4f14edbd5ff999a882faec05c8da31e4521d5351453fd89e3d6525afa7ff270c

Analysis

max time kernel
120s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 16:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

908921e6d94e264fd15836f2c6461d10N.exe
Size

468KB
MD5

908921e6d94e264fd15836f2c6461d10
SHA1

eaf8368f14cb64336533ca1f8688dd793009283c
SHA256

4f14edbd5ff999a882faec05c8da31e4521d5351453fd89e3d6525afa7ff270c
SHA512

e80e122bc0dc0c283a778bdbc027c31cfb132902637707642607b4e981ee40eba100ddd43b96989eeee57d379969835eb7d73ca7915a6d69cc85323d46ef883b
SSDEEP

3072:WudSogdEI65AHbYbzujcff8wAaJBHpnLfEHCgdSN1ZgLfD4DPnf/:WuUoE+AHwzgcffnBjJ1ZKb4DP

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2980	Unicorn-6049.exe
1520	Unicorn-37134.exe
1672	Unicorn-25628.exe
4252	Unicorn-56926.exe
1256	Unicorn-56926.exe
3076	Unicorn-5679.exe
448	Unicorn-57481.exe
3612	Unicorn-54726.exe
2872	Unicorn-43028.exe
3268	Unicorn-17970.exe
2140	Unicorn-14440.exe
4952	Unicorn-34306.exe
4764	Unicorn-29957.exe
984	Unicorn-32451.exe
4984	Unicorn-16744.exe
4540	Unicorn-53138.exe
3244	Unicorn-29188.exe
1856	Unicorn-8789.exe
3096	Unicorn-25126.exe
4464	Unicorn-39608.exe
4896	Unicorn-32723.exe
2168	Unicorn-2851.exe
1704	Unicorn-8716.exe
4400	Unicorn-5452.exe
2636	Unicorn-8981.exe
3468	Unicorn-8981.exe
428	Unicorn-8981.exe
3140	Unicorn-8981.exe
2808	Unicorn-27682.exe
4040	Unicorn-29911.exe
3856	Unicorn-52378.exe
1872	Unicorn-52378.exe
2940	Unicorn-62776.exe
212	Unicorn-49041.exe
4992	Unicorn-54224.exe
400	Unicorn-3945.exe
3744	Unicorn-24558.exe
4456	Unicorn-21220.exe
2180	Unicorn-57401.exe
3484	Unicorn-60930.exe
4024	Unicorn-19824.exe
4608	Unicorn-38656.exe
1528	Unicorn-44786.exe
216	Unicorn-629.exe
3584	Unicorn-21050.exe
4912	Unicorn-54469.exe
3756	Unicorn-49830.exe
2116	Unicorn-42216.exe
4496	Unicorn-29218.exe
3704	Unicorn-41662.exe
3448	Unicorn-49060.exe
4972	Unicorn-41397.exe
5020	Unicorn-49830.exe
3452	Unicorn-29964.exe
4396	Unicorn-59.exe
4516	Unicorn-46493.exe
5076	Unicorn-9757.exe
1556	Unicorn-46685.exe
4788	Unicorn-62658.exe
4136	Unicorn-54490.exe
3108	Unicorn-62658.exe
2280	Unicorn-2165.exe
3708	Unicorn-2165.exe
3540	Unicorn-16455.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5932	4496	WerFault.exe	140

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55847.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43368.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52057.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15899.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25304.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52057.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8981.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39177.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49945.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62134.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21274.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7055.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63140.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41133.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29964.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42306.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30607.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52057.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1975.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56966.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50271.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46560.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38236.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7272.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36899.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63716.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23874.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-579.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-483.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30903.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22615.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49737.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55741.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-695.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61958.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21323.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20608.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	7808	dwm.exe
Token: SeChangeNotifyPrivilege	7808	dwm.exe
Token: 33	7808	dwm.exe
Token: SeIncBasePriorityPrivilege	7808	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
784	908921e6d94e264fd15836f2c6461d10N.exe
2980	Unicorn-6049.exe
1672	Unicorn-25628.exe
1520	Unicorn-37134.exe
4252	Unicorn-56926.exe
3076	Unicorn-5679.exe
1256	Unicorn-56926.exe
448	Unicorn-57481.exe
3612	Unicorn-54726.exe
2872	Unicorn-43028.exe
4764	Unicorn-29957.exe
4952	Unicorn-34306.exe
984	Unicorn-32451.exe
3268	Unicorn-17970.exe
2140	Unicorn-14440.exe
4984	Unicorn-16744.exe
4540	Unicorn-53138.exe
3244	Unicorn-29188.exe
1856	Unicorn-8789.exe
4464	Unicorn-39608.exe
3096	Unicorn-25126.exe
2636	Unicorn-8981.exe
3468	Unicorn-8981.exe
4896	Unicorn-32723.exe
2168	Unicorn-2851.exe
4400	Unicorn-5452.exe
1704	Unicorn-8716.exe
428	Unicorn-8981.exe
3140	Unicorn-8981.exe
2808	Unicorn-27682.exe
4040	Unicorn-29911.exe
3856	Unicorn-52378.exe
2940	Unicorn-62776.exe
212	Unicorn-49041.exe
1872	Unicorn-52378.exe
400	Unicorn-3945.exe
4992	Unicorn-54224.exe
3744	Unicorn-24558.exe
4456	Unicorn-21220.exe
2180	Unicorn-57401.exe
3484	Unicorn-60930.exe
4024	Unicorn-19824.exe
4608	Unicorn-38656.exe
216	Unicorn-629.exe
1528	Unicorn-44786.exe
3584	Unicorn-21050.exe
2116	Unicorn-42216.exe
4912	Unicorn-54469.exe
3756	Unicorn-49830.exe
4972	Unicorn-41397.exe
3704	Unicorn-41662.exe
4396	Unicorn-59.exe
3452	Unicorn-29964.exe
3448	Unicorn-49060.exe
4496	Unicorn-29218.exe
5020	Unicorn-49830.exe
4516	Unicorn-46493.exe
5076	Unicorn-9757.exe
1556	Unicorn-46685.exe
4788	Unicorn-62658.exe
3540	Unicorn-16455.exe
2280	Unicorn-2165.exe
4136	Unicorn-54490.exe
3108	Unicorn-62658.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 784 wrote to memory of 2980	784	908921e6d94e264fd15836f2c6461d10N.exe	87
PID 784 wrote to memory of 2980	784	908921e6d94e264fd15836f2c6461d10N.exe	87
PID 784 wrote to memory of 2980	784	908921e6d94e264fd15836f2c6461d10N.exe	87
PID 2980 wrote to memory of 1520	2980	Unicorn-6049.exe	88
PID 2980 wrote to memory of 1520	2980	Unicorn-6049.exe	88
PID 2980 wrote to memory of 1520	2980	Unicorn-6049.exe	88
PID 784 wrote to memory of 1672	784	908921e6d94e264fd15836f2c6461d10N.exe	89
PID 784 wrote to memory of 1672	784	908921e6d94e264fd15836f2c6461d10N.exe	89
PID 784 wrote to memory of 1672	784	908921e6d94e264fd15836f2c6461d10N.exe	89
PID 1520 wrote to memory of 1256	1520	Unicorn-37134.exe	94
PID 1672 wrote to memory of 4252	1672	Unicorn-25628.exe	95
PID 1520 wrote to memory of 1256	1520	Unicorn-37134.exe	94
PID 1520 wrote to memory of 1256	1520	Unicorn-37134.exe	94
PID 1672 wrote to memory of 4252	1672	Unicorn-25628.exe	95
PID 1672 wrote to memory of 4252	1672	Unicorn-25628.exe	95
PID 784 wrote to memory of 3076	784	908921e6d94e264fd15836f2c6461d10N.exe	96
PID 784 wrote to memory of 3076	784	908921e6d94e264fd15836f2c6461d10N.exe	96
PID 784 wrote to memory of 3076	784	908921e6d94e264fd15836f2c6461d10N.exe	96
PID 2980 wrote to memory of 448	2980	Unicorn-6049.exe	97
PID 2980 wrote to memory of 448	2980	Unicorn-6049.exe	97
PID 2980 wrote to memory of 448	2980	Unicorn-6049.exe	97
PID 4252 wrote to memory of 3612	4252	Unicorn-56926.exe	99
PID 4252 wrote to memory of 3612	4252	Unicorn-56926.exe	99
PID 4252 wrote to memory of 3612	4252	Unicorn-56926.exe	99
PID 1672 wrote to memory of 2872	1672	Unicorn-25628.exe	100
PID 1672 wrote to memory of 2872	1672	Unicorn-25628.exe	100
PID 1672 wrote to memory of 2872	1672	Unicorn-25628.exe	100
PID 1256 wrote to memory of 3268	1256	Unicorn-56926.exe	101
PID 1256 wrote to memory of 3268	1256	Unicorn-56926.exe	101
PID 1256 wrote to memory of 3268	1256	Unicorn-56926.exe	101
PID 1520 wrote to memory of 2140	1520	Unicorn-37134.exe	102
PID 1520 wrote to memory of 2140	1520	Unicorn-37134.exe	102
PID 1520 wrote to memory of 2140	1520	Unicorn-37134.exe	102
PID 3076 wrote to memory of 4952	3076	Unicorn-5679.exe	103
PID 3076 wrote to memory of 4952	3076	Unicorn-5679.exe	103
PID 3076 wrote to memory of 4952	3076	Unicorn-5679.exe	103
PID 784 wrote to memory of 4764	784	908921e6d94e264fd15836f2c6461d10N.exe	104
PID 784 wrote to memory of 4764	784	908921e6d94e264fd15836f2c6461d10N.exe	104
PID 784 wrote to memory of 4764	784	908921e6d94e264fd15836f2c6461d10N.exe	104
PID 2980 wrote to memory of 984	2980	Unicorn-6049.exe	105
PID 2980 wrote to memory of 984	2980	Unicorn-6049.exe	105
PID 2980 wrote to memory of 984	2980	Unicorn-6049.exe	105
PID 448 wrote to memory of 4984	448	Unicorn-57481.exe	108
PID 448 wrote to memory of 4984	448	Unicorn-57481.exe	108
PID 448 wrote to memory of 4984	448	Unicorn-57481.exe	108
PID 3612 wrote to memory of 4540	3612	Unicorn-54726.exe	109
PID 3612 wrote to memory of 4540	3612	Unicorn-54726.exe	109
PID 3612 wrote to memory of 4540	3612	Unicorn-54726.exe	109
PID 4252 wrote to memory of 3244	4252	Unicorn-56926.exe	110
PID 4252 wrote to memory of 3244	4252	Unicorn-56926.exe	110
PID 4252 wrote to memory of 3244	4252	Unicorn-56926.exe	110
PID 2872 wrote to memory of 1856	2872	Unicorn-43028.exe	111
PID 2872 wrote to memory of 1856	2872	Unicorn-43028.exe	111
PID 2872 wrote to memory of 1856	2872	Unicorn-43028.exe	111
PID 4764 wrote to memory of 3096	4764	Unicorn-29957.exe	112
PID 4764 wrote to memory of 3096	4764	Unicorn-29957.exe	112
PID 4764 wrote to memory of 3096	4764	Unicorn-29957.exe	112
PID 1672 wrote to memory of 4464	1672	Unicorn-25628.exe	113
PID 1672 wrote to memory of 4464	1672	Unicorn-25628.exe	113
PID 1672 wrote to memory of 4464	1672	Unicorn-25628.exe	113
PID 784 wrote to memory of 4896	784	908921e6d94e264fd15836f2c6461d10N.exe	114
PID 784 wrote to memory of 4896	784	908921e6d94e264fd15836f2c6461d10N.exe	114
PID 784 wrote to memory of 4896	784	908921e6d94e264fd15836f2c6461d10N.exe	114
PID 1520 wrote to memory of 2168	1520	Unicorn-37134.exe	115

C:\Users\Admin\AppData\Local\Temp\908921e6d94e264fd15836f2c6461d10N.exe
"C:\Users\Admin\AppData\Local\Temp\908921e6d94e264fd15836f2c6461d10N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:784
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6049.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6049.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37134.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37134.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56926.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17970.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44786.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44926.exe
        8⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27070.exe
        9⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9981.exe
        10⤵
        
        PID:12360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46719.exe
        10⤵
        
        PID:17500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34499.exe
        9⤵
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32239.exe
        9⤵
        
        PID:14692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28091.exe
        9⤵
        
        PID:17180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44553.exe
        9⤵
        
        PID:19360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5040.exe
        8⤵
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25949.exe
        8⤵
        
        PID:11460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48384.exe
        8⤵
        
        PID:16048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20715.exe
        8⤵
        
        PID:18460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57349.exe
        7⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
        8⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34138.exe
        9⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25720.exe
        9⤵
        
        PID:12368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1163.exe
        9⤵
        
        PID:16656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61520.exe
        9⤵
        
        PID:17860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57225.exe
        8⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56752.exe
        8⤵
        
        PID:12780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51673.exe
        8⤵
        
        PID:16848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58911.exe
        8⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51832.exe
        7⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3012.exe
        8⤵
        
        PID:17308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29667.exe
        8⤵
        
        PID:17944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3052.exe
        7⤵
        
        PID:11804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22245.exe
        7⤵
        
        PID:14696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13982.exe
        7⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54469.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48818.exe
        7⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
        8⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32462.exe
        9⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
        9⤵
        
        PID:15576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11270.exe
        9⤵
        
        PID:18216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14220.exe
        8⤵
        
        PID:9640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43872.exe
        8⤵
        
        PID:14184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12651.exe
        8⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        7⤵
        
        PID:3220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17779.exe
        7⤵
        
        PID:10504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39177.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6010.exe
        7⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51048.exe
        6⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe
        7⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42306.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5003.exe
        8⤵
        
        PID:13540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35551.exe
        8⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57225.exe
        7⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7167.exe
        7⤵
        
        PID:12312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64589.exe
        7⤵
        
        PID:16960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28350.exe
        7⤵
        
        PID:17800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61781.exe
        6⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25887.exe
        6⤵
        
        PID:10244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25304.exe
        6⤵
        
        PID:14596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26234.exe
        6⤵
        
        PID:1212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5452.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43368.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35518.exe
        7⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47874.exe
        8⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32462.exe
        9⤵
        
        PID:9484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
        9⤵
        
        PID:15140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55847.exe
        9⤵
        
        PID:18080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52477.exe
        8⤵
        
        PID:9420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44640.exe
        8⤵
        
        PID:14636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64968.exe
        8⤵
        
        PID:17204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44023.exe
        8⤵
        
        PID:19328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10660.exe
        7⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4515.exe
        7⤵
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45565.exe
        7⤵
        
        PID:14464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18447.exe
        7⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31691.exe
        6⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39566.exe
        7⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5492.exe
        7⤵
        
        PID:13292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10099.exe
        7⤵
        
        PID:16860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20679.exe
        7⤵
        
        PID:18416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20416.exe
        6⤵
        
        PID:9468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2011.exe
        6⤵
        
        PID:13368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36228.exe
        6⤵
        
        PID:17312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8408.exe
        6⤵
        
        PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38656.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52326.exe
        6⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12741.exe
        7⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13141.exe
        8⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8703.exe
        8⤵
        
        PID:13768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59191.exe
        8⤵
        
        PID:17120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21236.exe
        7⤵
        
        PID:9544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56269.exe
        8⤵
        
        PID:19196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4811.exe
        7⤵
        
        PID:13332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20122.exe
        7⤵
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27487.exe
        7⤵
        
        PID:18544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        6⤵
        
        PID:7344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-483.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49929.exe
        6⤵
        
        PID:13532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8262.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52637.exe
        5⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60126.exe
        6⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32462.exe
        7⤵
        
        PID:10280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47295.exe
        7⤵
        
        PID:17872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52477.exe
        6⤵
        
        PID:9220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44640.exe
        6⤵
        
        PID:14628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34982.exe
        6⤵
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61668.exe
        5⤵
        
        PID:7660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15428.exe
        6⤵
        
        PID:19364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28376.exe
        5⤵
        
        PID:9872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42910.exe
        5⤵
        
        PID:15096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18258.exe
        5⤵
        
        PID:6672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14440.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21050.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39690.exe
        7⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20910.exe
        8⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40806.exe
        9⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
        9⤵
        
        PID:12236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-203.exe
        9⤵
        
        PID:15512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31012.exe
        9⤵
        
        PID:16676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19124.exe
        8⤵
        
        PID:8948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30903.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7604.exe
        8⤵
        
        PID:16808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52855.exe
        8⤵
        
        PID:17836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56597.exe
        7⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48082.exe
        8⤵
        
        PID:14168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41867.exe
        8⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-675.exe
        7⤵
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
        7⤵
        
        PID:15912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51416.exe
        7⤵
        
        PID:19336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28952.exe
        6⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37904.exe
        7⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60334.exe
        8⤵
        
        PID:14216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55757.exe
        8⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46823.exe
        8⤵
        
        PID:19300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46560.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28155.exe
        7⤵
        
        PID:15196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50157.exe
        7⤵
        
        PID:17256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53577.exe
        7⤵
        
        PID:18088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6331.exe
        6⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9981.exe
        7⤵
        
        PID:12676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52685.exe
        7⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41867.exe
        7⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34387.exe
        6⤵
        
        PID:12068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12196.exe
        6⤵
        
        PID:16344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53525.exe
        6⤵
        
        PID:8032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42216.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65154.exe
        6⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
        7⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3489.exe
        8⤵
        
        PID:11008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52441.exe
        8⤵
        
        PID:13928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43403.exe
        8⤵
        
        PID:17932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34499.exe
        7⤵
        
        PID:11164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
        7⤵
        
        PID:14440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42575.exe
        7⤵
        
        PID:17280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12876.exe
        6⤵
        
        PID:8544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8067.exe
        6⤵
        
        PID:12532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47364.exe
        6⤵
        
        PID:16528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62653.exe
        6⤵
        
        PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51048.exe
        5⤵
        
        PID:5476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36862.exe
        6⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60858.exe
        7⤵
        
        PID:11232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14916.exe
        7⤵
        
        PID:14672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31534.exe
        7⤵
        
        PID:17620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12300.exe
        6⤵
        
        PID:8852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23503.exe
        6⤵
        
        PID:12508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64589.exe
        6⤵
        
        PID:16952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28350.exe
        6⤵
        
        PID:18276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60245.exe
        5⤵
        
        PID:3320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32270.exe
        6⤵
        
        PID:11204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14916.exe
        6⤵
        
        PID:14516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55847.exe
        6⤵
        
        PID:18240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25155.exe
        5⤵
        
        PID:9660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24536.exe
        5⤵
        
        PID:14152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41273.exe
        5⤵
        
        PID:708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2851.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29218.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4496
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4496 -s 632
        6⤵
        Program crash
        
        PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4064.exe
        5⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
        6⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17330.exe
        7⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14047.exe
        7⤵
        
        PID:1188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34499.exe
        6⤵
        
        PID:11296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3188.exe
        6⤵
        
        PID:15484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47235.exe
        6⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18775.exe
        5⤵
        
        PID:8164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23645.exe
        5⤵
        
        PID:10512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45732.exe
        5⤵
        
        PID:15080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31327.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41397.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52902.exe
        5⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
        6⤵
        
        PID:220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8865.exe
        7⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1024.exe
        7⤵
        
        PID:11968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58340.exe
        7⤵
        
        PID:16432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21795.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21236.exe
        6⤵
        
        PID:9516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62180.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe
        6⤵
        
        PID:17272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61163.exe
        6⤵
        
        PID:16728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21079.exe
        5⤵
        
        PID:8704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10380.exe
        5⤵
        
        PID:9792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15903.exe
        5⤵
        
        PID:15476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30699.exe
        5⤵
        
        PID:6072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48248.exe
      4⤵
      PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42290.exe
        5⤵
        
        PID:6100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3681.exe
        6⤵
        
        PID:11224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14916.exe
        6⤵
        
        PID:14504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23366.exe
        6⤵
        
        PID:17416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
        5⤵
        
        PID:10092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9855.exe
        5⤵
        
        PID:14280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
        5⤵
        
        PID:6368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6840.exe
      4⤵
      PID:7796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39822.exe
      4⤵
      PID:10328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29199.exe
      4⤵
      PID:14800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43187.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57481.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57481.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16744.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27682.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9757.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36182.exe
        7⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20910.exe
        8⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64418.exe
        9⤵
        
        PID:13344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29415.exe
        9⤵
        
        PID:16596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14238.exe
        9⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
        8⤵
        
        PID:10128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63716.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40656.exe
        8⤵
        
        PID:17272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42295.exe
        8⤵
        
        PID:18756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56597.exe
        7⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-675.exe
        7⤵
        
        PID:10036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50505.exe
        7⤵
        
        PID:14684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27487.exe
        7⤵
        
        PID:8680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57349.exe
        6⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
        7⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32462.exe
        8⤵
        
        PID:10436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
        8⤵
        
        PID:15588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44711.exe
        8⤵
        
        PID:17588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34499.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10588.exe
        7⤵
        
        PID:14576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14178.exe
        7⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6331.exe
        6⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56966.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14916.exe
        7⤵
        
        PID:14480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52688.exe
        7⤵
        
        PID:19352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36473.exe
        6⤵
        
        PID:10712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50932.exe
        6⤵
        
        PID:15292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50928.exe
        6⤵
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46685.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8517.exe
        6⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
        7⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-697.exe
        8⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1024.exe
        8⤵
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58340.exe
        8⤵
        
        PID:16240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-67.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-67.exe
        8⤵
        
        PID:17764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15616.exe
        7⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35948.exe
        7⤵
        
        PID:12952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59344.exe
        7⤵
        
        PID:16584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21763.exe
        7⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5040.exe
        6⤵
        
        PID:6872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43053.exe
        6⤵
        
        PID:12008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53236.exe
        6⤵
        
        PID:16212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4656.exe
        6⤵
        
        PID:3760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44553.exe
        6⤵
        
        PID:19416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22615.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55658.exe
        6⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43614.exe
        7⤵
        
        PID:13392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18092.exe
        7⤵
        
        PID:17352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39179.exe
        7⤵
        
        PID:2396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26139.exe
        6⤵
        
        PID:11132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6504.exe
        6⤵
        
        PID:14792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59871.exe
        6⤵
        
        PID:6708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57697.exe
        5⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32462.exe
        6⤵
        
        PID:9272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
        6⤵
        
        PID:15060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55847.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25887.exe
        5⤵
        
        PID:9912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25304.exe
        5⤵
        
        PID:14604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18066.exe
        5⤵
        
        PID:6756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29911.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54490.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28746.exe
        6⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5917.exe
        7⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19634.exe
        8⤵
        
        PID:10380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51709.exe
        8⤵
        
        PID:14828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16298.exe
        8⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
        7⤵
        
        PID:10060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9855.exe
        7⤵
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61268.exe
        7⤵
        
        PID:17068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57515.exe
        7⤵
        
        PID:17596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41028.exe
        6⤵
        
        PID:7764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37048.exe
        6⤵
        
        PID:10264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17015.exe
        6⤵
        
        PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51065.exe
        5⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43022.exe
        6⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39286.exe
        7⤵
        
        PID:10116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30136.exe
        7⤵
        
        PID:14112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4918.exe
        7⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10136.exe
        6⤵
        
        PID:9476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39530.exe
        7⤵
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45567.exe
        7⤵
        
        PID:17072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59248.exe
        6⤵
        
        PID:13840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55796.exe
        6⤵
        
        PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6331.exe
        5⤵
        
        PID:8116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36473.exe
        5⤵
        
        PID:10704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50932.exe
        5⤵
        
        PID:15260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55012.exe
        5⤵
        
        PID:5464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26405.exe
      4⤵
      PID:1236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8325.exe
        5⤵
        
        PID:2340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25460.exe
        6⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63285.exe
        7⤵
        
        PID:18684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59597.exe
        6⤵
        
        PID:15300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1926.exe
        6⤵
        
        PID:10024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40532.exe
        5⤵
        
        PID:9740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30592.exe
        5⤵
        
        PID:13468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41810.exe
        5⤵
        
        PID:17380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39962.exe
        5⤵
        
        PID:1392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17687.exe
        5⤵
        
        PID:8440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37495.exe
      4⤵
      PID:5448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
        5⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53982.exe
        6⤵
        
        PID:8476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1024.exe
        6⤵
        
        PID:9844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1163.exe
        6⤵
        
        PID:16512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20679.exe
        6⤵
        
        PID:7596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45933.exe
        5⤵
        
        PID:9708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17256.exe
        5⤵
        
        PID:14228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50271.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:18612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52533.exe
      4⤵
      PID:5212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44489.exe
        5⤵
        
        PID:8020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27954.exe
      4⤵
      PID:11060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42375.exe
      4⤵
      PID:12948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58039.exe
      4⤵
      PID:5352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-629.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22476.exe
        6⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51190.exe
        7⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43806.exe
        8⤵
        
        PID:13640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22368.exe
        8⤵
        
        PID:4676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20050.exe
        8⤵
        
        PID:14696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38584.exe
        7⤵
        
        PID:11108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6504.exe
        7⤵
        
        PID:14712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51127.exe
        7⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6331.exe
        6⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32462.exe
        7⤵
        
        PID:10444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
        7⤵
        
        PID:15228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35235.exe
        7⤵
        
        PID:18220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34387.exe
        6⤵
        
        PID:12060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12196.exe
        6⤵
        
        PID:16352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47765.exe
        6⤵
        
        PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36160.exe
        5⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41522.exe
        6⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54174.exe
        7⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21252.exe
        7⤵
        
        PID:12864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1739.exe
        7⤵
        
        PID:16764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8427.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58185.exe
        6⤵
        
        PID:9676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49928.exe
        6⤵
        
        PID:13508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49945.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39503.exe
        6⤵
        
        PID:1152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17239.exe
        5⤵
        
        PID:7360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32462.exe
        6⤵
        
        PID:10412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11270.exe
        6⤵
        
        PID:17972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        5⤵
        
        PID:1224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16375.exe
        5⤵
        
        PID:14520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12160.exe
        5⤵
        
        PID:7696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29964.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29964.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        5⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53842.exe
        7⤵
        
        PID:9788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
        7⤵
        
        PID:15044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23522.exe
        7⤵
        
        PID:18136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34499.exe
        6⤵
        
        PID:11124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3188.exe
        6⤵
        
        PID:15492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
        6⤵
        
        PID:1972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5040.exe
        5⤵
        
        PID:516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe
        5⤵
        
        PID:10720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59597.exe
        5⤵
        
        PID:15252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50935.exe
        5⤵
        
        PID:17292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5547.exe
      4⤵
      PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49882.exe
        5⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44138.exe
        6⤵
        
        PID:10404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10676.exe
        6⤵
        
        PID:14864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25722.exe
        6⤵
        
        PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
        5⤵
        
        PID:10080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9855.exe
        5⤵
        
        PID:14060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22730.exe
        5⤵
        
        PID:1128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64137.exe
      4⤵
      PID:7548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63412.exe
      4⤵
      PID:8068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65377.exe
      4⤵
      PID:14496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4516.exe
      4⤵
      PID:60
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8716.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8716.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49830.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3509.exe
        5⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46374.exe
        6⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64942.exe
        7⤵
        
        PID:11036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52441.exe
        7⤵
        
        PID:14592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6646.exe
        7⤵
        
        PID:17496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26139.exe
        6⤵
        
        PID:11096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6504.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9710.exe
        6⤵
        
        PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20608.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17011.exe
        5⤵
        
        PID:9320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33209.exe
        5⤵
        
        PID:14552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22531.exe
        5⤵
        
        PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65517.exe
      4⤵
      PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55658.exe
        5⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8237.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56613.exe
        6⤵
        
        PID:10904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39036.exe
        6⤵
        
        PID:17264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
        6⤵
        
        PID:2268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38724.exe
        5⤵
        
        PID:9328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63524.exe
        5⤵
        
        PID:14056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34240.exe
        5⤵
        
        PID:18772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47748.exe
      4⤵
      PID:7948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23874.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1463.exe
        5⤵
        
        PID:17892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34387.exe
      4⤵
      PID:12020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36700.exe
      4⤵
      PID:16304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13982.exe
      4⤵
      PID:5956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28206.exe
      4⤵
      PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
        5⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24744.exe
        6⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28739.exe
        6⤵
        
        PID:12644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1975.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36319.exe
        6⤵
        
        PID:17884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58185.exe
        5⤵
        
        PID:9588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17256.exe
        5⤵
        
        PID:13976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39503.exe
        5⤵
        
        PID:1156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58133.exe
      4⤵
      PID:8140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe
      4⤵
      PID:10752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59597.exe
      4⤵
      PID:15280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6010.exe
      4⤵
      PID:2964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2932.exe
    3⤵
    PID:5424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46265.exe
      4⤵
      PID:7964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28687.exe
      4⤵
      PID:8860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48192.exe
      4⤵
      PID:15904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24799.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24799.exe
      4⤵
      PID:18440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49562.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49562.exe
    3⤵
    PID:7916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38903.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38903.exe
    3⤵
    PID:10456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60813.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60813.exe
    3⤵
    PID:14872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39219.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39219.exe
    3⤵
    PID:10016
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56926.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56926.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54726.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52378.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2165.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45201.exe
        8⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29286.exe
        9⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21798.exe
        10⤵
        
        PID:15048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15111.exe
        10⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1024.exe
        9⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1163.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61712.exe
        9⤵
        
        PID:18164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15947.exe
        8⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40853.exe
        8⤵
        
        PID:12792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26577.exe
        8⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14308.exe
        7⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10925.exe
        8⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52477.exe
        8⤵
        
        PID:9656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44640.exe
        8⤵
        
        PID:14612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7354.exe
        8⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7099.exe
        7⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53577.exe
        7⤵
        
        PID:9936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42380.exe
        7⤵
        
        PID:15132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22723.exe
        7⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43752.exe
        6⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34750.exe
        7⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20194.exe
        8⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52425.exe
        8⤵
        
        PID:12168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-203.exe
        8⤵
        
        PID:15452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2886.exe
        8⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62705.exe
        7⤵
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21274.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61901.exe
        8⤵
        
        PID:16852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28566.exe
        8⤵
        
        PID:18720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13800.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44449.exe
        7⤵
        
        PID:17484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33663.exe
        6⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40474.exe
        7⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3157.exe
        8⤵
        
        PID:14320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41867.exe
        8⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24464.exe
        7⤵
        
        PID:10416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24411.exe
        7⤵
        
        PID:14884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41149.exe
        7⤵
        
        PID:17356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35558.exe
        7⤵
        
        PID:7868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22092.exe
        6⤵
        
        PID:8372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1715.exe
        6⤵
        
        PID:10976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32040.exe
        6⤵
        
        PID:15408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18066.exe
        6⤵
        
        PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62658.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37298.exe
        7⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
        8⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1045.exe
        9⤵
        
        PID:12320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15736.exe
        9⤵
        
        PID:17120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55655.exe
        9⤵
        
        PID:17812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63421.exe
        8⤵
        
        PID:9412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63524.exe
        8⤵
        
        PID:1748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49076.exe
        8⤵
        
        PID:17772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5040.exe
        7⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43053.exe
        7⤵
        
        PID:11984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53236.exe
        7⤵
        
        PID:16228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33735.exe
        7⤵
        
        PID:19076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4796.exe
        6⤵
        
        PID:736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47298.exe
        7⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40438.exe
        8⤵
        
        PID:10968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52441.exe
        8⤵
        
        PID:14420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55847.exe
        8⤵
        
        PID:18176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34499.exe
        7⤵
        
        PID:11156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22841.exe
        7⤵
        
        PID:14468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42575.exe
        7⤵
        
        PID:17060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18775.exe
        6⤵
        
        PID:8156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3052.exe
        6⤵
        
        PID:10928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22245.exe
        6⤵
        
        PID:16324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41122.exe
        6⤵
        
        PID:5348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16455.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33598.exe
        6⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
        7⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32462.exe
        8⤵
        
        PID:11376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53785.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37695.exe
        8⤵
        
        PID:19168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34499.exe
        7⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31777.exe
        7⤵
        
        PID:15412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30706.exe
        7⤵
        
        PID:16824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5040.exe
        6⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe
        6⤵
        
        PID:10744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59597.exe
        6⤵
        
        PID:14120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34214.exe
        6⤵
        
        PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27277.exe
        5⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53058.exe
        6⤵
        
        PID:8964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
        6⤵
        
        PID:11072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-203.exe
        6⤵
        
        PID:14436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32050.exe
        6⤵
        
        PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37075.exe
        5⤵
        
        PID:8644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57069.exe
        5⤵
        
        PID:12524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64430.exe
        5⤵
        
        PID:16632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4382.exe
        5⤵
        
        PID:17844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29188.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52378.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2165.exe
        6⤵
        Executes dropped EXE
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34174.exe
        7⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe
        8⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23695.exe
        8⤵
        
        PID:13012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55260.exe
        8⤵
        
        PID:16672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
        8⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62705.exe
        7⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9716.exe
        7⤵
        
        PID:13228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36067.exe
        7⤵
        
        PID:17072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40941.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32180.exe
        6⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48974.exe
        7⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15284.exe
        7⤵
        
        PID:11196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35039.exe
        7⤵
        
        PID:15428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
        7⤵
        
        PID:3276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64380.exe
        6⤵
        
        PID:8752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40853.exe
        6⤵
        
        PID:12836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64476.exe
        6⤵
        
        PID:16800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48763.exe
        6⤵
        
        PID:18144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43752.exe
        5⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62762.exe
        6⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35954.exe
        7⤵
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1832.exe
        8⤵
        
        PID:18736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43540.exe
        7⤵
        
        PID:12352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7028.exe
        7⤵
        
        PID:16472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40603.exe
        7⤵
        
        PID:17976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62705.exe
        6⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32462.exe
        7⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
        7⤵
        
        PID:15100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-623.exe
        6⤵
        
        PID:11220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6068.exe
        6⤵
        
        PID:14892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35551.exe
        6⤵
        
        PID:7784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21411.exe
        5⤵
        
        PID:6164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6841.exe
        6⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31362.exe
        7⤵
        
        PID:13600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14200.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42303.exe
        7⤵
        
        PID:656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52477.exe
        6⤵
        
        PID:9260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19175.exe
        6⤵
        
        PID:14528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40464.exe
        6⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43919.exe
        6⤵
        
        PID:17604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62165.exe
        5⤵
        
        PID:7608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56588.exe
        5⤵
        
        PID:10908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42564.exe
        5⤵
        
        PID:15272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
        5⤵
        
        PID:5896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62776.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62658.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53037.exe
        6⤵
        
        PID:7740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25887.exe
        6⤵
        
        PID:10196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25304.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6628.exe
        6⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18584.exe
        5⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32638.exe
        6⤵
        
        PID:9052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
        6⤵
        
        PID:12148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-203.exe
        6⤵
        
        PID:14680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35558.exe
        6⤵
        
        PID:8008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7395.exe
        5⤵
        
        PID:7960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20624.exe
        5⤵
        
        PID:12400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63900.exe
        5⤵
        
        PID:16588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26405.exe
      4⤵
      PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        5⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26442.exe
        6⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51974.exe
        7⤵
        
        PID:13580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56769.exe
        7⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50139.exe
        7⤵
        
        PID:18980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19176.exe
        6⤵
        
        PID:11940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31531.exe
        6⤵
        
        PID:16328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64968.exe
        6⤵
        
        PID:17004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28350.exe
        6⤵
        
        PID:17952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62705.exe
        5⤵
        
        PID:9192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13800.exe
        5⤵
        
        PID:13112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56656.exe
        5⤵
        
        PID:17232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15899.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:18268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
      4⤵
      PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61958.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24121.exe
        6⤵
        
        PID:3228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20712.exe
        5⤵
        
        PID:11896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24515.exe
        5⤵
        
        PID:16376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29180.exe
        5⤵
        
        PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55862.exe
      4⤵
      PID:1124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65432.exe
      4⤵
      PID:13020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38140.exe
      4⤵
      PID:16732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59500.exe
      4⤵
      PID:17808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43028.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43028.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8789.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3945.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10525.exe
        6⤵
        
        PID:4068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49934.exe
        7⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59882.exe
        8⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5705.exe
        9⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44517.exe
        9⤵
        
        PID:16932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15930.exe
        9⤵
        
        PID:17616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7116.exe
        8⤵
        
        PID:12208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31531.exe
        8⤵
        
        PID:16336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12651.exe
        8⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62705.exe
        7⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1391.exe
        7⤵
        
        PID:12252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38549.exe
        7⤵
        
        PID:15532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44827.exe
        7⤵
        
        PID:16780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43280.exe
        6⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25970.exe
        7⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1024.exe
        7⤵
        
        PID:11444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58340.exe
        7⤵
        
        PID:15128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52512.exe
        6⤵
        
        PID:8260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20624.exe
        6⤵
        
        PID:12412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63900.exe
        6⤵
        
        PID:16620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61016.exe
        6⤵
        
        PID:18408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19440.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61240.exe
        6⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10645.exe
        7⤵
        
        PID:10376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18564.exe
        7⤵
        
        PID:16028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25722.exe
        7⤵
        
        PID:6420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4272.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7055.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32005.exe
        6⤵
        
        PID:7752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53892.exe
        5⤵
        
        PID:2720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40474.exe
        6⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55482.exe
        7⤵
        
        PID:13664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56769.exe
        7⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52303.exe
        7⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28356.exe
        6⤵
        
        PID:10340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53000.exe
        6⤵
        
        PID:14808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52524.exe
        6⤵
        
        PID:10012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53047.exe
        6⤵
        
        PID:18252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59617.exe
        5⤵
        
        PID:8636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36074.exe
        6⤵
        
        PID:16984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23383.exe
        6⤵
        
        PID:17824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34387.exe
        5⤵
        
        PID:12028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36700.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55741.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21220.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22394.exe
        5⤵
        
        PID:1132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30666.exe
        6⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39706.exe
        7⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52477.exe
        7⤵
        
        PID:9436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27343.exe
        7⤵
        
        PID:14564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64968.exe
        7⤵
        
        PID:17168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44023.exe
        7⤵
        
        PID:18764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10660.exe
        6⤵
        
        PID:8356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4323.exe
        6⤵
        
        PID:11844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61901.exe
        6⤵
        
        PID:16296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49503.exe
        6⤵
        
        PID:1424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19352.exe
        5⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40474.exe
        6⤵
        
        PID:7824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36140.exe
        6⤵
        
        PID:10548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60784.exe
        6⤵
        
        PID:15104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4483.exe
        6⤵
        
        PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21655.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10380.exe
        5⤵
        
        PID:12228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57512.exe
        5⤵
        
        PID:4980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36560.exe
        5⤵
        
        PID:7172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25181.exe
        5⤵
        
        PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17223.exe
      4⤵
      PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40370.exe
        5⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25970.exe
        6⤵
        
        PID:7332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1024.exe
        6⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1163.exe
        6⤵
        
        PID:16708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50645.exe
        5⤵
        
        PID:8772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34987.exe
        5⤵
        
        PID:12800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34591.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42409.exe
      4⤵
      PID:7088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2093.exe
        5⤵
        
        PID:11928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42300.exe
        5⤵
        
        PID:16288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25442.exe
        5⤵
        
        PID:19068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61144.exe
      4⤵
      PID:10136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51397.exe
      4⤵
      PID:14244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62991.exe
      4⤵
      PID:5900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39608.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39608.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60930.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23354.exe
        5⤵
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30474.exe
        6⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60894.exe
        7⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52477.exe
        7⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44640.exe
        7⤵
        
        PID:14584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34982.exe
        7⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24256.exe
        6⤵
        
        PID:8584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53842.exe
        7⤵
        
        PID:10588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60225.exe
        7⤵
        
        PID:14128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59739.exe
        7⤵
        
        PID:17732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37188.exe
        6⤵
        
        PID:11960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61901.exe
        6⤵
        
        PID:16272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37250.exe
        6⤵
        
        PID:18472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-468.exe
        5⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45186.exe
        6⤵
        
        PID:9616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11391.exe
        6⤵
        
        PID:14192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50576.exe
        6⤵
        
        PID:18028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49580.exe
        5⤵
        
        PID:8488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29177.exe
        5⤵
        
        PID:13260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15467.exe
        5⤵
        
        PID:16876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11815.exe
        5⤵
        
        PID:17784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52497.exe
      4⤵
      PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62134.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24744.exe
        6⤵
        
        PID:8924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28739.exe
        6⤵
        
        PID:12684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        6⤵
        
        PID:17108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53047.exe
        6⤵
        
        PID:18184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41080.exe
        5⤵
        
        PID:8904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48969.exe
        5⤵
        
        PID:13320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43335.exe
        5⤵
        
        PID:5888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21323.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6540.exe
      4⤵
      PID:10068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41840.exe
      4⤵
      PID:14652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27323.exe
      4⤵
      PID:6524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44449.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44449.exe
      4⤵
      PID:17452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19824.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19824.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35990.exe
      4⤵
      PID:3908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32202.exe
        5⤵
        
        PID:6484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48206.exe
        6⤵
        
        PID:8652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10868.exe
        6⤵
        
        PID:13560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41280.exe
        6⤵
        
        PID:11816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43475.exe
        6⤵
        
        PID:16388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22440.exe
        5⤵
        
        PID:8308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10868.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43008.exe
        5⤵
        
        PID:16828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14555.exe
        5⤵
        
        PID:6316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14640.exe
      4⤵
      PID:7076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13892.exe
        5⤵
        
        PID:8224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63944.exe
      4⤵
      PID:10108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22042.exe
        5⤵
        
        PID:12896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56769.exe
        5⤵
        
        PID:4808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41867.exe
        5⤵
        
        PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23313.exe
      4⤵
      PID:14260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22531.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22531.exe
      4⤵
      PID:6768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63432.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63432.exe
    3⤵
    PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13753.exe
      4⤵
      PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19426.exe
        5⤵
        
        PID:8536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23452.exe
        5⤵
        
        PID:11996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56036.exe
        5⤵
        
        PID:16244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29964.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63281.exe
      4⤵
      PID:7748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14759.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7028.exe
      4⤵
      PID:16496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44687.exe
      4⤵
      PID:18056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51277.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51277.exe
    3⤵
    PID:6592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
      4⤵
      PID:8884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7116.exe
      4⤵
      PID:12200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39700.exe
      4⤵
      PID:14856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
      4⤵
      PID:17004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51010.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51010.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19739.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19739.exe
    3⤵
    PID:12344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37564.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37564.exe
    3⤵
    PID:16556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18467.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18467.exe
    3⤵
    PID:18232
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5679.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5679.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34306.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34306.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41662.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3509.exe
        6⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
        7⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2093.exe
        8⤵
        
        PID:11920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42300.exe
        8⤵
        
        PID:16260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62583.exe
        8⤵
        
        PID:19304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10136.exe
        7⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59248.exe
        7⤵
        
        PID:13728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47644.exe
        7⤵
        
        PID:19028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64844.exe
        6⤵
        
        PID:9488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51013.exe
        6⤵
        
        PID:13252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53294.exe
        6⤵
        
        PID:17304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56490.exe
        6⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17687.exe
        6⤵
        
        PID:18972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12232.exe
        5⤵
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23178.exe
        6⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11849.exe
        7⤵
        
        PID:11080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52441.exe
        7⤵
        
        PID:14728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18898.exe
        7⤵
        
        PID:17448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10136.exe
        6⤵
        
        PID:9396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59248.exe
        6⤵
        
        PID:13764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8811.exe
        6⤵
        
        PID:17632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14691.exe
        5⤵
        
        PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34387.exe
        5⤵
        
        PID:11972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36700.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55689.exe
        5⤵
        
        PID:16752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46493.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7401.exe
        5⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16826.exe
        6⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32462.exe
        7⤵
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
        7⤵
        
        PID:15116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55847.exe
        7⤵
        
        PID:18192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14028.exe
        6⤵
        
        PID:9952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63140.exe
        6⤵
        
        PID:14008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31474.exe
        6⤵
        
        PID:6852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7099.exe
        5⤵
        
        PID:7728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3012.exe
        6⤵
        
        PID:708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1463.exe
        6⤵
        
        PID:17900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10380.exe
        5⤵
        
        PID:12256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57512.exe
        5⤵
        
        PID:15204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36067.exe
        5⤵
        
        PID:16740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-676.exe
        5⤵
        
        PID:17644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5547.exe
      4⤵
      PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24994.exe
        5⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32462.exe
        6⤵
        
        PID:9604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
        6⤵
        
        PID:15536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19822.exe
        6⤵
        
        PID:17560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33872.exe
        5⤵
        
        PID:9940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63140.exe
        5⤵
        
        PID:14032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11630.exe
        5⤵
        
        PID:7616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52845.exe
      4⤵
      PID:7624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58560.exe
      4⤵
      PID:9536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25304.exe
      4⤵
      PID:14644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52749.exe
      4⤵
      PID:10028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23022.exe
      4⤵
      PID:19240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54224.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54224.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43390.exe
      4⤵
      PID:1568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-925.exe
        5⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27454.exe
        6⤵
        
        PID:7504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52477.exe
        6⤵
        
        PID:9584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44640.exe
        6⤵
        
        PID:14660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52524.exe
        6⤵
        
        PID:16928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32626.exe
        6⤵
        
        PID:8048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58901.exe
        5⤵
        
        PID:7684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4323.exe
        5⤵
        
        PID:11832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61901.exe
        5⤵
        
        PID:15244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8662.exe
        5⤵
        
        PID:19060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43280.exe
      4⤵
      PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-505.exe
        5⤵
        
        PID:9136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20712.exe
        5⤵
        
        PID:12172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24515.exe
        5⤵
        
        PID:15620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45724.exe
        5⤵
        
        PID:3336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48428.exe
      4⤵
      PID:7988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20624.exe
      4⤵
      PID:12392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63900.exe
      4⤵
      PID:16648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61016.exe
      4⤵
      PID:3636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63545.exe
    3⤵
    PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9285.exe
      4⤵
      PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
        5⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12513.exe
        6⤵
        
        PID:9644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11391.exe
        6⤵
        
        PID:13360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50960.exe
        6⤵
        
        PID:19092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34499.exe
        5⤵
        
        PID:11312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7272.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22730.exe
        5⤵
        
        PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5040.exe
      4⤵
      PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42462.exe
        5⤵
        
        PID:12964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29806.exe
        5⤵
        
        PID:9032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59389.exe
      4⤵
      PID:12124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36899.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52272.exe
      4⤵
      PID:6276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54216.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54216.exe
    3⤵
    PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
      4⤵
      PID:8876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30711.exe
      4⤵
      PID:12556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7028.exe
      4⤵
      PID:16600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65299.exe
      4⤵
      PID:18108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33176.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33176.exe
    3⤵
    PID:7072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12489.exe
    3⤵
    PID:12220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34539.exe
    3⤵
    PID:16392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14267.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14267.exe
    3⤵
    PID:17964
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29957.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29957.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25126.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24558.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42814.exe
        5⤵
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11781.exe
        6⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25970.exe
        7⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1024.exe
        7⤵
        
        PID:12296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58340.exe
        7⤵
        
        PID:16016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5251.exe
        7⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59965.exe
        6⤵
        
        PID:4748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39456.exe
        6⤵
        
        PID:12380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7028.exe
        6⤵
        
        PID:16536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12014.exe
        6⤵
        
        PID:18380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14256.exe
        5⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60858.exe
        6⤵
        
        PID:10996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52441.exe
        6⤵
        
        PID:13460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64207.exe
        6⤵
        
        PID:17440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63944.exe
        5⤵
        
        PID:10156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11060.exe
        5⤵
        
        PID:14232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63948.exe
        5⤵
        
        PID:6896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2528.exe
      4⤵
      PID:4108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14905.exe
        5⤵
        
        PID:6220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8865.exe
        6⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21252.exe
        6⤵
        
        PID:12816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1739.exe
        6⤵
        
        PID:16792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13696.exe
        5⤵
        
        PID:8596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10867.exe
        5⤵
        
        PID:12516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2368.exe
        5⤵
        
        PID:16576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12014.exe
        5⤵
        
        PID:17412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11079.exe
      4⤵
      PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8865.exe
        5⤵
        
        PID:8632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1024.exe
        5⤵
        
        PID:2644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33835.exe
        5⤵
        
        PID:16412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8427.exe
        5⤵
        
        PID:18068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6244.exe
      4⤵
      PID:8552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53376.exe
      4⤵
      PID:1920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22860.exe
      4⤵
      PID:16900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41133.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:18204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57401.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57401.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7017.exe
      4⤵
      PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19758.exe
        5⤵
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8865.exe
        6⤵
        
        PID:8816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21252.exe
        6⤵
        
        PID:12852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1739.exe
        6⤵
        
        PID:16744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20679.exe
        6⤵
        
        PID:18396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55584.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2508.exe
        5⤵
        
        PID:12976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36235.exe
        5⤵
        
        PID:17280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62168.exe
        5⤵
        
        PID:12928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2196.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8865.exe
        5⤵
        
        PID:8820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21252.exe
        5⤵
        
        PID:12844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1739.exe
        5⤵
        
        PID:16772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20679.exe
        5⤵
        
        PID:8056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43332.exe
      4⤵
      PID:9576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10676.exe
      4⤵
      PID:13324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36235.exe
      4⤵
      PID:17288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40365.exe
      4⤵
      PID:17428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-695.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-695.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20910.exe
      4⤵
      PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-261.exe
        5⤵
        
        PID:9748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36192.exe
        5⤵
        
        PID:13484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44080.exe
        5⤵
        
        PID:17388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
        5⤵
        
        PID:3252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42040.exe
      4⤵
      PID:9976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63140.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31912.exe
      4⤵
      PID:7280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43919.exe
      4⤵
      PID:17476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10660.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10660.exe
    3⤵
    PID:7372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63412.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63412.exe
    3⤵
    PID:8064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65377.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65377.exe
    3⤵
    PID:14508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57801.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57801.exe
    3⤵
    PID:4956
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49830.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49830.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24122.exe
      4⤵
      PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23458.exe
        5⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25970.exe
        6⤵
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1024.exe
        6⤵
        
        PID:10604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1163.exe
        6⤵
        
        PID:16612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20679.exe
        6⤵
        
        PID:18388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31376.exe
        5⤵
        
        PID:8932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10868.exe
        5⤵
        
        PID:13552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61937.exe
        5⤵
        
        PID:17464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48045.exe
      4⤵
      PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32462.exe
        5⤵
        
        PID:2676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52057.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15930.exe
        5⤵
        
        PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27955.exe
      4⤵
      PID:9540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6193.exe
        5⤵
        
        PID:14824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43419.exe
        5⤵
        
        PID:18548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49737.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25942.exe
      4⤵
      PID:5732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
    3⤵
    PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35430.exe
      4⤵
      PID:6620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32462.exe
        5⤵
        
        PID:11364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28128.exe
        5⤵
        
        PID:15848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13190.exe
        5⤵
        
        PID:19100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10136.exe
      4⤵
      PID:9456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59248.exe
      4⤵
      PID:13748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29772.exe
      4⤵
      PID:18364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26943.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26943.exe
    3⤵
    PID:7148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39741.exe
      4⤵
      PID:19016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17283.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17283.exe
    3⤵
    PID:11468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31848.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31848.exe
    3⤵
    PID:16060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42825.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42825.exe
    3⤵
    PID:18784
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49060.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49060.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52518.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52518.exe
    3⤵
    PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38590.exe
      4⤵
      PID:7108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3489.exe
        5⤵
        
        PID:11028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52441.exe
        5⤵
        
        PID:14456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33872.exe
      4⤵
      PID:9988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63140.exe
      4⤵
      PID:14016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
      4⤵
      PID:17272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19543.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19543.exe
    3⤵
    PID:7760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63168.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63168.exe
    3⤵
    PID:11952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38236.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38236.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43338.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43338.exe
    3⤵
    PID:5144
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19613.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19613.exe
  2⤵
  PID:5712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31154.exe
    3⤵
    PID:6460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56632.exe
      4⤵
      PID:18468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1968.exe
    3⤵
    PID:9428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59248.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59248.exe
    3⤵
    PID:13888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49076.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49076.exe
    3⤵
    PID:17720
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60511.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60511.exe
  2⤵
  PID:8184
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54180.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54180.exe
  2⤵
  PID:10520
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23596.exe
  2⤵
  PID:15088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59252.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59252.exe
  2⤵
  PID:6016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4496 -ip 4496
1⤵
PID:2720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 16352 -ip 16352
1⤵
PID:16780

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:7808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-14440.exe

Filesize
468KB

MD5
03eb08d880277fe532da60ae5ac7e64f

SHA1
f2199685b88ca9bfb08a0c63d86bd5082e360832

SHA256
c38557039cc98344c4544ac91d4253a3ce5631de614cb02adf09fd739cbf72b6

SHA512
35ef393fcdb4a4915d0721a96d80e3119669e1f5e65c39fcdd6ded6f90ceda801545c0bff3a3f848b5767b14d928a3c3550801df17c4a5e147f3b135895898f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16744.exe

Filesize
468KB

MD5
c18575d2066623b48c8ffcb5f70afcbd

SHA1
c54149bacbc31994a446025d92d16344073c9be8

SHA256
0244b1cf0d87faa4bf6d928442f74bdf4b203e7b82a9804f6abed306c15ab4bd

SHA512
de6b3157529fd8e31ad59d93c50e7fedd28f4025e6377133d9cb0b8da35e6a6f010687195820b623117be561f84863f9ab407b54e387ebc853aa03d912d4cd99

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17970.exe

Filesize
468KB

MD5
5c3d61af10936ba53d1b149a6ba6bf2d

SHA1
0abd1ea7e2d92081908cf823d77bbbc1972b4190

SHA256
6ca0a657a57b27662f9347f568531ba581ab5dd693906fbcaeb36b7203ad0783

SHA512
731c7cc368157573c559b13e32592707b996d909f9bf48b795394da005f3e49dd45defac8c4e37abd0755c7e9feecc3c4dd8f3337f744db1ab494b587549cd9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25126.exe

Filesize
468KB

MD5
9efbabb630ec00c340d81c4fba4247b1

SHA1
60bfb268f4184629021771d705cbeee852d43234

SHA256
e4816b372bfca0a2b5796f3b637b30acfb47f41cfef6e1c93aec2220c572c4c4

SHA512
a63e9ac4bf9a428e8b4f2877ac3db79a2721c4b41c33d829da22281d4e20a5982902a8bf0f0159bd649c62b0b19c81325b1da0863141ca5f9cd663d81c601d41

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25628.exe

Filesize
468KB

MD5
01d5238eea391a0a8996955d5248d4c2

SHA1
9f5781394946bac0416564afd2849372e8c0665f

SHA256
8b624cf958392fe33a464820a9b18e044a2f408efe57bd85385aaffbc70b6f82

SHA512
2ff13a6a6161f80b37d2c093f2803fe4181af5da38a5e75f300e6e6afae8b98d1d1a3084afedbdadd9cf5a8127970765f519e1842e8e461d645ec6c720e21f97

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27682.exe

Filesize
468KB

MD5
0e03b4afd9bee707193504d0a4076de2

SHA1
f9692693d4e50513de786d72e04ff7fb60319bbe

SHA256
30ea6220941e34cd81bc6f708bd10b3e4f3a5f12fb5b493ed5f50155b547695a

SHA512
5e3efbbd28338c6fb3b68adfb7144c1d816a0bc7c151a8998d758c5532aeee34c540641c4310082856e45e664b56bde66c8f6ad8c4654b014f087feac7d39eaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2851.exe

Filesize
468KB

MD5
36b97da59862885f36c376d6c59d0303

SHA1
7a7f1aa838f0cce7805e06aaa872e14a4fb36732

SHA256
500c5c8f89240bf4c39776e0c3a8181cf6b09cef16c99473a15df3abadc3537f

SHA512
b5703694d8ba59ee2e737469f217ce897cb8e62f5cb16444c40c79e7b4945626625fde6454f4c0624efd32aa8d6bf1748901946d1e8d697b6682914b246d28fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29188.exe

Filesize
468KB

MD5
eee703765db56956e29205bb94c58e9c

SHA1
b32b1645fc30d2c0cecad05cd8d40603738e94dc

SHA256
5058080d58a1a944f83516635ae7ab9b73acb3a18a665473e2623cf9102abaa4

SHA512
a38ed57a6244d532be99dd1a7baa531c4beb8a76a61fa1001cba9ce5cafd5c2326d80b9411f1ef2256dcd2be221f162b85ddc81c57daef6fe121faed35167e04

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29911.exe

Filesize
468KB

MD5
065b0a430e58c627b5fbf1d40a16404a

SHA1
f007c8d3a95672639963d60d9a6da11f18d53a37

SHA256
64ce938aef9b99e534ab6ff70e1da779c17471f76efd9fdc877499e0eb8f9f90

SHA512
1622b4667ac519dec324311b8c04ddb02667439cbd710fd2483b10ea9f2bf609c5737e37715e8d6dde8d059c3623b4a01d2e9c87d787b04a8d94b77a6a27c93d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29957.exe

Filesize
468KB

MD5
2dc2c2761fe5de31aab4b871b5cc884a

SHA1
738e6b66457b1ec9cac59efa66072f0e56b81d8a

SHA256
e4c153238659d5961333da626b8980e05b58ade399c29ccd1c06e9e332b9724a

SHA512
020d96fe5473f47e500579468252cb90caf43788409cfd3e9f3898b509f408d902ae878c67b6687b1bbb82d03de26c6ce284723f7024a46735a0e7d883cce1a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32451.exe

Filesize
468KB

MD5
8982a04c1dcc68edb82eb3e6445fecd1

SHA1
7858e70aa6f7777e5fa2768015b961672879545c

SHA256
1d627bc6027b9f464cfd0ec644e1606aa7fa8e616882111557befa81d704a400

SHA512
5c1cd19f39357631ed72c9bb3f2d8597d498ecd1d87ec4dce860c5239eac938ea4a9c2b415d3163da5cc27df3e23ac5ee289e13309c6de3df16fbadddf7247dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32723.exe

Filesize
468KB

MD5
1f6153e5c2f30285869376a3d4144028

SHA1
22a1b6f275cf898e05c6185cc17c914ae062b163

SHA256
6da19673dcc2f805d1ab400dff0b9b7259177b60a7bdbef4adf33fe33f09ba98

SHA512
6b3c3b0d4cc341c38a3629e5c86c9ca9e6dc5e6a7aff5ef60f55266fb1afb5ed014279d596e84d444d589d2500e1c171fbd6cf0b38b11d21593d94e53994f7b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34306.exe

Filesize
468KB

MD5
33793455d440e379834de05a9e55e61c

SHA1
cbcf2b1f04aecbb1482548143bbc83d1418fe2bf

SHA256
59e70722746f362862a14dd8281c9e52333112a5954e72c336fdc79baf48f4d6

SHA512
2b24035a9ed0911cc7bff23867aacdb479e1f331657ccf159c2e94fa26d43636a55a1c906e7898afa96c24d1f2f3d2e6d41b4a15e59528985e39c6b5e750db89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37134.exe

Filesize
468KB

MD5
e4dc30caa364a4eae3e822315034f7e3

SHA1
8dcc3013602f181b4c599833f83fb1e2d51804bd

SHA256
e3856175f27eaad8c825ea07890c3879dae2ca72f53e84a6511550065d363a69

SHA512
e94ab7009fe1877424e915896f088fb9e5d92f9153953262bd082f82d97fd436e963513cdcd62473a91fc7c0251060c7107a70f10bcd1b0d6a55e4793ab81ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39608.exe

Filesize
468KB

MD5
48c02d17271f0400638e8dd0593622db

SHA1
fb30a1a627dadf0b3cf22e8b4674fe69fdb2040e

SHA256
85e58d7328034f0b69ceb24d406bd65c46e886e0b823de09494667a911d7d9a1

SHA512
e3f6b9329d11d2ff9608f8d9144f15083ea63cff69d63e45310828233a6d4be24c84bbaff6bcf07e00ac20927c966cf2b4370b367650f88c9fe2faa3201b13f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43028.exe

Filesize
468KB

MD5
143ac45a82c79357597dad5a6ce09763

SHA1
770453c69191ed42062074a357303ba4143aa627

SHA256
a317b03ee07c3bddd7757855af3413f93d8045d69fcfbe0b3447ed92cf276188

SHA512
8c1856de45280750ffc12731c9eb53bac4e77245be7531301849fe6716bf1bbbf1371c661ecc0dd877ff369f0bbfa916e0fe373538f7a5d05c443aef7eb5e067

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52378.exe

Filesize
468KB

MD5
673b1bdf37e371ac14662894115d348a

SHA1
7bf9fc5e0e12e1f6926b952f7445b575e37fefe1

SHA256
8083486a83328f652f71e3c3b4830ecabcfccde91c4929a9cff88b152e1df60b

SHA512
a94a0f54c903f8a3743f247860b703b2fb4945c78fcf267eba4166b74ed69e4ab22e40d546964811004ecfed054eaa2812f82c17bfda4c0bfd92ad7166f9faf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53138.exe

Filesize
468KB

MD5
5a0f96f430a7d91646ebca792e79a530

SHA1
e9836297962b5dc08a46a5598a0ec2262a628a3e

SHA256
cd8c0b3f3448b4c065a976a9ad88b0f8e143bdcc2545b7e1babd1be7ffc1e3d3

SHA512
54a92a30e5f0d1edcffce550bd67e74e4b8b8b229cf31beb7c57f5362703b021dc1d2b69f56aac6b3ae37aff96318f83036acc0948f3e5852320ecf7bc08ceaf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5452.exe

Filesize
468KB

MD5
0651469d74d0f285d6261a9576194479

SHA1
a1cb39cd98277c71f0cbcb03701f0016fff5bcab

SHA256
5c6240c9c2f3223749746d781cec7aadc222b2c9ada17099cf90f9e2844607ef

SHA512
a3dcff98c787bfd5790b070c5da37d6191f82aced0b841f1825200da3d2c3892e03ff44f2012d830fe026213c59cb8e10bd60cc74312558f137315abe9ceb26e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54726.exe

Filesize
468KB

MD5
c6dc90e46e65b998205e88ab6f436041

SHA1
7a3d314300f47e3234246929326f59684f7b23bb

SHA256
f063119afc9b5d152f42e322550f655429149828ed11904c6dfcfa6caa05a651

SHA512
29ce9e62cad4648ce2e11ca69b1d8c46136ce72b339836a35edaf1da8f67d25cbb369d6a97aaf41c5d7864887fb9348be08baaa6411b19b2ade2fbcac4e26326

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5679.exe

Filesize
468KB

MD5
34e5ed71bacc7639398506ac2ef5f92f

SHA1
4ed9ea3c04c6496a8b75a04bdf50cfa7ca7c8487

SHA256
e866a6a76116f9352039ae62445f32b10a6b9c8d810cda1a7f66adb6c7559267

SHA512
a80ecc8b76ee0f3f5e7213cb47d0449f80f0dc7768d3b01d8b77046da6f241943c9228b4cc24dc8048b1747b8d32df022cccb994bf6554ac285c8cf922f82c18

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56926.exe

Filesize
468KB

MD5
1c728b6660cb56a45b70dfe5f777b8f3

SHA1
5872ec447928f1f695d42f3da47db2470d0186fc

SHA256
f27b66d095636e8045f039ab2a0c03c9c9c6c0a31f2f0f29d31c1dea874f9bc9

SHA512
779ede3fa010bf0c45ff73145653727f8b4f5269c71370231e4e162ad34ddacad7b799ad4a90484f4955bf51c7b56249e8b156ff47bc927328c7368d489136d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57481.exe

Filesize
468KB

MD5
6517f56e28b73635788b35867d4a2100

SHA1
fd7ae4198ea0a457c427bc5f53c96891862e3eba

SHA256
712805a5cf6b17ba430efff4dada17ca7614e2c3ffc12d46b2ac83844f48a384

SHA512
35c5e50a0128b183c87bb4aa10cbe81ff794fe0e074fdb7334394495083c6be768b423b6be86e3f7c888593f626caddb1f7e43644adf9542eb08472c5c708fef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6049.exe

Filesize
468KB

MD5
797d9f82f4f222998589870845f594c6

SHA1
95f5cb8d1cccc96945a380f27629406700cc3a90

SHA256
0617452fbba0fe4b9c6891441e99b545f13af949ee7cd3937aa68b9661ef1c24

SHA512
c9c9c3d26597f236c68129f2b9c6515bac91dcd82560be3a228b3dfc86ecfe37dccfac014ed8be9cba1338c7e7b390e377e590f45167d1b0c07f84706ccfacd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62776.exe

Filesize
468KB

MD5
fe599bd50de568ddf6c637c5d58d7913

SHA1
95b12566e7d216d8d3f1eca7fbc2b3315ca8bba3

SHA256
4ed2e53785fe22e2a1014d8adf03d271c3ca2e85f4ccff3fefd523b0ce6a92e6

SHA512
bcbac9eee6a51d5fa7a4b78a3ea912823a4be954584da7f459ad67dfdac8cd0b2e3b121b16fe11c7e1faaa1489ebf6a7b2b1a8dbe941bdf4a727e2605cd197b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8716.exe

Filesize
468KB

MD5
94263e824079f0946d67a225881765ef

SHA1
05dec10b7ab5bfd2a3bf72f5ff18758012dfbcf3

SHA256
5b641e7c5eb070af0f1976b92e1ce68d4db73d146e3f64c235efd064a7f37dac

SHA512
07f8d8da1e492c7b360a286c89f3d398b2621aba2667c68c7346574aa5ee6a3068de11ef1093b194d6b5da607689119bc0c536f41e44528abc3eb394053e8c96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8789.exe

Filesize
468KB

MD5
4d9c3f98f81a5d58dc003c84974974cb

SHA1
8e807d9e3df1e483a4990448db718b2e8699699a

SHA256
23fbd37411163725056de066aa8841ebee7472ff16a8d8d2bbccdf0f075f1dcf

SHA512
2559bae69b287ffb7021107038f9a5f2c2a2a6b5f8b661a796ae0276f38da07acb53ccbb9222fb33a0ac1bfc90ae9f40d5d79024807020c9e022afd6240ebb90

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe

Filesize
468KB

MD5
39d847fc79a338bf4daa04dc7c6baf7e

SHA1
0e0597445e051bfbcf0a82ebf5802e7931bd977b

SHA256
f7e6c3d24608a7956d2d420fd7426628aa8828326e89659f37bca66a8283c93a

SHA512
d5614f30834a4fd2283c712c283af44ce7a8d0720d7500f6996d3aafcca2da8af0baa0a13ca098848accb3c2d06dda89c7e109e2135d4a6026c5744862c2dcc5

Download Submit
memory/708-2604-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1256-2570-0x0000000075AF0000-0x0000000075AFF000-memory.dmp

Filesize
60KB

Download
memory/4808-2583-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads