492614db175e9abe7f17468fcc153fedabe27efa14e623d4d68445c048e0c11a

Analysis

max time kernel
150s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 21:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

492614db175e9abe7f17468fcc153fedabe27efa14e623d4d68445c048e0c11a.exe
Size

468KB
MD5

37deebd5f511759105e3dafb47c86a5c
SHA1

7967124080c2e6ec647ba9246564ef31dc80242d
SHA256

492614db175e9abe7f17468fcc153fedabe27efa14e623d4d68445c048e0c11a
SHA512

21621baf5f4c8fb0918f1c9d9ab79fc113b8a7b8e2e96f4e4fa8ee15cab0abf0353d077f74ac29937da6508b97d8d8dd70730f2e1a5e7c50dc8607f2d17270f3
SSDEEP

3072:yu0VogkGII5AtGYJzYITff8wFChCPppIJEHCyV1uyqwLBJVusilI:yueoTIAtVzVTffrfKRyq6zVus

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2128	Unicorn-60190.exe
668	Unicorn-24948.exe
4316	Unicorn-44814.exe
2032	Unicorn-13101.exe
1516	Unicorn-52088.exe
628	Unicorn-46521.exe
116	Unicorn-849.exe
2680	Unicorn-49796.exe
4024	Unicorn-64741.exe
1248	Unicorn-2541.exe
1344	Unicorn-58519.exe
1584	Unicorn-47393.exe
4616	Unicorn-41528.exe
1360	Unicorn-49365.exe
2528	Unicorn-30144.exe
2212	Unicorn-64954.exe
2912	Unicorn-1455.exe
1008	Unicorn-53257.exe
3960	Unicorn-44534.exe
4008	Unicorn-44534.exe
1136	Unicorn-63563.exe
4880	Unicorn-17892.exe
4724	Unicorn-52437.exe
5092	Unicorn-52702.exe
4348	Unicorn-54654.exe
4596	Unicorn-22643.exe
4484	Unicorn-64252.exe
4668	Unicorn-58130.exe
4216	Unicorn-13105.exe
2324	Unicorn-33818.exe
1144	Unicorn-48763.exe
1536	Unicorn-27596.exe
2220	Unicorn-54793.exe
2176	Unicorn-5037.exe
1436	Unicorn-11259.exe
3332	Unicorn-5129.exe
532	Unicorn-34372.exe
3076	Unicorn-54238.exe
3520	Unicorn-30310.exe
1100	Unicorn-21379.exe
4740	Unicorn-42562.exe
2996	Unicorn-48784.exe
3716	Unicorn-17792.exe
2700	Unicorn-63729.exe
4032	Unicorn-37086.exe
1064	Unicorn-56952.exe
2808	Unicorn-22142.exe
3732	Unicorn-41600.exe
3248	Unicorn-60936.exe
4432	Unicorn-8306.exe
1896	Unicorn-20388.exe
1712	Unicorn-54933.exe
3984	Unicorn-22334.exe
224	Unicorn-1721.exe
4188	Unicorn-1456.exe
1424	Unicorn-20750.exe
1704	Unicorn-53444.exe
2380	Unicorn-2852.exe
4752	Unicorn-2105.exe
2756	Unicorn-4143.exe
4472	Unicorn-47222.exe
3252	Unicorn-35546.exe
5012	Unicorn-15680.exe
3480	Unicorn-23848.exe

Program crash 11 IoCs

pid	pid_target	Process	procid_target
7752	2700	WerFault.exe	137
9228	2700	WerFault.exe	137
9536	2536	WerFault.exe	175
10364	6712	WerFault.exe	258
10300	2536	WerFault.exe	175
10380	6828	WerFault.exe	268
14900	6712	WerFault.exe	258
15640	5160	WerFault.exe	283
15084	6828	WerFault.exe	268
14424	1236	WerFault.exe	752
2156	8820	Process not Found	387

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41643.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33027.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11497.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14639.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36060.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7035.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44242.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46930.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30671.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55040.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64925.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12058.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32294.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31784.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50359.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64326.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7808.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	Process not Found
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	Process not Found

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Process not Found
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	Process not Found

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	Process not Found

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	7412	Process not Found
Token: SeChangeNotifyPrivilege	7412	Process not Found
Token: 33	7412	Process not Found
Token: SeIncBasePriorityPrivilege	7412	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3096	492614db175e9abe7f17468fcc153fedabe27efa14e623d4d68445c048e0c11a.exe
2128	Unicorn-60190.exe
668	Unicorn-24948.exe
4316	Unicorn-44814.exe
2032	Unicorn-13101.exe
628	Unicorn-46521.exe
1516	Unicorn-52088.exe
116	Unicorn-849.exe
2680	Unicorn-49796.exe
4024	Unicorn-64741.exe
1584	Unicorn-47393.exe
1344	Unicorn-58519.exe
1248	Unicorn-2541.exe
4616	Unicorn-41528.exe
1360	Unicorn-49365.exe
2528	Unicorn-30144.exe
2212	Unicorn-64954.exe
1008	Unicorn-53257.exe
2912	Unicorn-1455.exe
3960	Unicorn-44534.exe
5092	Unicorn-52702.exe
4008	Unicorn-44534.exe
4348	Unicorn-54654.exe
1136	Unicorn-63563.exe
4724	Unicorn-52437.exe
4880	Unicorn-17892.exe
4596	Unicorn-22643.exe
4484	Unicorn-64252.exe
4216	Unicorn-13105.exe
4668	Unicorn-58130.exe
2324	Unicorn-33818.exe
1144	Unicorn-48763.exe
1536	Unicorn-27596.exe
2220	Unicorn-54793.exe
1436	Unicorn-11259.exe
2176	Unicorn-5037.exe
3332	Unicorn-5129.exe
532	Unicorn-34372.exe
3076	Unicorn-54238.exe
3520	Unicorn-30310.exe
1100	Unicorn-21379.exe
1064	Unicorn-56952.exe
3716	Unicorn-17792.exe
4740	Unicorn-42562.exe
4032	Unicorn-37086.exe
2996	Unicorn-48784.exe
2700	Unicorn-63729.exe
3732	Unicorn-41600.exe
4432	Unicorn-8306.exe
2808	Unicorn-22142.exe
3248	Unicorn-60936.exe
1896	Unicorn-20388.exe
1712	Unicorn-54933.exe
3984	Unicorn-22334.exe
224	Unicorn-1721.exe
1424	Unicorn-20750.exe
4188	Unicorn-1456.exe
1704	Unicorn-53444.exe
2380	Unicorn-2852.exe
4752	Unicorn-2105.exe
2756	Unicorn-4143.exe
4472	Unicorn-47222.exe
5012	Unicorn-15680.exe
3252	Unicorn-35546.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 2128	3096	492614db175e9abe7f17468fcc153fedabe27efa14e623d4d68445c048e0c11a.exe	89
PID 3096 wrote to memory of 2128	3096	492614db175e9abe7f17468fcc153fedabe27efa14e623d4d68445c048e0c11a.exe	89
PID 3096 wrote to memory of 2128	3096	492614db175e9abe7f17468fcc153fedabe27efa14e623d4d68445c048e0c11a.exe	89
PID 3096 wrote to memory of 668	3096	492614db175e9abe7f17468fcc153fedabe27efa14e623d4d68445c048e0c11a.exe	92
PID 3096 wrote to memory of 668	3096	492614db175e9abe7f17468fcc153fedabe27efa14e623d4d68445c048e0c11a.exe	92
PID 3096 wrote to memory of 668	3096	492614db175e9abe7f17468fcc153fedabe27efa14e623d4d68445c048e0c11a.exe	92
PID 2128 wrote to memory of 4316	2128	Unicorn-60190.exe	93
PID 2128 wrote to memory of 4316	2128	Unicorn-60190.exe	93
PID 2128 wrote to memory of 4316	2128	Unicorn-60190.exe	93
PID 668 wrote to memory of 2032	668	Unicorn-24948.exe	95
PID 668 wrote to memory of 2032	668	Unicorn-24948.exe	95
PID 668 wrote to memory of 2032	668	Unicorn-24948.exe	95
PID 3096 wrote to memory of 1516	3096	492614db175e9abe7f17468fcc153fedabe27efa14e623d4d68445c048e0c11a.exe	96
PID 3096 wrote to memory of 1516	3096	492614db175e9abe7f17468fcc153fedabe27efa14e623d4d68445c048e0c11a.exe	96
PID 3096 wrote to memory of 1516	3096	492614db175e9abe7f17468fcc153fedabe27efa14e623d4d68445c048e0c11a.exe	96
PID 2128 wrote to memory of 628	2128	Unicorn-60190.exe	97
PID 2128 wrote to memory of 628	2128	Unicorn-60190.exe	97
PID 2128 wrote to memory of 628	2128	Unicorn-60190.exe	97
PID 4316 wrote to memory of 116	4316	Unicorn-44814.exe	98
PID 4316 wrote to memory of 116	4316	Unicorn-44814.exe	98
PID 4316 wrote to memory of 116	4316	Unicorn-44814.exe	98
PID 2032 wrote to memory of 2680	2032	Unicorn-13101.exe	101
PID 2032 wrote to memory of 2680	2032	Unicorn-13101.exe	101
PID 2032 wrote to memory of 2680	2032	Unicorn-13101.exe	101
PID 668 wrote to memory of 4024	668	Unicorn-24948.exe	102
PID 668 wrote to memory of 4024	668	Unicorn-24948.exe	102
PID 668 wrote to memory of 4024	668	Unicorn-24948.exe	102
PID 1516 wrote to memory of 1248	1516	Unicorn-52088.exe	103
PID 1516 wrote to memory of 1248	1516	Unicorn-52088.exe	103
PID 1516 wrote to memory of 1248	1516	Unicorn-52088.exe	103
PID 4316 wrote to memory of 1344	4316	Unicorn-44814.exe	104
PID 4316 wrote to memory of 1344	4316	Unicorn-44814.exe	104
PID 4316 wrote to memory of 1344	4316	Unicorn-44814.exe	104
PID 3096 wrote to memory of 1584	3096	492614db175e9abe7f17468fcc153fedabe27efa14e623d4d68445c048e0c11a.exe	105
PID 3096 wrote to memory of 1584	3096	492614db175e9abe7f17468fcc153fedabe27efa14e623d4d68445c048e0c11a.exe	105
PID 3096 wrote to memory of 1584	3096	492614db175e9abe7f17468fcc153fedabe27efa14e623d4d68445c048e0c11a.exe	105
PID 2128 wrote to memory of 4616	2128	Unicorn-60190.exe	106
PID 2128 wrote to memory of 4616	2128	Unicorn-60190.exe	106
PID 2128 wrote to memory of 4616	2128	Unicorn-60190.exe	106
PID 628 wrote to memory of 1360	628	Unicorn-46521.exe	107
PID 628 wrote to memory of 1360	628	Unicorn-46521.exe	107
PID 628 wrote to memory of 1360	628	Unicorn-46521.exe	107
PID 4024 wrote to memory of 2528	4024	Unicorn-64741.exe	108
PID 4024 wrote to memory of 2528	4024	Unicorn-64741.exe	108
PID 4024 wrote to memory of 2528	4024	Unicorn-64741.exe	108
PID 2680 wrote to memory of 2212	2680	Unicorn-49796.exe	109
PID 2680 wrote to memory of 2212	2680	Unicorn-49796.exe	109
PID 2680 wrote to memory of 2212	2680	Unicorn-49796.exe	109
PID 668 wrote to memory of 2912	668	Unicorn-24948.exe	110
PID 668 wrote to memory of 2912	668	Unicorn-24948.exe	110
PID 668 wrote to memory of 2912	668	Unicorn-24948.exe	110
PID 2032 wrote to memory of 1008	2032	Unicorn-13101.exe	111
PID 2032 wrote to memory of 1008	2032	Unicorn-13101.exe	111
PID 2032 wrote to memory of 1008	2032	Unicorn-13101.exe	111
PID 1248 wrote to memory of 3960	1248	Unicorn-2541.exe	113
PID 1248 wrote to memory of 3960	1248	Unicorn-2541.exe	113
PID 1248 wrote to memory of 3960	1248	Unicorn-2541.exe	113
PID 4616 wrote to memory of 4008	4616	Unicorn-41528.exe	112
PID 4616 wrote to memory of 4008	4616	Unicorn-41528.exe	112
PID 4616 wrote to memory of 4008	4616	Unicorn-41528.exe	112
PID 1516 wrote to memory of 1136	1516	Unicorn-52088.exe	114
PID 1516 wrote to memory of 1136	1516	Unicorn-52088.exe	114
PID 1516 wrote to memory of 1136	1516	Unicorn-52088.exe	114
PID 1584 wrote to memory of 4880	1584	Unicorn-47393.exe	115

C:\Users\Admin\AppData\Local\Temp\492614db175e9abe7f17468fcc153fedabe27efa14e623d4d68445c048e0c11a.exe
"C:\Users\Admin\AppData\Local\Temp\492614db175e9abe7f17468fcc153fedabe27efa14e623d4d68445c048e0c11a.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60190.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60190.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44814.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44814.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-849.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64252.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20388.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27570.exe
        7⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13501.exe
        8⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29628.exe
        9⤵
        
        PID:10368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52456.exe
        10⤵
        
        PID:13760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exe
        10⤵
        
        PID:17132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62034.exe
        10⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45637.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56825.exe
        8⤵
        
        PID:10388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59372.exe
        8⤵
        
        PID:16144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19292.exe
        7⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
        8⤵
        
        PID:13088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22511.exe
        7⤵
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49338.exe
        7⤵
        
        PID:16600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21030.exe
        7⤵
        
        PID:5644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3620.exe
        6⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54342.exe
        7⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39118.exe
        8⤵
        
        PID:11176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63280.exe
        8⤵
        
        PID:10220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33009.exe
        7⤵
        
        PID:11620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26893.exe
        7⤵
        
        PID:16184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45215.exe
        7⤵
        
        PID:7224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33027.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64132.exe
        7⤵
        
        PID:16340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46930.exe
        6⤵
        
        PID:10512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17579.exe
        6⤵
        
        PID:16716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16028.exe
        6⤵
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54933.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64326.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44420.exe
        7⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2183.exe
        8⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62824.exe
        9⤵
        
        PID:14872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        8⤵
        
        PID:13212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3890.exe
        7⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11385.exe
        7⤵
        
        PID:14028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41113.exe
        7⤵
        
        PID:17088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25706.exe
        6⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11119.exe
        7⤵
        
        PID:9240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56581.exe
        7⤵
        
        PID:14304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57946.exe
        7⤵
        
        PID:788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26621.exe
        6⤵
        
        PID:8448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22102.exe
        6⤵
        
        PID:15168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2111.exe
        5⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13501.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39118.exe
        7⤵
        
        PID:11184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57281.exe
        7⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3540.exe
        6⤵
        
        PID:10292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27275.exe
        6⤵
        
        PID:16320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13692.exe
        5⤵
        
        PID:6616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37552.exe
        6⤵
        
        PID:14248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9935.exe
        5⤵
        
        PID:32
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53251.exe
        5⤵
        
        PID:14896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10264.exe
        5⤵
        
        PID:17324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21968.exe
        5⤵
        
        PID:6004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58519.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27596.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47222.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50896.exe
        8⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-71.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-71.exe
        9⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15011.exe
        10⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12834.exe
        10⤵
        
        PID:12756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49007.exe
        9⤵
        
        PID:9384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60010.exe
        9⤵
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4116.exe
        9⤵
        
        PID:14808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        9⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14527.exe
        8⤵
        
        PID:8928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37173.exe
        8⤵
        
        PID:14060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6832.exe
        8⤵
        
        PID:10136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50429.exe
        7⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17944.exe
        8⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60328.exe
        9⤵
        
        PID:11888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55746.exe
        10⤵
        
        PID:15456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37691.exe
        10⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe
        9⤵
        
        PID:16620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57946.exe
        9⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11490.exe
        8⤵
        
        PID:10732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        8⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47776.exe
        7⤵
        
        PID:9036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37552.exe
        8⤵
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6498.exe
        8⤵
        
        PID:14788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52081.exe
        8⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50343.exe
        7⤵
        
        PID:15736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe
        7⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15680.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54980.exe
        7⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-71.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-71.exe
        8⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42622.exe
        9⤵
        
        PID:12780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65237.exe
        9⤵
        
        PID:17040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31307.exe
        9⤵
        
        PID:16636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33009.exe
        8⤵
        
        PID:11664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21512.exe
        9⤵
        
        PID:17284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52767.exe
        8⤵
        
        PID:15840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17049.exe
        8⤵
        
        PID:16656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45215.exe
        8⤵
        
        PID:17176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46895.exe
        7⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11319.exe
        8⤵
        
        PID:11880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24588.exe
        8⤵
        
        PID:15900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56144.exe
        7⤵
        
        PID:11848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29545.exe
        6⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60128.exe
        7⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe
        8⤵
        
        PID:15700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52985.exe
        7⤵
        
        PID:15768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10635.exe
        7⤵
        
        PID:17016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42698.exe
        7⤵
        
        PID:16836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31659.exe
        6⤵
        
        PID:9600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64925.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe
        6⤵
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54793.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35546.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        7⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28826.exe
        8⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11101.exe
        9⤵
        
        PID:14724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe
        9⤵
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        8⤵
        
        PID:13076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10386.exe
        8⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17625.exe
        7⤵
        
        PID:9512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17250.exe
        7⤵
        
        PID:13484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36291.exe
        7⤵
        
        PID:17328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55304.exe
        7⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        6⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36994.exe
        7⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10006.exe
        7⤵
        
        PID:15876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32871.exe
        6⤵
        
        PID:1512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33020.exe
        6⤵
        
        PID:15496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56282.exe
        6⤵
        
        PID:17100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41668.exe
        5⤵
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56926.exe
        6⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-71.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-71.exe
        7⤵
        
        PID:3436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-813.exe
        8⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44329.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17467.exe
        7⤵
        
        PID:10992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64251.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30366.exe
        6⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1947.exe
        7⤵
        
        PID:12936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21333.exe
        6⤵
        
        PID:11768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53197.exe
        6⤵
        
        PID:17248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-408.exe
        5⤵
        
        PID:6344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39708.exe
        6⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61122.exe
        7⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24038.exe
        7⤵
        
        PID:15720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42408.exe
        6⤵
        
        PID:11752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42044.exe
        5⤵
        
        PID:9772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33660.exe
        6⤵
        
        PID:14468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23160.exe
        5⤵
        
        PID:14744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3584.exe
        5⤵
        
        PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22643.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23848.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        6⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36994.exe
        7⤵
        
        PID:8840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33660.exe
        8⤵
        
        PID:14528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe
        8⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29170.exe
        7⤵
        
        PID:12384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32871.exe
        6⤵
        
        PID:2508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33020.exe
        6⤵
        
        PID:15816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35768.exe
        5⤵
        
        PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24119.exe
        5⤵
        
        PID:7312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56812.exe
        6⤵
        
        PID:9140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60686.exe
        7⤵
        
        PID:14856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44329.exe
        6⤵
        
        PID:14008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47858.exe
        6⤵
        
        PID:10200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38596.exe
        5⤵
        
        PID:8704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24662.exe
        6⤵
        
        PID:15944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4878.exe
        5⤵
        
        PID:14548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20807.exe
        5⤵
        
        PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17792.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52266.exe
        5⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36060.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8823.exe
        7⤵
        
        PID:9300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10478.exe
        7⤵
        
        PID:14500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37028.exe
        7⤵
        
        PID:556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34266.exe
        6⤵
        
        PID:10276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36814.exe
        6⤵
        
        PID:15980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19292.exe
        5⤵
        
        PID:8096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30152.exe
        6⤵
        
        PID:14832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20784.exe
        5⤵
        
        PID:12284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62063.exe
        5⤵
        
        PID:15428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26807.exe
      4⤵
      PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21670.exe
        5⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60128.exe
        6⤵
        
        PID:8776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23140.exe
        6⤵
        
        PID:2700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62444.exe
        6⤵
        
        PID:17364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12058.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11385.exe
        5⤵
        
        PID:12428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41113.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13692.exe
      4⤵
      PID:8104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
        5⤵
        
        PID:12792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
      4⤵
      PID:10328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32831.exe
      4⤵
      PID:16008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46521.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49365.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58130.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1721.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48566.exe
        7⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64648.exe
        8⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29402.exe
        9⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23140.exe
        9⤵
        
        PID:11192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12058.exe
        8⤵
        
        PID:9632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11385.exe
        8⤵
        
        PID:13868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        8⤵
        
        PID:10216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19292.exe
        7⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20784.exe
        7⤵
        
        PID:12276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47673.exe
        7⤵
        
        PID:10168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40952.exe
        6⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45935.exe
        7⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-224.exe
        8⤵
        
        PID:11144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60332.exe
        8⤵
        
        PID:3216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57130.exe
        7⤵
        
        PID:11072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39555.exe
        7⤵
        
        PID:15908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33027.exe
        6⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30152.exe
        7⤵
        
        PID:15032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44930.exe
        7⤵
        
        PID:16640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40245.exe
        6⤵
        
        PID:10532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46744.exe
        6⤵
        
        PID:16904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34310.exe
        6⤵
        
        PID:17008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20750.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26008.exe
        6⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36060.exe
        7⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36994.exe
        8⤵
        
        PID:8892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10006.exe
        8⤵
        
        PID:15892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62063.exe
        8⤵
        
        PID:10212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24502.exe
        7⤵
        
        PID:9436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24122.exe
        8⤵
        
        PID:15280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50816.exe
        8⤵
        
        PID:10140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60010.exe
        7⤵
        
        PID:13360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41065.exe
        7⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        7⤵
        
        PID:10128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19292.exe
        6⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2741.exe
        7⤵
        
        PID:14288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe
        7⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34379.exe
        6⤵
        
        PID:10344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37559.exe
        6⤵
        
        PID:16412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50604.exe
        5⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28276.exe
        6⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34254.exe
        7⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44329.exe
        7⤵
        
        PID:14100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45122.exe
        7⤵
        
        PID:16540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34808.exe
        6⤵
        
        PID:9316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60010.exe
        6⤵
        
        PID:11544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41065.exe
        6⤵
        
        PID:1456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41113.exe
        6⤵
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29163.exe
        5⤵
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39908.exe
        6⤵
        
        PID:12464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4661.exe
        6⤵
        
        PID:15644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52576.exe
        5⤵
        
        PID:10644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26837.exe
        5⤵
        
        PID:14900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13105.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22334.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11617.exe
        6⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23616.exe
        7⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45930.exe
        8⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50359.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19051.exe
        8⤵
        
        PID:640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19492.exe
        7⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36466.exe
        7⤵
        
        PID:1236
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1236 -s 464
        8⤵
        Program crash
        
        PID:14424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19108.exe
        7⤵
        
        PID:17296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19292.exe
        6⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46296.exe
        7⤵
        
        PID:15136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60910.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55841.exe
        6⤵
        
        PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59427.exe
        5⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31784.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56812.exe
        7⤵
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44329.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20425.exe
        7⤵
        
        PID:16680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45694.exe
        7⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33882.exe
        6⤵
        
        PID:9596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24213.exe
        6⤵
        
        PID:14536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57427.exe
        6⤵
        
        PID:16516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32745.exe
        6⤵
        
        PID:468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33027.exe
        5⤵
        
        PID:8036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25518.exe
        6⤵
        
        PID:12304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43556.exe
        6⤵
        
        PID:16924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46930.exe
        5⤵
        
        PID:10632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40750.exe
        5⤵
        
        PID:17132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1456.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48566.exe
        5⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36060.exe
        6⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
        7⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43520.exe
        8⤵
        
        PID:14448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25901.exe
        8⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        7⤵
        
        PID:13276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49281.exe
        7⤵
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36754.exe
        6⤵
        
        PID:9368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60010.exe
        6⤵
        
        PID:10272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49281.exe
        6⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19292.exe
        5⤵
        
        PID:8112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4329.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55725.exe
        6⤵
        
        PID:12456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13627.exe
        6⤵
        
        PID:16672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4879.exe
        6⤵
        
        PID:10184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44494.exe
        5⤵
        
        PID:10484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62281.exe
        5⤵
        
        PID:14900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51888.exe
      4⤵
      PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13501.exe
        5⤵
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15203.exe
        6⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12061.exe
        7⤵
        
        PID:14772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62881.exe
        7⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46275.exe
        6⤵
        
        PID:12984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20233.exe
        6⤵
        
        PID:16924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18043.exe
        5⤵
        
        PID:11196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38456.exe
        5⤵
        
        PID:15900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62281.exe
        5⤵
        
        PID:10100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13692.exe
      4⤵
      PID:7968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41854.exe
        5⤵
        
        PID:12108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11497.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24078.exe
      4⤵
      PID:16632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40250.exe
      4⤵
      PID:5752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41528.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41528.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44534.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11259.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51882.exe
        6⤵
        
        PID:1056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12541.exe
        7⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60948.exe
        8⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15203.exe
        9⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44329.exe
        9⤵
        
        PID:13992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39668.exe
        9⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        9⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37966.exe
        8⤵
        
        PID:9576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47704.exe
        8⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19292.exe
        7⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35824.exe
        8⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49949.exe
        7⤵
        
        PID:12148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60220.exe
        7⤵
        
        PID:16536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-104.exe
        7⤵
        
        PID:17052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19894.exe
        6⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48670.exe
        7⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15211.exe
        8⤵
        
        PID:11784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50053.exe
        9⤵
        
        PID:17360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7292.exe
        8⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46301.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37172.exe
        7⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3396.exe
        7⤵
        
        PID:952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31247.exe
        6⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13960.exe
        6⤵
        
        PID:12312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27547.exe
        6⤵
        
        PID:15496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-104.exe
        6⤵
        
        PID:17040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20148.exe
        5⤵
        
        PID:4004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4949.exe
        6⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63636.exe
        7⤵
        
        PID:8856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2741.exe
        8⤵
        
        PID:14240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60359.exe
        8⤵
        
        PID:16424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43913.exe
        8⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10006.exe
        7⤵
        
        PID:15728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6832.exe
        7⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3890.exe
        6⤵
        
        PID:9548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23637.exe
        6⤵
        
        PID:13180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        6⤵
        
        PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11839.exe
        5⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19288.exe
        6⤵
        
        PID:9200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44329.exe
        6⤵
        
        PID:14000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57946.exe
        6⤵
        
        PID:5040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1760.exe
        5⤵
        
        PID:9700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13437.exe
        5⤵
        
        PID:15196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16028.exe
        5⤵
        
        PID:1036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34372.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34372.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63942.exe
        5⤵
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10403.exe
        6⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32142.exe
        7⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53094.exe
        8⤵
        
        PID:15284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32294.exe
        7⤵
        
        PID:11352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23734.exe
        6⤵
        
        PID:9164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8095.exe
        6⤵
        
        PID:10620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36213.exe
        6⤵
        
        PID:17356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58789.exe
        5⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2183.exe
        6⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6825.exe
        7⤵
        
        PID:14216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60359.exe
        7⤵
        
        PID:17396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52081.exe
        7⤵
        
        PID:112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10006.exe
        6⤵
        
        PID:15868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62742.exe
        5⤵
        
        PID:9396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-338.exe
        5⤵
        
        PID:12532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24577.exe
        5⤵
        
        PID:5032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33883.exe
      4⤵
      PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8841.exe
        5⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18738.exe
        6⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2528.exe
        7⤵
        
        PID:12084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20644.exe
        7⤵
        
        PID:17280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16560.exe
        6⤵
        
        PID:9128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56632.exe
        6⤵
        
        PID:16020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6054.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38538.exe
        6⤵
        
        PID:12820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65237.exe
        6⤵
        
        PID:17048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62034.exe
        6⤵
        
        PID:17024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40000.exe
        5⤵
        
        PID:12244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19196.exe
        5⤵
        
        PID:13948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24577.exe
        5⤵
        
        PID:64
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9728.exe
      4⤵
      PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3527.exe
        5⤵
        
        PID:9348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46275.exe
        5⤵
        
        PID:13128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35200.exe
        5⤵
        
        PID:17200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10007.exe
      4⤵
      PID:9568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51840.exe
      4⤵
      PID:15632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52437.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52437.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54238.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe
        5⤵
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31592.exe
        6⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2183.exe
        7⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2528.exe
        7⤵
        
        PID:11960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30347.exe
        7⤵
        
        PID:17376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49007.exe
        6⤵
        
        PID:9412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60010.exe
        6⤵
        
        PID:13340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41065.exe
        6⤵
        
        PID:16416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        6⤵
        
        PID:5620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-626.exe
        5⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20064.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57946.exe
        6⤵
        
        PID:3704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25827.exe
        5⤵
        
        PID:10852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20504.exe
        5⤵
        
        PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9842.exe
      4⤵
      PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23424.exe
        5⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53330.exe
        6⤵
        
        PID:8988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12834.exe
        6⤵
        
        PID:12696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26448.exe
        5⤵
        
        PID:9668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11385.exe
        5⤵
        
        PID:12768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24584.exe
        5⤵
        
        PID:5664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1341.exe
      4⤵
      PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63636.exe
        5⤵
        
        PID:8812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
        6⤵
        
        PID:13008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23715.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2528.exe
        5⤵
        
        PID:11680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30347.exe
        5⤵
        
        PID:16448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23491.exe
      4⤵
      PID:9500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20837.exe
      4⤵
      PID:13560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-610.exe
      4⤵
      PID:17208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21379.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21379.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62572.exe
      4⤵
      PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19340.exe
        5⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64814.exe
        6⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64002.exe
        7⤵
        
        PID:14332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60359.exe
        7⤵
        
        PID:15828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64333.exe
        7⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39092.exe
        6⤵
        
        PID:12564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11290.exe
        5⤵
        
        PID:8256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65346.exe
        6⤵
        
        PID:14084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8095.exe
        5⤵
        
        PID:13496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55304.exe
        5⤵
        
        PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15513.exe
      4⤵
      PID:7268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35584.exe
        5⤵
        
        PID:13568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4857.exe
        5⤵
        
        PID:16768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14562.exe
      4⤵
      PID:10872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14745.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24826.exe
      4⤵
      PID:17008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57527.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57527.exe
    3⤵
    PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45935.exe
      4⤵
      PID:7784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18044.exe
        5⤵
        
        PID:12636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36291.exe
        5⤵
        
        PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7089.exe
        5⤵
        
        PID:3304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57130.exe
      4⤵
      PID:11100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35421.exe
      4⤵
      PID:17052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30758.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30758.exe
    3⤵
    PID:8088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50790.exe
      4⤵
      PID:12840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57069.exe
      4⤵
      PID:16952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10579.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10579.exe
    3⤵
    PID:10316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12236.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12236.exe
    3⤵
    PID:16528
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24948.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24948.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13101.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13101.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49796.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64954.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56952.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19018.exe
        7⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-97.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-97.exe
        8⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-71.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-71.exe
        9⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53906.exe
        10⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39974.exe
        10⤵
        
        PID:14052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38700.exe
        9⤵
        
        PID:9528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11385.exe
        9⤵
        
        PID:13580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44957.exe
        9⤵
        
        PID:16468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41113.exe
        9⤵
        
        PID:10112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14527.exe
        8⤵
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25637.exe
        8⤵
        
        PID:13040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51668.exe
        8⤵
        
        PID:17172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58789.exe
        7⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36994.exe
        8⤵
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9539.exe
        9⤵
        
        PID:15068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        8⤵
        
        PID:13068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54468.exe
        8⤵
        
        PID:17144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38238.exe
        7⤵
        
        PID:9428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-338.exe
        7⤵
        
        PID:11344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32399.exe
        7⤵
        
        PID:17380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32745.exe
        7⤵
        
        PID:1824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9842.exe
        6⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21478.exe
        7⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32142.exe
        8⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15980.exe
        9⤵
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19736.exe
        9⤵
        
        PID:16864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32294.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49281.exe
        8⤵
        
        PID:244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13428.exe
        7⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8095.exe
        7⤵
        
        PID:12632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54495.exe
        7⤵
        
        PID:15508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62986.exe
        6⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35658.exe
        7⤵
        
        PID:10500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45637.exe
        7⤵
        
        PID:16156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5050.exe
        6⤵
        
        PID:10932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11839.exe
        6⤵
        
        PID:15392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8306.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29708.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16988.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43050.exe
        7⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11153.exe
        8⤵
        
        PID:10464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37468.exe
        8⤵
        
        PID:16096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50909.exe
        7⤵
        
        PID:13156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10443.exe
        7⤵
        
        PID:17308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44102.exe
        6⤵
        
        PID:7700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14946.exe
        6⤵
        
        PID:11632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1123.exe
        6⤵
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-514.exe
        6⤵
        
        PID:16700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4725.exe
        6⤵
        
        PID:17384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54304.exe
        5⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64648.exe
        6⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
        7⤵
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        7⤵
        
        PID:13024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49007.exe
        6⤵
        
        PID:9404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60010.exe
        6⤵
        
        PID:12220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        6⤵
        
        PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38893.exe
        5⤵
        
        PID:7996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15403.exe
        6⤵
        
        PID:10808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        6⤵
        
        PID:17200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61121.exe
        5⤵
        
        PID:12256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20838.exe
        5⤵
        
        PID:6828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53257.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5037.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21156.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39184.exe
        7⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59386.exe
        8⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43224.exe
        9⤵
        
        PID:11648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39388.exe
        9⤵
        
        PID:15764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33009.exe
        8⤵
        
        PID:11608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52767.exe
        8⤵
        
        PID:14900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16754.exe
        8⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30558.exe
        7⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19270.exe
        8⤵
        
        PID:14428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
        8⤵
        
        PID:16656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe
        8⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63352.exe
        7⤵
        
        PID:11212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23411.exe
        7⤵
        
        PID:15592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34781.exe
        6⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7035.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44329.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32487.exe
        6⤵
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17214.exe
        7⤵
        
        PID:16556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47218.exe
        6⤵
        
        PID:15580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27740.exe
        5⤵
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32770.exe
        6⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45380.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36618.exe
        8⤵
        
        PID:11052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24038.exe
        8⤵
        
        PID:15796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16560.exe
        7⤵
        
        PID:10252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45215.exe
        7⤵
        
        PID:10176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6054.exe
        6⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36400.exe
        7⤵
        
        PID:12888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30426.exe
        7⤵
        
        PID:16964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15303.exe
        6⤵
        
        PID:10508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32399.exe
        6⤵
        
        PID:17296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12133.exe
        6⤵
        
        PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60080.exe
        5⤵
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11721.exe
        6⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46296.exe
        7⤵
        
        PID:15128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe
        6⤵
        
        PID:7812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30731.exe
        6⤵
        
        PID:16776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43335.exe
        5⤵
        
        PID:9156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15980.exe
        6⤵
        
        PID:12588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51365.exe
        5⤵
        
        PID:14280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18347.exe
        5⤵
        
        PID:16608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5129.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12987.exe
        5⤵
        
        PID:4684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22116.exe
        6⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34882.exe
        7⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6685.exe
        8⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10478.exe
        8⤵
        
        PID:14388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35776.exe
        8⤵
        
        PID:17396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33009.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9788.exe
        7⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10827.exe
        7⤵
        
        PID:16664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45215.exe
        7⤵
        
        PID:17252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14527.exe
        6⤵
        
        PID:8920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50343.exe
        6⤵
        
        PID:15860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16147.exe
        6⤵
        
        PID:4688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34781.exe
        5⤵
        
        PID:7288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3527.exe
        6⤵
        
        PID:9292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46275.exe
        6⤵
        
        PID:12700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20233.exe
        6⤵
        
        PID:17012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57946.exe
        6⤵
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8558.exe
        5⤵
        
        PID:9620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21413.exe
        5⤵
        
        PID:14464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16440.exe
        5⤵
        
        PID:17032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55509.exe
      4⤵
      PID:376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59412.exe
        5⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64814.exe
        6⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59472.exe
        7⤵
        
        PID:15788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4879.exe
        7⤵
        
        PID:16844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39092.exe
        6⤵
        
        PID:12544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33471.exe
        6⤵
        
        PID:16852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16224.exe
        6⤵
        
        PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11290.exe
        5⤵
        
        PID:8044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8095.exe
        5⤵
        
        PID:3572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36213.exe
        5⤵
        
        PID:17404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4187.exe
      4⤵
      PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60128.exe
        5⤵
        
        PID:8796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53867.exe
        5⤵
        
        PID:7824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62444.exe
        5⤵
        
        PID:17344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6458.exe
      4⤵
      PID:9608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21367.exe
      4⤵
      PID:13152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15291.exe
      4⤵
      PID:16480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63786.exe
      4⤵
      PID:17272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64741.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64741.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30144.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33818.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53444.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20362.exe
        7⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-71.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-71.exe
        8⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-224.exe
        9⤵
        
        PID:11136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19875.exe
        9⤵
        
        PID:16152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43394.exe
        8⤵
        
        PID:11156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7319.exe
        8⤵
        
        PID:16780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55304.exe
        8⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14527.exe
        7⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32435.exe
        7⤵
        
        PID:12620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27547.exe
        7⤵
        
        PID:16428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41643.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24808.exe
        6⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-71.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-71.exe
        7⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7035.exe
        8⤵
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44926.exe
        9⤵
        
        PID:14088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe
        9⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44329.exe
        8⤵
        
        PID:14124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57946.exe
        8⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24265.exe
        7⤵
        
        PID:11232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36509.exe
        7⤵
        
        PID:15596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12286.exe
        7⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20392.exe
        6⤵
        
        PID:8584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16940.exe
        7⤵
        
        PID:14320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12994.exe
        7⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16971.exe
        6⤵
        
        PID:13016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35132.exe
        6⤵
        
        PID:17160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2852.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65286.exe
        6⤵
        
        PID:4372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63086.exe
        7⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12497.exe
        8⤵
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13627.exe
        8⤵
        
        PID:16520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16944.exe
        8⤵
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12092.exe
        7⤵
        
        PID:10888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14639.exe
        7⤵
        
        PID:15484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9562.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9757.exe
        7⤵
        
        PID:12960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64333.exe
        7⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55376.exe
        6⤵
        
        PID:10648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49811.exe
        6⤵
        
        PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3733.exe
        5⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63086.exe
        6⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15403.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57946.exe
        7⤵
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33009.exe
        6⤵
        
        PID:11584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9788.exe
        6⤵
        
        PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38893.exe
        5⤵
        
        PID:8004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56654.exe
        6⤵
        
        PID:10736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-904.exe
        6⤵
        
        PID:15492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61751.exe
        6⤵
        
        PID:10164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31579.exe
        5⤵
        
        PID:10404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35415.exe
        5⤵
        
        PID:10152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48763.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2105.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46812.exe
        6⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-71.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-71.exe
        7⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48076.exe
        8⤵
        
        PID:11676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17686.exe
        8⤵
        
        PID:14136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20233.exe
        8⤵
        
        PID:17208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57946.exe
        8⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6367.exe
        7⤵
        
        PID:11504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52767.exe
        7⤵
        
        PID:15524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6832.exe
        7⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14527.exe
        6⤵
        
        PID:8592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50343.exe
        6⤵
        
        PID:15744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15810.exe
        5⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55468.exe
        6⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26800.exe
        7⤵
        
        PID:15808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        6⤵
        
        PID:13060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18698.exe
        6⤵
        
        PID:17128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32871.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42788.exe
        6⤵
        
        PID:14112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7563.exe
        5⤵
        
        PID:15620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58814.exe
        5⤵
        
        PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4143.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7917.exe
        5⤵
        
        PID:4412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-71.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-71.exe
        6⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43224.exe
        7⤵
        
        PID:11556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17903.exe
        7⤵
        
        PID:15524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37094.exe
        6⤵
        
        PID:11528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9788.exe
        6⤵
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17049.exe
        6⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30638.exe
        6⤵
        
        PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7808.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19488.exe
        6⤵
        
        PID:12200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64551.exe
        6⤵
        
        PID:16920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9081.exe
        5⤵
        
        PID:11684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28692.exe
        5⤵
        
        PID:16440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11544.exe
      4⤵
      PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-71.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-71.exe
        5⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39140.exe
        6⤵
        
        PID:11740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42102.exe
        6⤵
        
        PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39118.exe
        5⤵
        
        PID:11168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19875.exe
        5⤵
        
        PID:15588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24577.exe
        5⤵
        
        PID:1944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41302.exe
      4⤵
      PID:7452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28232.exe
        5⤵
        
        PID:12524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16913.exe
        5⤵
        
        PID:5720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1998.exe
      4⤵
      PID:11728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18757.exe
      4⤵
      PID:14424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45503.exe
      4⤵
      PID:5148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1455.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1455.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42562.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9287.exe
        5⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47544.exe
        6⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20684.exe
        7⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60328.exe
        8⤵
        
        PID:11896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35200.exe
        8⤵
        
        PID:15528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20644.exe
        7⤵
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45215.exe
        7⤵
        
        PID:10116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6054.exe
        6⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38704.exe
        7⤵
        
        PID:12484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5704.exe
        7⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40000.exe
        6⤵
        
        PID:11436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1341.exe
        6⤵
        
        PID:15712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59637.exe
        6⤵
        
        PID:17032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29038.exe
        6⤵
        
        PID:16600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39634.exe
        5⤵
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56244.exe
        6⤵
        
        PID:12292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20233.exe
        6⤵
        
        PID:17188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18070.exe
        5⤵
        
        PID:10804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8715.exe
        5⤵
        
        PID:15268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63145.exe
        5⤵
        
        PID:16876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28280.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32400.exe
      4⤵
      PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13501.exe
        5⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36994.exe
        6⤵
        
        PID:8848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29170.exe
        6⤵
        
        PID:12344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3705.exe
        6⤵
        
        PID:17388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25635.exe
        5⤵
        
        PID:9392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49996.exe
        6⤵
        
        PID:14408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe
        6⤵
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16228.exe
        5⤵
        
        PID:15600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30761.exe
        5⤵
        
        PID:17376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10469.exe
      4⤵
      PID:8028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62684.exe
        5⤵
        
        PID:10900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-904.exe
        5⤵
        
        PID:15528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37172.exe
        5⤵
        
        PID:16132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12119.exe
      4⤵
      PID:12264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17836.exe
      4⤵
      PID:13760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13890.exe
      4⤵
      PID:15336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36921.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36921.exe
    3⤵
    PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20170.exe
      4⤵
      PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-71.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-71.exe
        5⤵
        
        PID:7172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-813.exe
        6⤵
        
        PID:9280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13602.exe
        6⤵
        
        PID:14188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45698.exe
        6⤵
        
        PID:16856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18859.exe
        6⤵
        
        PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2580.exe
        5⤵
        
        PID:8568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16237.exe
        5⤵
        
        PID:15148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41833.exe
        5⤵
        
        PID:17008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14527.exe
      4⤵
      PID:8936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12061.exe
        5⤵
        
        PID:14740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10883.exe
        5⤵
        
        PID:3652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50343.exe
      4⤵
      PID:15884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20838.exe
      4⤵
      PID:16916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27376.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27376.exe
    3⤵
    PID:5396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60948.exe
      4⤵
      PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42046.exe
        5⤵
        
        PID:12352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35200.exe
        5⤵
        
        PID:15640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45694.exe
        5⤵
        
        PID:3112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50987.exe
      4⤵
      PID:10960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14639.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30758.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30758.exe
    3⤵
    PID:8072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15185.exe
      4⤵
      PID:14456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41775.exe
      4⤵
      PID:6088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10579.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10579.exe
    3⤵
    PID:10680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47916.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47916.exe
    3⤵
    PID:16296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47430.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47430.exe
    3⤵
    PID:16676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33483.exe
    3⤵
    PID:16404
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52088.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52088.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2541.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2541.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44534.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48784.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54404.exe
        6⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36060.exe
        7⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36994.exe
        8⤵
        
        PID:9084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16918.exe
        8⤵
        
        PID:12448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34431.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        8⤵
        
        PID:10204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55805.exe
        7⤵
        
        PID:9716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13331.exe
        7⤵
        
        PID:13084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        7⤵
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19292.exe
        6⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5097.exe
        7⤵
        
        PID:12332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe
        7⤵
        
        PID:16612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43556.exe
        7⤵
        
        PID:16380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12205.exe
        6⤵
        
        PID:10780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40568.exe
        5⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36060.exe
        6⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64980.exe
        7⤵
        
        PID:9332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46275.exe
        7⤵
        
        PID:12996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54495.exe
        6⤵
        
        PID:9804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59975.exe
        6⤵
        
        PID:15824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49811.exe
        6⤵
        
        PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33027.exe
        5⤵
        
        PID:8080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15211.exe
        6⤵
        
        PID:11792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7292.exe
        6⤵
        
        PID:15496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18859.exe
        6⤵
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46930.exe
        5⤵
        
        PID:10776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40750.exe
        5⤵
        
        PID:10192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37086.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47606.exe
        5⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64456.exe
        6⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18712.exe
        7⤵
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        7⤵
        
        PID:13052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58552.exe
        7⤵
        
        PID:17112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37173.exe
        7⤵
        
        PID:17156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31281.exe
        6⤵
        
        PID:9264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26173.exe
        6⤵
        
        PID:17292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49251.exe
        5⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56812.exe
        6⤵
        
        PID:7752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44329.exe
        6⤵
        
        PID:14016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18859.exe
        6⤵
        
        PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41396.exe
        5⤵
        
        PID:7248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30079.exe
        5⤵
        
        PID:14560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49811.exe
        5⤵
        
        PID:856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46136.exe
      4⤵
      PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23232.exe
        5⤵
        
        PID:6308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60730.exe
        6⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1568.exe
        6⤵
        
        PID:11552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52138.exe
        6⤵
        
        PID:16632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38622.exe
        5⤵
        
        PID:9808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9466.exe
        5⤵
        
        PID:14760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55342.exe
        5⤵
        
        PID:16652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8049.exe
        5⤵
        
        PID:5568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20226.exe
      4⤵
      PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-813.exe
        5⤵
        
        PID:8696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35968.exe
        5⤵
        
        PID:14260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8557.exe
        5⤵
        
        PID:16376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57946.exe
        5⤵
        
        PID:2444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44242.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43520.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62439.exe
      4⤵
      PID:15180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33698.exe
      4⤵
      PID:17208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63563.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63563.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22142.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17456.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36060.exe
        6⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63636.exe
        7⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55040.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43913.exe
        8⤵
        
        PID:17316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        7⤵
        
        PID:13228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55805.exe
        6⤵
        
        PID:9724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52985.exe
        6⤵
        
        PID:15776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62063.exe
        6⤵
        
        PID:10144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46432.exe
        5⤵
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56244.exe
        6⤵
        
        PID:12128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45201.exe
        6⤵
        
        PID:16496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-748.exe
        5⤵
        
        PID:12364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-898.exe
        5⤵
        
        PID:17048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-610.exe
        5⤵
        
        PID:3892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43168.exe
      4⤵
      PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-71.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-71.exe
        5⤵
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6685.exe
        6⤵
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10478.exe
        6⤵
        
        PID:14620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2361.exe
        6⤵
        
        PID:16504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33009.exe
        5⤵
        
        PID:11512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9788.exe
        5⤵
        
        PID:14904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10827.exe
        5⤵
        
        PID:16596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45215.exe
        5⤵
        
        PID:10108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49967.exe
      4⤵
      PID:7468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54106.exe
        5⤵
        
        PID:11696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7292.exe
        5⤵
        
        PID:15764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4879.exe
        5⤵
        
        PID:8712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45176.exe
      4⤵
      PID:11576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11357.exe
      4⤵
      PID:16648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26173.exe
      4⤵
      PID:16476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60936.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60936.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52266.exe
      4⤵
      PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13501.exe
        5⤵
        
        PID:6844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36994.exe
        6⤵
        
        PID:8560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        6⤵
        
        PID:13220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62444.exe
        6⤵
        
        PID:17328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3890.exe
        5⤵
        
        PID:9492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11385.exe
        5⤵
        
        PID:12628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49281.exe
        5⤵
        
        PID:4128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62271.exe
      4⤵
      PID:8020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5097.exe
        5⤵
        
        PID:12376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20233.exe
        5⤵
        
        PID:1236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4661.exe
        5⤵
        
        PID:1260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20784.exe
      4⤵
      PID:10640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53703.exe
      4⤵
      PID:5736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-662.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-662.exe
    3⤵
    PID:5384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60517.exe
      4⤵
      PID:7508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7035.exe
        5⤵
        
        PID:8496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44329.exe
        5⤵
        
        PID:13976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4879.exe
        5⤵
        
        PID:17212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47618.exe
      4⤵
      PID:8476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50838.exe
      4⤵
      PID:6028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5915.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5915.exe
    3⤵
    PID:7516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41754.exe
      4⤵
      PID:11920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45175.exe
      4⤵
      PID:14496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30607.exe
      4⤵
      PID:7224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37794.exe
    3⤵
    PID:11080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58062.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58062.exe
    3⤵
    PID:14120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39615.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39615.exe
    3⤵
    PID:16428
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47393.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47393.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17892.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17892.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30310.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62572.exe
        5⤵
        
        PID:388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47544.exe
        6⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25920.exe
        7⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9736.exe
        7⤵
        
        PID:11736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42016.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8095.exe
        6⤵
        
        PID:12400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63641.exe
        5⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62876.exe
        6⤵
        
        PID:10712
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5160 -s 652
        6⤵
        Program crash
        
        PID:15640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64722.exe
        5⤵
        
        PID:10920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20504.exe
        5⤵
        
        PID:14780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63127.exe
      4⤵
      PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13501.exe
        5⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2183.exe
        6⤵
        
        PID:8864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12834.exe
        6⤵
        
        PID:12748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48630.exe
        6⤵
        
        PID:6712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25635.exe
        5⤵
        
        PID:9172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49556.exe
        5⤵
        
        PID:16132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-322.exe
        5⤵
        
        PID:17184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59764.exe
        5⤵
        
        PID:17152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33027.exe
      4⤵
      PID:8064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9373.exe
        5⤵
        
        PID:12212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45393.exe
        5⤵
        
        PID:17212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52081.exe
        5⤵
        
        PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46930.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50838.exe
      4⤵
      PID:5524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63729.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63729.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40014.exe
      4⤵
      PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9417.exe
        5⤵
        
        PID:6712
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6712 -s 640
        6⤵
        Program crash
        
        PID:10364
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6712 -s 640
        6⤵
        Program crash
        
        PID:14900
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 728
        5⤵
        Program crash
        
        PID:9536
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2536 -s 768
        5⤵
        Program crash
        
        PID:10300
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 740
      4⤵
      Program crash
      PID:7752
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2700 -s 748
      4⤵
      Program crash
      PID:9228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54304.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54304.exe
    3⤵
    PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28276.exe
      4⤵
      PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15980.exe
        5⤵
        
        PID:12512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38402.exe
        5⤵
        
        PID:16640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4661.exe
        5⤵
        
        PID:17136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33009.exe
      4⤵
      PID:11492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52767.exe
      4⤵
      PID:16348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8049.exe
      4⤵
      PID:5668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21649.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21649.exe
    3⤵
    PID:8336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13457.exe
      4⤵
      PID:12012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33492.exe
    3⤵
    PID:12552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15291.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15291.exe
    3⤵
    PID:15080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45503.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45503.exe
    3⤵
    PID:2684
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54654.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54654.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38238.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38238.exe
    3⤵
    PID:1288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63688.exe
      4⤵
      PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34882.exe
        5⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17760.exe
        6⤵
        
        PID:10656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-904.exe
        6⤵
        
        PID:15472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
        6⤵
        
        PID:8248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6367.exe
        5⤵
        
        PID:11600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9788.exe
        5⤵
        
        PID:15968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46895.exe
      4⤵
      PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63556.exe
        5⤵
        
        PID:16048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54931.exe
        5⤵
        
        PID:17208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62034.exe
        5⤵
        
        PID:16668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53046.exe
      4⤵
      PID:11124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30671.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11972.exe
      4⤵
      PID:15500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33629.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33629.exe
    3⤵
    PID:6156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6057.exe
        5⤵
        
        PID:13100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16612.exe
        5⤵
        
        PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11490.exe
      4⤵
      PID:10540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37172.exe
      4⤵
      PID:16292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61751.exe
      4⤵
      PID:10092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37113.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37113.exe
    3⤵
    PID:9104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30884.exe
      4⤵
      PID:15852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14967.exe
      4⤵
      PID:4812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5295.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5295.exe
    3⤵
    PID:12360
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41600.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41600.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52266.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52266.exe
    3⤵
    PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3532.exe
      4⤵
      PID:8180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44494.exe
      4⤵
      PID:10448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8809.exe
      4⤵
      PID:2156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19292.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19292.exe
    3⤵
    PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60686.exe
      4⤵
      PID:15040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49778.exe
      4⤵
      PID:10200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12205.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12205.exe
    3⤵
    PID:11128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17380.exe
    3⤵
    PID:3016
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13139.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13139.exe
  2⤵
  PID:5368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9417.exe
    3⤵
    PID:6828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60128.exe
      4⤵
      PID:8724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65180.exe
        5⤵
        
        PID:12800
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6828 -s 600
      4⤵
      Program crash
      PID:10380
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6828 -s 644
      4⤵
      Program crash
      PID:15084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12058.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12058.exe
    3⤵
    PID:9624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11385.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11385.exe
    3⤵
    PID:13944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49281.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49281.exe
    3⤵
    PID:3980
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9227.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9227.exe
  2⤵
  PID:7956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
    3⤵
    PID:13032
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5244.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5244.exe
  2⤵
  PID:10336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2700 -ip 2700
1⤵
PID:7816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 2700 -ip 2700
1⤵
PID:8436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2536 -ip 2536
1⤵
PID:9392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 6712 -ip 6712
1⤵
PID:10752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 584 -p 2536 -ip 2536
1⤵
PID:12084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 6828 -ip 6828
1⤵
PID:12176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 6712 -ip 6712
1⤵
PID:14116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 6828 -ip 6828
1⤵
PID:14380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5160 -ip 5160
1⤵
PID:14720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 592 -p 8796 -ip 8796
1⤵
PID:4936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 648 -p 8796 -ip 8796
1⤵
PID:16692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 656 -p 8820 -ip 8820
1⤵
PID:10120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-13101.exe

Filesize
468KB

MD5
f40a5f0dba2faad541c529108f01e99b

SHA1
eed28e3c8a4d9c94dbf3126ffac6c1e37658803b

SHA256
779419de9d651d8433c119dd8b650de8becb6e28842260c45401c2af7302ac17

SHA512
476132f5c42a630c4cae974a5960f18852608e6049c802f51862b8813fb9367fe00b54961bda935f306da61dd965647ce642f6fd26ca3bbf2254aa8486fa784a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13105.exe

Filesize
468KB

MD5
722c838f08cabf65b2e3d07f7bbc2825

SHA1
c8c6988a9907e80048f45099baacac7f8028f619

SHA256
e19f4d5d44b9e6d74e670040ca9d662bdc881ae2785a7eafb5dfdf51871f2ccf

SHA512
29c6752570ef2f056ded1a85b6843b3c881f6378b04cd892c1573c9d91296d25f4c15883e2d8d98a931a48f74797071319906273b789e9a069b15488573f7606

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1455.exe

Filesize
468KB

MD5
8a2762fa484eb0b640a0b990db2705a9

SHA1
8a466b666536b8347feb8b867ad0fe8cf7376c17

SHA256
afadc05fe4abe849aefca38c297d15a81b694f61492eeb8cfbc42f30882ee9ba

SHA512
94379bee2cd7588e946d871e684e4c885a7ac63aeae48989ef8a897edc0ec64c3eb08871e56715d5d829cdfe3790abfa7b17f3e4382825cf0d36af680648231e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17892.exe

Filesize
468KB

MD5
29a3908276caf4ebbdfb5aa33b687dab

SHA1
c9a74627cd31a299e2f2998d9097c6b6869f3568

SHA256
c203677e64ef56b9b541d21e61472a684a961bc0e7a450af5b43a6b803a4cb58

SHA512
1d0b4a07efe0a57c74c68a6e66ccaaecd4b3aaec949a6fb7d102937ade128f57edcb04d40525e2efabc2eb53fc8ce8ea9faa8be05f65be12ea663139d48f19a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22643.exe

Filesize
468KB

MD5
ebd4e34f7f901a109ecf207b53180e57

SHA1
b792655922d2d0c90f90f21db222a296a9fed6b6

SHA256
0f159905b1e81cea72f59bc4438172d5892b92d362563403b0a871d5be7606fa

SHA512
33b189cd92c7694b1a97340017a1beff89956d653d30ad655e7605448985978972fc1248992fb2490f577b1cef4f8c4711707f667c12f3558d150ff7cddb95cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24317.exe

Filesize
468KB

MD5
b055c11917032341ecd3174aa8729577

SHA1
0950cf8115358678bac2bbe9340aeda414c341d7

SHA256
67fcebc0fa20a6176961bc08bc5704c912f7858c99678d59cc26de67589710e1

SHA512
f0a4d6817795bbab598b1e2b99b1b3da59acc152f7a1a98e4a80aabc249962f7b1873442c077d6a544332aa5fd7ebdd97e3e474a194ee301219c99ce4b11b7e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24948.exe

Filesize
468KB

MD5
c554f4e97e22c7b3a1adbbaa5a267c4c

SHA1
fde40c86e972e6fba07c69878221496ba3a28749

SHA256
419f1038983e928f3e700703be5e30ffe67457765e105e9c48c9db039f0a8ab6

SHA512
a83fb4f81eb049893f0494a6619ddd85aaa78b845b53c1ed0a1a64d39dd26d1fdf69e66f191717ce99d012d5afefa93ed2a39871cbc9275c8bba27329bda5b7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2541.exe

Filesize
468KB

MD5
9c7de4583ecee64e3e989fbf9cdca640

SHA1
4d84c2e1c2f627b6bd404820d20205a3f2f5c43a

SHA256
6962a3a7d6b0130014dc44b6c4c666cb4d60e146be607ab108271b0ff3e7639b

SHA512
48889e5ac2866eb579d2dce07729d0a6188b8d78c0ec7f6485ee9f14f89e4699c4806582cad420cf9b81355b8cd5628b42962adfd2cd649ac635324ffc42d87f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30144.exe

Filesize
468KB

MD5
b1bc3117888cfdbd4af309588559152a

SHA1
538a0476ceda4c969df12542af83ed4e7b7b4d06

SHA256
3872b13d4b36507614c4aae8c1ff03a9b1013736ebdba9dcc1f5b84de8dbe278

SHA512
e8535dc0bdc493522192a2382a5859771719fbbbd6cabdde1f1e09f12af931366acc05d354c1f786e44d5160b56712a1d30b821f5fb81c6cb4d1a3305ed873cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33818.exe

Filesize
468KB

MD5
352d870fbf5ffdb9001fd5ce5d2d29f2

SHA1
3028a44a662c8fbfbc826d65e4be444cb8adae79

SHA256
9eaf5be6f7dc0a6603277d4eede4dd717a36650b26353c713f412a25689be44c

SHA512
4813140c5f0bbddd61ff85e61271a36c0508c2dd7dab0df7e884c5cd2e252fd79af591fdd480b07ce507e184a93d2d6126780c435a07e14a67098c1781ed6d09

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41528.exe

Filesize
468KB

MD5
9e84a4d556824f10a6d0218b8158d6b3

SHA1
cacdc4232d431aee2825bc9efff5e39c21cb60c7

SHA256
4fa3a5d4a7f2e29a6eee76b0bf9edfee87bfe179b8ca443e30f730b417c7d2f0

SHA512
5ef523c73d43c7a25db5e991671bda358dab44deea6f9797050e6a4849f2a21c366c997dfb1316c384ed8209aab86bfc5de15047b1e4693420ac02a818126933

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44534.exe

Filesize
468KB

MD5
eb1df74b923cb226e96c91622547c365

SHA1
875ed0fc67075ab6fb6022bfd2e940f8b27fec8c

SHA256
78d2878749a349d6c85d077247a26d82650c53dde928277edc128c7f09ba9bdf

SHA512
e462672a48647c9d0373db322f1b6171ad48ead480f182f199b132422e214385dc42daf37c5653fb08b56688798be3833618634054245119c4ba013c6418ec3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44814.exe

Filesize
468KB

MD5
df6c8c827d588edc9a6045d89e07ab50

SHA1
da56a86126a4b86b4b38e689ee193652f6674f62

SHA256
52815cd478a0f480fc4340c53543e78b6c44380f5156aaf26786e4ecfec0b07d

SHA512
256e064197ceb50e888480b719333e797c30c0d0f7652c1e65d20745c0608f504eddcd68c39eed5b9ae704f8d52e1f38f9e5d441e67b4694ba6321c83be51c24

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46521.exe

Filesize
468KB

MD5
484525f3ec34f1c045613dfa581e9d64

SHA1
29cf7e9c3cc59440f3ee198ed0c1d1031c2e68bb

SHA256
909a5d1cf8d920c675e96be61cc09bec37c6a7d989b6b2431a871fc2f76c99f2

SHA512
ca7361904a54d9587a4bd63f30ac209e879239c85b7bab9063ae5d26def0db3441bea8d2f1eba8ae665ac97b32bd4fffe549f30c7dfe69519de45259329b2585

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47393.exe

Filesize
468KB

MD5
8d3148817f1810723c99e9711e80739a

SHA1
bf3708454cf80676fb9225fa422d87dd306121d7

SHA256
3115e43ad6fbe9cb49243aa22a9deb7280212569f34d40843db261f0090925e0

SHA512
937ce6a11a6c773ed896ca8ba0d1e3a5d9a4304969728fc83d7d9e66a9ab92ef7d5fadf8af74b788e600b903ff04ce9c3640006d2a68d70489c4435115d65947

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48763.exe

Filesize
468KB

MD5
e767d4005705289de347e0ed8c64e61e

SHA1
a1a27bed784d4fa96215bceae98df87b1bd6669c

SHA256
f3f1ae98690840297de128d49ba18caf0957170a6e605538a46337b0a0d1b371

SHA512
865512cd7b0505a1e97d34ef7f447c334bbadae7b8d40f29d96522e78265ddbdfec5e8f13f7ed77f12074270553fbcce444ad189a4560f18927ff83eec27b7ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49365.exe

Filesize
468KB

MD5
815e9f6cbff6448118dcc0f2e2adbd20

SHA1
bb1d41e9fce08751864677bbe2b63e65c7aa25c7

SHA256
4c67aeebb5078514e46b2f7b082ce0ad1f6673299d3b36edd7959134c5a4c0f2

SHA512
7ca451a68ad5c805b33da2218c48a3de94334664302de5eeda03e77a57c97ce3672a346938db2c460e281f276d66b0ee11138513af41100a4ec366fff3f0b9a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49796.exe

Filesize
468KB

MD5
2dc3b3fd73d44b606a81750310557557

SHA1
2249e37f9858e07ee2cd469c44c2465630f32c88

SHA256
d685ac961c2217bdde8cd879692763bf1a6450c2a137d848ec28f6a2b9266b81

SHA512
1f04cb8a7d8d1840d8403ecdc48c2d10d26d139f624859b04ca21966582814e1c077384ff4cc2ff67ddad678ce606324fdc21e36b2fe78cf82ec7e216b34bb19

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52088.exe

Filesize
468KB

MD5
840fc97403e37143e3db3acb50c8e848

SHA1
ef90926e47c6cc59ab9cc622b04cd67a6a44ed76

SHA256
f807a30c8156c7011edde1259652da3bf3b9b323464b064624f327722240af15

SHA512
c39d77929800fbdcd079801c63a0f58d6bf91acd41236ee4a8b64d39b492e9f5089d7b7f8abcc85f1c53bf912e2f648cf3a3cb9477ec3196be66155fa4010710

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52437.exe

Filesize
468KB

MD5
72ae796779c4519e371b47a8555984d3

SHA1
3991a6a4cc902cfc6806b8413dad05aff4d71a15

SHA256
fc944a2c636f2bbd81f8e39a78f9c73cb9f6a2a55be63cebc0574d5d38eae234

SHA512
e68c211c3c627fed6e570b269bff4d9bf4bf6ed855f53203a19f3de77500f7ea60a0cfbb4c01bf00dfbdd25f26e49a9a51197a37f478b3d91624b789e7ea8501

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52702.exe

Filesize
468KB

MD5
f26cd513c16035112f8396a9de9be935

SHA1
648268ad0822983c71552e1d752b2f4f9adfd164

SHA256
ce38615c0ffbe6bb2d980f6d67611fb6c1367a16c701f482d77fef36645e74f3

SHA512
a101ef4d7a388e77bbb98a6ca24bc42859038b10b00539e2e9f8412c266e504cd934cd604e97412925441826c17b0277d6ae12895a9b6f659f1dbb9ee33ef4ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53257.exe

Filesize
468KB

MD5
f52c650490b546d25756bde6e753dcac

SHA1
bf3c4b1399964a8964e9e53da436743829c101d8

SHA256
473b3e20ef936b9d0d8f34bf62427c9ebcb9cef6de99a29c6b325da240be6390

SHA512
849cb5a3a7e9ff4eebcea6b056be5d0fe0588d948d6a76f8cf37f7ce1b6f37e7e864450c6db1e378cff27677b88e60bba0b429bddc96797968cb91d2c314e0ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54654.exe

Filesize
468KB

MD5
82d71a8c6dfec77909d1c96f059821f1

SHA1
c096d09db137daab24cb907f72309c927a2a495f

SHA256
6106880cf82144e8cbc1f5f938558de23c24c2ea21d9a7bcb44dbd8f092434d6

SHA512
b0ea40f720e7a50f90f34cd745b8c6dfb6eb616680f4350cbed6a2998854da62d6bd04fdc639c28dd92d9075551cac21166389b4a8e78ec64e8bbc49e90f14f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58130.exe

Filesize
468KB

MD5
a5f1b0f9b777465406492354f88bf3f8

SHA1
d6bf3b8965e09de726695c69f75a67362addad5b

SHA256
b6d92f249357135003959181fb98ca576a0b4d64bbf1cd2991fbfa59d0df6806

SHA512
d068aa374631b61ebec65cde8241e3e9bf85c0f5b27d8a5882f3cbf6a0f3c23b800bc70a432629ec1a126aeb2ad8b2993a2939ef2afd626c99dca94a38afa28b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58519.exe

Filesize
468KB

MD5
4f7631cbb48a79dba3c965d46fe032da

SHA1
8c0313dcc5126dc099cdd79769851057750f893a

SHA256
3d20c015780e536ccc6f30c68a5d2218eb9efafda74a6072da96737493c047d4

SHA512
1b1ea5b7ef8a1d95399b2307738fee59ba3a9886bf92fba334a4e2194197b6d2fa5bf28cf2e6afe97a6ab994ac177df34bc093a182a25b5a3002730243ba6a37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60190.exe

Filesize
468KB

MD5
a91e51692efb0215872f8cceb614803e

SHA1
619ac79d2f9f5928b5d063f22b76953390c834f8

SHA256
0a3a3c20b95b5582de63aa040790aa29bcaed8c9a92e420bd9caff8333bb55b7

SHA512
07a22c9e8ed6df9a73acf9e3bf2760c54a925ef8838d3ae87325750a2da705a95821c54b0e749a61e37245852dd4d5f562a4f9bd1d8dda88b4087b75910bb609

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63563.exe

Filesize
468KB

MD5
9dbd470644d913bc79906092fdb62ef9

SHA1
d905ddca5fe91978bbd8d13912bb2b13a2f3e47e

SHA256
2569efafa9f72598f6857d7516cc58aa44d5f8188a824e7b1ab3b0b48b951d0c

SHA512
0672c82becb7b42918a44d4267f3608a3b01137526737330338b19572be1039f18747c7825a642b2492d7aa9bbbfdeb08ee8ea2512ca0748cac8851ec569fb02

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64252.exe

Filesize
468KB

MD5
d7728202362474a976e5cd59e2675191

SHA1
c23c15adce08e3afb234486450eefc9619f633a1

SHA256
92159356bd8c93945e5fc187581d2bb054fcbc01999f6e621c02fa78ec788397

SHA512
6ce965ac482a7c58e0473e270e0ab1118c242003ac4a661a8cc06a7afb79c496ea2758b98feec3d655c3c5e99de9cd7f03d6112b0c73e428adfd2846e6ed0529

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64741.exe

Filesize
468KB

MD5
888060af866e3a458ffb95dcde79fe0b

SHA1
47f74881d7b9336ce2c4681432f42ea9c934e860

SHA256
5458508b87f4c26cec904f2b0354e77eb271369cc9cdf6ef003628df44a6fce2

SHA512
2f7c3458a11b260f22293eaabf141b98ffcf94af3c7d16a919e87a0b6cec7a87fcf76772088285877ca3cbb39818d0c998f5e60ec14335600f73d7191417f586

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64954.exe

Filesize
468KB

MD5
8c6810058c5648eb4b52240d33ece935

SHA1
d0185ba57eba85ae79271a3db4f4f6103fc4f8c3

SHA256
d9d6759e7ed7f27d0c5ed9e200f726581f6766022aaa3947d47e74b7e8ac447c

SHA512
1f0d76b3ebcc4ed15b12bc2e86a8e59771972be396a431f87cd1669b7cd9df5822c57391afb7745340520eba6bc5b8ab8315bbeb7f9f793b607986ed174b844d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-849.exe

Filesize
468KB

MD5
0389e42fb7591bd409ac86751c9d92b4

SHA1
5e403420ad8c9d529232510814ccb264a74990d7

SHA256
daf3ba5f41d5cc58638a93e06bf3103b46698ff1c714a268887fbe06c6cb9d37

SHA512
d5241f0120c1770f8be967e690ee69f7ecd959e3811152b38f19adc510f3891d5133bd6c7630b6d3cae161b1845bcb273c2bc2ea48270a9c93ba925cf6d299ad

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads