4⤵
      PID:15516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37759.exe
      4⤵
      PID:15912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22246.exe
      4⤵
      PID:18848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64852.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64852.exe
    3⤵
    PID:5676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18430.exe
      4⤵
      PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20670.exe
        5⤵
        
        PID:3608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53192.exe
        5⤵
        
        PID:14248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27494.exe
        5⤵
        
        PID:6652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62484.exe
      4⤵
      PID:10824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40317.exe
      4⤵
      PID:14124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28842.exe
      4⤵
      PID:6808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44589.exe
    3⤵
    PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5101.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5101.exe
      4⤵
      PID:11852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58293.exe
      4⤵
      PID:14228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41109.exe
      4⤵
      PID:9424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56311.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56311.exe
    3⤵
    PID:10100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53544.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53544.exe
    3⤵
    PID:13428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64420.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64420.exe
    3⤵
    PID:17696
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8035.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8035.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59446.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21481.exe
      4⤵
      PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40447.exe
        5⤵
        
        PID:7040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13152.exe
        6⤵
        
        PID:8736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59895.exe
        6⤵
        
        PID:12600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13880.exe
        6⤵
        
        PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57684.exe
        5⤵
        
        PID:9516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33846.exe
        5⤵
        
        PID:14864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46277.exe
        5⤵
        
        PID:8480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31043.exe
      4⤵
      PID:7976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40161.exe
        5⤵
        
        PID:9860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50976.exe
        5⤵
        
        PID:14712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39687.exe
        5⤵
        
        PID:17280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41645.exe
      4⤵
      PID:10968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31158.exe
      4⤵
      PID:12292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53148.exe
      4⤵
      PID:5112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51885.exe
    3⤵
    PID:5352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55513.exe
      4⤵
      PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17577.exe
        5⤵
        
        PID:10132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19372.exe
        5⤵
        
        PID:13632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7631.exe
        5⤵
        
        PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24144.exe
        5⤵
        
        PID:11948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20012.exe
      4⤵
      PID:9196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57701.exe
      4⤵
      PID:13008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4146.exe
      4⤵
      PID:5452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13835.exe
    3⤵
    PID:6732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11069.exe
      4⤵
      PID:12060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1884.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39837.exe
      4⤵
      PID:5636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16442.exe
      4⤵
      PID:17428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40088.exe
    3⤵
    PID:9664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17311.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17311.exe
    3⤵
    PID:14888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63343.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63343.exe
    3⤵
    PID:8356
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25620.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25620.exe
  2⤵
  - Executes dropped EXE
  PID:2988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14573.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14573.exe
    3⤵
    PID:5272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32846.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25909.exe
        5⤵
        
        PID:3912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44983.exe
        5⤵
        
        PID:11632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17991.exe
      4⤵
      PID:9332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16579.exe
      4⤵
      PID:13552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45977.exe
      4⤵
      PID:1368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31046.exe
      4⤵
      PID:18332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45264.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45264.exe
    3⤵
    PID:7580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34245.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34245.exe
    3⤵
    PID:10868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43852.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43852.exe
    3⤵
    PID:14740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21773.exe
    3⤵
    PID:9428
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62198.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62198.exe
  2⤵
  PID:5528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6312.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6312.exe
    3⤵
    PID:6368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48710.exe
      4⤵
      PID:7772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41748.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2365.exe
      4⤵
      PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17377.exe
      4⤵
      PID:18276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20095.exe
    3⤵
    PID:8868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-223.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-223.exe
    3⤵
    PID:12536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3804.exe
    3⤵
    PID:8476
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14539.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14539.exe
  2⤵
  PID:6556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17769.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17769.exe
    3⤵
    PID:10056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34639.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34639.exe
    3⤵
    PID:12072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62613.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62613.exe
    3⤵
    PID:5076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59976.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59976.exe
    3⤵
    PID:18300
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28548.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28548.exe
  2⤵
  PID:9524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23439.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23439.exe
  2⤵
  PID:14040
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31909.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31909.exe
  2⤵
  PID:8844

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3304 -ip 3304
1⤵
PID:5568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 2176 -ip 2176
1⤵
PID:4452

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-15037.exe

Filesize
468KB

MD5
4febf09e90f9daca0ff0dead61de7ba8

SHA1
9f7821ca984eb4a216a34c3fe086948cf33a7a0e

SHA256
b3f06ec1488e4b738f829e894fab998ada1a976173226ef1a8c890b3adf2f64e

SHA512
2c261261659a0c5d17714de3884d0fbfe41c671350de957dbadd007c2205f16258565afbf373f742fbb4c3600f061c8e748fbd5a5acbe1e472f0e0d3a4ff9b10

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18996.exe

Filesize
468KB

MD5
53360ee70d32fe9a5f93d82052353285

SHA1
8c2f27e2ed61a48d3dd9ff913f76aa101924b431

SHA256
d6a5dd587ee6097499ab1b2b39456606c03bc1feddc1fce09217c32d1009b0f3

SHA512
366868bb72050745a973c8ff4811bb567c3cb70a73e4007256d8cfaec91ffcb9a019a615a770d94d8bab24000a467c91cd3e68dfd6b191ef97196c51477444e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe

Filesize
468KB

MD5
9979da1b5d7755f5003abcc6ddb0836e

SHA1
0f411fc60107d01ff1058faca032132143e70fc9

SHA256
91974f1a280af5ce3e107bd4fb190be62e282009d1d9c6876bccb4b28ad93d00

SHA512
11bb53e021d2edd743230f6f2eea25802048c2e587ece85c88014abf87358ae3c5b2bebfb32ffee9631656dd53a5f4dc3854b142b44d20af2cae1b20f4ee629f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19492.exe

Filesize
468KB

MD5
d291ace588d4bc6a2c5f92e2153ad880

SHA1
51f17e5c9a586d04741531f61ebc6c9dda5a31af

SHA256
e05fed276948766d3ce1ae3c7ed4db15859d836c8bba648865db76d64b78f3c3

SHA512
70121b42be3536290e01b5d230bc33a71a175d9f6a78c053b4b1c2719aaa9dfd42ad922adb698a8f92136ca21ecdcbf0e34bf916e344b08812d8c446fada8514

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21988.exe

Filesize
468KB

MD5
0946582c3f3ce046fa8a37e4702f5f8f

SHA1
4ea63db688d225ff25138bdc27abf86b99ea42f3

SHA256
ac257b7e367d735b19d9eeac26a891d2193f20e5636a8d39a53c41ababea958e

SHA512
0a10d7ade46ae060cb843c0161cfccbf0b06ba3880320f21eca13232e4f6be9ab6a948a79a93db40b55a0d34dc9c04c1e9b6e3d65278e2e8b47cb3be68189678

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23214.exe

Filesize
468KB

MD5
930b6763bc948b5d2a6dafeab4429f30

SHA1
a91e0aa583b764293d1ea737d8a72a1f875b8f87

SHA256
28a6a4d5d755d220da60edf8ccb5db4290fb94b241c9e06cf2423b46de883647

SHA512
b4b71a1670ff868a69bef3af56a48c320cbefd03b48cd75e7966a4eef04da44d1e9748ff339d5750790c80b297bffa9a3a4da1e38fd60f7921fb7084112a5873

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24283.exe

Filesize
468KB

MD5
6dea7eb1e7df15b705e694443c9fdf89

SHA1
0292cb091b2d0a7e6aade91c8b5e62b5089fac70

SHA256
33e44ec0f372d68ffd2a9b5fc68ce6b4ce6066bb111e07d27231e6c9f614bebe

SHA512
441d68ca7ad61adf1b4a19480ab016602eb60d773482d90c8aeeb91b399c38a75a2e6596bac4f9e6fb20f51524ddc65ac06cc35b10f4c73fef30fb0ac1fd2545

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-245.exe

Filesize
468KB

MD5
e7105cbde64cddf0891440c8d5d8aa27

SHA1
74163807fde3816a9fae63cc70676a1cb2a74e88

SHA256
c86fec16553e3c7b70fe58da5e069cf12cb11451af7081434716de0fdec400b3

SHA512
1b16fad5a025561ec7013bb5076dc814f17dff37ecfbfb5bea79fefc48955291b5f44b064bfa381f29b67a92241b2ecff1d10b8272d4309edb276a17dff4013d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27246.exe

Filesize
468KB

MD5
5fc1760089b8719f4b2a61764c89b9e5

SHA1
6e2b1a5fcd1e1f7ed4a36de69707ab4e116f4b68

SHA256
55663be3b3a47b0dab6563cf63c10bfa61b44e878c76271bb43a0c00ba60e693

SHA512
9f4e1909fe69f8f2231101ed05c4e5c3f03006cdb5b4684d9c2ba2b12e48cca78ce318afb76e54a5407a96cd7268f0b4817b8198141fcd25a0a57d253dc87c33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2756.exe

Filesize
468KB

MD5
462838d1b385624838b59a5d9dd97acd

SHA1
5ab27e71d83552d40074f9ad8ae07edcc9701729

SHA256
9bf4caa4ff629c92da03cfdec990414e246568cbfc69a58b015278c3d5feff64

SHA512
6e9e0cdf257c8a82dc4f8697646eaef8c5d5d020a08a2e20047a589b2edbc6754cf317093ded4435dc72433876792714f6dea578af39ff834d77d58074bc40a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27710.exe

Filesize
468KB

MD5
fb904321474c2414a0d50ae070b7bc95

SHA1
f7d505aecf916bcc944c27a0b36bba1b4a664e3a

SHA256
67d2793f290ff0000e96da0ec296c3162604b2b56634ccf29ec316237fd438a4

SHA512
dbd5c636bbc29411db3bec6da4303eca082536352555d2cb37f7423c77c5341eddab2637194bc01980ea708052166b419533f0dd89839373b31668c23f0bedae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29080.exe

Filesize
468KB

MD5
182cf79ee0f3a2a604d42af611097331

SHA1
3cb0225a7370fccc4f1bf0d6e85cb896df9a3fda

SHA256
756cdce3a6b0a1213aa07ca36bd9c1fd1dda5ae2f9c42e3dba65f42daf23b415

SHA512
904257ee71f737f6bc02b818231773d887fc4674ba00461b139239459fb663e39556035fa6f1338671d3740cf943a7f1918f41a2400f9b9bd122b153e2c40ade

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29345.exe

Filesize
468KB

MD5
6e22551fae7eea462d560d2a52323384

SHA1
a02c4a4d5011e9e7e22671d6d4ac3183e88c1d93

SHA256
48128db127cb22145baaab3466c03cefdb08b78fa1ef6eecd39edf7a73796c1e

SHA512
a2c777bb49b0c8430ce8cb86a64d641de0e919ae6a006f69844a57d2e8ab9f2326c88fde9ee0830a002fc161d5be361c17c25477b24df0af9cf7a813d1dca2bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32731.exe

Filesize
468KB

MD5
c6c5e19838aba6ce78fec3847cc68dc4

SHA1
6d27af76989698c2ba376287908ba3dac0a58836

SHA256
f4e56e2a2d4d051b9a7beb5f27d25f749fbcd04f86cf41094050e3e659665fff

SHA512
e680c092d61383d94255ba78dbfd9be75c01c4459d797e83670b285f3a602f755c0cbda28e65d81c5cfe3519b2a95d830f0713ee119c678e8af9a52fe64248a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34567.exe

Filesize
468KB

MD5
7efc9cbefbd077e806c503a3ed6252b7

SHA1
2b017d7bdda86a810b5656be7a5dd2b1e4b0c3b4

SHA256
cf1f4775174120530cb4b8b96dfcb1e9c1d6b13467862d97938c2fd7bf28b6fd

SHA512
ac04e64fa0411a4db3f9900dbe9e1e534ee62c64369c546e1c92a70c1049183a6dfc3ec069d7558a09f7f7bc200da3741f27766a75ef2e2c0c64adca3409a98d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3701.exe

Filesize
468KB

MD5
4ce532632194f5392e02a28adeccf662

SHA1
86c493fe6ae065a2b3d57852d4a52078eec021f9

SHA256
3c4e42d75d07c307e7429b8af645a92592f53c4faa7da3d012cbdfeede36b07a

SHA512
b8ed48b23cfbc5d099380c73f81aceb064d8086dc8d1d9ad4a13b16a8200fc8ef6fef46c3f05b12dd749acc8b5571a46b28f5ef7e22e22ba2ebab23a2760ebbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37452.exe

Filesize
468KB

MD5
6b173accf64107520ac21f66a0da2c4d

SHA1
4f9b8c5cc4b24246553caba6ad16405baa901875

SHA256
c74b519caf4009f9c2e82e3ff96e01892421a3c6d37c4e273d846f9b1f996d50

SHA512
c3197c5cd73227506a0151ca180a0433a4ad71aeb743075b465b41fe804cddb40644aa9cf1b2d36ba4b4faea3af252207731e988f5e68091e7b9aec4ea96c11c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41397.exe

Filesize
468KB

MD5
873fe4c5f1eb690ce3ce7344e2e8968d

SHA1
179626f8febb0c2e9b644f45ec873fc4ba5188ce

SHA256
e28c6d6f71eca399b02116f40e0b82688d10c4568bfdd7a74e1f22a1ebeb4bf7

SHA512
33fb2418b2a903ea9581880cbfa6dfa9ab5199c979cb12c188a3750a7f62ffe0b39726543bf6a0822f6965e0882c475a44174849ffbcee0e7d676f7ef0bd7a52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41854.exe

Filesize
468KB

MD5
29ceb4d8f65e9712a3ba50c20ae1d6da

SHA1
6f75778ba01ffce88229fcd63993d13563c54bee

SHA256
b220d1573565acfbd8b8e69fbbbcbfaf4d3db94858375beb594d97b7a83c3cc4

SHA512
d048300879bc8d29f6ebcc87e95d9f660fadfcdceab2875578ffe4e014a98cf271b1b644d4007ff5eb1cbda11a33d0266b78a10db4616c80562f17bf43e8a725

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43582.exe

Filesize
468KB

MD5
15ca021fd2a4eb1caa5cad8142a298ab

SHA1
0acafa323959424871093e1d0ea34fc462b20e61

SHA256
9a83dcfd431662b2fd42c06d1185d4e59ba34ff68f1647a87ce61d1fad2918e4

SHA512
dc7a9d77d312503db8588fd257984c8440bfe0e5df80c2069ba71be248589a520464f70489d0af0c37738b8db68329d5a3ca73c4b2e9ddbe9bb72aa443712c5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43989.exe

Filesize
468KB

MD5
ed948812e08ec9124e4a1d3182b08bec

SHA1
7ad19fe6426987807e73c75d53603957913baf90

SHA256
42a96c5965523c913d37e36601fc1ab8874ac140f6b6f087a4af183788a461d5

SHA512
19479c57c47acd59e8375e4618bfc29fc6f06ca90a841127c9519312b90c1c5421118ec7222ab21259fb5dc11be403d0cb59c3726e86bfb11445c1a1909498d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49948.exe

Filesize
468KB

MD5
008f02d329f16103991ceb8ed2b97ef7

SHA1
ff103bcb7b48cbdfed307d1b48d601adad54cca1

SHA256
d2a8b526fecc1c408ff9af172b5fb6c6443e87b0dfeef6c5fa6f39a7e9c69339

SHA512
251f1c32280b7f18526380f90697d9800ff3033f76c4332ada08af869c54704c127ce97e75108ee2ab4157920e63c954914dcb3e0e3f646ece5dacc22dabc7dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54625.exe

Filesize
468KB

MD5
3b7264cc6512324ca215899c65d201e3

SHA1
240fdd6154f2b9ed78a60cff6c122722aedc821e

SHA256
34c21d01327c6d5003d881d32b74b432522686c1e7d45b32d597d901509a210c

SHA512
e75d2f771deea8f50db142a93d76d17bcb270268c09cf3a63a13010c95ce6ebe4f2b78e6df54ff5f16b149219e482f66b782aa8fb7fdd47a674d10430455e941

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57429.exe

Filesize
468KB

MD5
c438d1541cd33c9c7676600aa77d8deb

SHA1
8de5affa8f65ea968711aa86af03461f21a8addf

SHA256
b90b3910a67fb745f83586294f19ac8b3077bf43fb556b0164356a41c21929da

SHA512
3ec5d9c5c54314e17e30df90283c090afd46bb9217501642684693598c680e6a7fa696b557f309eb88c8a24bb7f1d98655484e6deebd10485cc22261d589fbc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58776.exe

Filesize
468KB

MD5
6a31f6ee1b89b799bcaa92ae586ef855

SHA1
f259b3aad14fbfd4caf375b193c2a35b0f38362c

SHA256
b14e894fa18ee494f3a4e3bf8c37ed53f1d75e585daad80b45beebd15f7e6ddd

SHA512
58e05b72fdd31221e25bc64bb08192e790188b34f6dd039f313bf3e3389471cbffeabee27312473c2923ff6707ee5dbffd0de56f157020a737ac67c4a0636f95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5997.exe

Filesize
468KB

MD5
90dd24e3986d14066f2364259535c70d

SHA1
77abd32800a05bc8039401707d7f55174e06da11

SHA256
2b4b8a2bb7b1be614b35484307772c88c6f6fbc3c3ff78c403bd1699b875af2d

SHA512
cdd79bfca1946d02e2c9e2e05df24e2fda18a938476638ec623185d313c252e9cfaad0daf32f5f259768183a68755c86be6f96720c93d1f294fe84478a19ad60

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60086.exe

Filesize
468KB

MD5
cb7b4d90a485a97ce3be0f9c0ad623ed

SHA1
9b4f2f0bc70771ff157a770234f2d585168927e2

SHA256
b81af61c537cb9d26b14a0e9317ec435525fbf79bd493bc5fc253ed6e10c139f

SHA512
575eae07822039fa0483d08a57c0a6bfb75213c0f9b757932c0c2b311eb84c4005c539394bce991325aae24b5b5f937d6ad968b47746f8c355b7b720723e6a21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-629.exe

Filesize
468KB

MD5
972f4c5f6defd3cb40fa1117dbe7cd4e

SHA1
8f9e4f63ae41837479408e0b0978060bfe7b4e5b

SHA256
97ac07e994f90c854ea1f195f2c1d2b47252e4c23346130c337001a6fb97a2ab

SHA512
b05d28f0939d8d17c40fcc72b88e675cced361779fc75e64fb76d6966e82bd6dca6bbfc9be269bae0ea90c29c27d22a548389f2bcd9cf6fc4c509cf5d0379554

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7380.exe

Filesize
468KB

MD5
c68078338d3b90b48b32ae9239288133

SHA1
8230c2521a2775b2a5f4ae9a00036a01b669fc2c

SHA256
aa30cad829e35e399464a47d24afa7fe279830043eb70a17eb711d3c8274c42a

SHA512
ec51ea09fbae441f156150f37ed888978ba45e662cb7b256a1f9c129d68b3da66d1a33517ce93632caddef48ac9e62234b8d71fcbc1b679dab49f03f947f1d11

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8035.exe

Filesize
468KB

MD5
c91cd4bbe2fe544a017cf03923c51990

SHA1
aa2ca247047346388acfc21015943a090869b314

SHA256
a4f60c7a46322a29a38fcdc5f3072edfc8b64b18ca52976bdf101b006a1c3183

SHA512
0cd87c7d6b7f946f9bdf13a75964f73860bb66d821294872f3608330c4c99642f0d7a9785037c498e19a5bab2f0acc5d337d327f1400ea5611dfaa297e1b5605

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-821.exe

Filesize
468KB

MD5
23a0660ef823711efa2d4119e1ab702b

SHA1
f4d841028c34583ad1c186aa454e61064cbe9a67

SHA256
673cfacba79607b30b3d46b4a290822f9b966aade366bbc52b16bed943c92881

SHA512
644ab754f491a2056c04cbe4898e04b8e16134241702bb0025ebdf992973b527be2746cc23928d7b4849d5c668775f3228d2e38b3db9d7e77c74605185c91e76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9479.exe

Filesize
468KB

MD5
5ed8f0664ca160ee167fed3f776743f6

SHA1
0d60314b9bc68074c5091283f4c4c35c74a3e94d

SHA256
05c4add443f518a08b496c68c84d4355ec5fd715aa72aad943778e0d45618a46

SHA512
01d4fbfe0608ab59a32decc10cc6fa064fc08e2b37a240591d31c3b338fca605743ae23cc63ffc368bc6ce07e9d7e1e3181737dc225ffe482f39866c9b61d752

Download Submit
memory/116-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/408-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/720-461-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/836-456-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/860-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/984-340-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1120-310-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1144-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1156-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1280-39-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1352-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1492-199-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1660-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1804-79-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1992-141-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1996-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2092-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2176-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2232-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2268-308-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2304-169-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2360-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2484-203-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2528-460-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2572-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2596-78-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2608-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2656-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2740-274-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2764-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2960-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2968-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2988-309-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2992-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3012-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3124-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3188-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3248-457-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3268-164-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3304-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3436-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3460-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3468-134-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3484-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3496-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3504-57-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3516-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3560-81-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3592-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3636-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3748-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3756-109-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3800-102-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3944-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4004-173-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4008-251-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4072-50-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4084-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4108-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4116-455-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4136-121-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4168-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4188-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4204-281-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4248-219-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4252-29-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4376-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4404-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4468-484-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4492-146-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4592-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4712-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4752-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4756-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4792-77-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4872-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4880-115-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4936-428-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4948-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5016-453-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5032-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5036-258-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5060-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5136-463-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5196-500-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5272-531-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5312-534-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5352-538-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5368-540-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5376-544-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5384-543-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5404-545-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5420-546-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5428-547-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5464-548-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5480-549-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13552-2599-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15544-2597-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15668-2560-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16000-2612-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads