fed618300726a011dab2eadc5f0ab0595ccc0130ad948fae3f9fc90335ec54b2

Analysis

max time kernel
120s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 14:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

864f6086a9a8a2e39943be53a4b27610N.exe
Size

468KB
MD5

864f6086a9a8a2e39943be53a4b27610
SHA1

8e22d03a685d0767b12827b36446752feb601a19
SHA256

fed618300726a011dab2eadc5f0ab0595ccc0130ad948fae3f9fc90335ec54b2
SHA512

979bc998f32f98a1d933fd26d2f50fcd34e80180c1509bdfd9957de63f5d715a38c2c21d54ba1439eac806066c188b87b7cea8ec8c7aaf39b1e0d71db56054ff
SSDEEP

3072:tWACogMFjb8y2bYyUz54ff8jEC2j4ICCgmHebVz7qJI3pMfzm0lK:tW1oXYy29U14ffAXHVqJWifzm

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4324	Unicorn-19959.exe
2144	Unicorn-37146.exe
4128	Unicorn-14265.exe
5032	Unicorn-7654.exe
4768	Unicorn-37181.exe
2176	Unicorn-57047.exe
1240	Unicorn-30496.exe
2140	Unicorn-2906.exe
3276	Unicorn-2906.exe
4880	Unicorn-38001.exe
3820	Unicorn-48215.exe
2648	Unicorn-48215.exe
4764	Unicorn-3845.exe
4112	Unicorn-27530.exe
2476	Unicorn-16097.exe
4604	Unicorn-51095.exe
1764	Unicorn-34759.exe
4588	Unicorn-18231.exe
4564	Unicorn-39397.exe
5044	Unicorn-63347.exe
4680	Unicorn-51650.exe
1916	Unicorn-41073.exe
4624	Unicorn-27337.exe
3400	Unicorn-47203.exe
4948	Unicorn-30867.exe
1932	Unicorn-11001.exe
4940	Unicorn-37966.exe
2544	Unicorn-4124.exe
4388	Unicorn-1324.exe
544	Unicorn-9989.exe
1700	Unicorn-21437.exe
748	Unicorn-24967.exe
4004	Unicorn-270.exe
4556	Unicorn-11816.exe
3684	Unicorn-24583.exe
4356	Unicorn-41879.exe
396	Unicorn-41109.exe
3040	Unicorn-1038.exe
4904	Unicorn-30373.exe
1396	Unicorn-50239.exe
1056	Unicorn-50239.exe
2468	Unicorn-1209.exe
1372	Unicorn-59869.exe
4748	Unicorn-462.exe
3116	Unicorn-462.exe
4596	Unicorn-43533.exe
2352	Unicorn-49398.exe
3000	Unicorn-41687.exe
1992	Unicorn-35557.exe
2012	Unicorn-21267.exe
4752	Unicorn-29435.exe
1444	Unicorn-29435.exe
3008	Unicorn-8557.exe
672	Unicorn-1401.exe
1824	Unicorn-43725.exe
2196	Unicorn-29989.exe
3188	Unicorn-9212.exe
5092	Unicorn-10742.exe
228	Unicorn-32816.exe
2972	Unicorn-1998.exe
3768	Unicorn-55838.exe
2792	Unicorn-10166.exe
3232	Unicorn-31333.exe
4340	Unicorn-55475.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
4720	544	WerFault.exe
1612	396	WerFault.exe	132

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41427.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53140.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7990.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42959.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6712.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62095.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19959.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47551.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28823.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6046.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43445.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55931.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3210.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-898.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31454.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63347.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61397.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61111.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40760.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54079.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44058.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12066.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26363.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3306.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16494.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63358.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58696.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7109.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39975.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38275.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12491.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27337.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17120	dwm.exe
Token: SeChangeNotifyPrivilege	17120	dwm.exe
Token: 33	17120	dwm.exe
Token: SeIncBasePriorityPrivilege	17120	dwm.exe
Token: SeCreateGlobalPrivilege	19208	dwm.exe
Token: SeChangeNotifyPrivilege	19208	dwm.exe
Token: 33	19208	dwm.exe
Token: SeIncBasePriorityPrivilege	19208	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5112	864f6086a9a8a2e39943be53a4b27610N.exe
4324	Unicorn-19959.exe
2144	Unicorn-37146.exe
4128	Unicorn-14265.exe
4768	Unicorn-37181.exe
2176	Unicorn-57047.exe
5032	Unicorn-7654.exe
1240	Unicorn-30496.exe
2140	Unicorn-2906.exe
3276	Unicorn-2906.exe
4880	Unicorn-38001.exe
3820	Unicorn-48215.exe
2648	Unicorn-48215.exe
4112	Unicorn-27530.exe
2476	Unicorn-16097.exe
4764	Unicorn-3845.exe
4604	Unicorn-51095.exe
1764	Unicorn-34759.exe
4680	Unicorn-51650.exe
4564	Unicorn-39397.exe
4948	Unicorn-30867.exe
4388	Unicorn-1324.exe
544	Unicorn-9989.exe
4588	Unicorn-18231.exe
2544	Unicorn-4124.exe
1932	Unicorn-11001.exe
4940	Unicorn-37966.exe
4624	Unicorn-27337.exe
1916	Unicorn-41073.exe
3400	Unicorn-47203.exe
5044	Unicorn-63347.exe
1700	Unicorn-21437.exe
4004	Unicorn-270.exe
748	Unicorn-24967.exe
4556	Unicorn-11816.exe
3684	Unicorn-24583.exe
4356	Unicorn-41879.exe
396	Unicorn-41109.exe
3040	Unicorn-1038.exe
4904	Unicorn-30373.exe
1056	Unicorn-50239.exe
1396	Unicorn-50239.exe
2468	Unicorn-1209.exe
1372	Unicorn-59869.exe
4748	Unicorn-462.exe
3116	Unicorn-462.exe
2352	Unicorn-49398.exe
4596	Unicorn-43533.exe
3000	Unicorn-41687.exe
4752	Unicorn-29435.exe
1444	Unicorn-29435.exe
1824	Unicorn-43725.exe
2196	Unicorn-29989.exe
1992	Unicorn-35557.exe
3008	Unicorn-8557.exe
2012	Unicorn-21267.exe
3188	Unicorn-9212.exe
672	Unicorn-1401.exe
5092	Unicorn-10742.exe
228	Unicorn-32816.exe
3232	Unicorn-31333.exe
2972	Unicorn-1998.exe
3768	Unicorn-55838.exe
2792	Unicorn-10166.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5112 wrote to memory of 4324	5112	864f6086a9a8a2e39943be53a4b27610N.exe	88
PID 5112 wrote to memory of 4324	5112	864f6086a9a8a2e39943be53a4b27610N.exe	88
PID 5112 wrote to memory of 4324	5112	864f6086a9a8a2e39943be53a4b27610N.exe	88
PID 4324 wrote to memory of 2144	4324	Unicorn-19959.exe	91
PID 4324 wrote to memory of 2144	4324	Unicorn-19959.exe	91
PID 4324 wrote to memory of 2144	4324	Unicorn-19959.exe	91
PID 5112 wrote to memory of 4128	5112	864f6086a9a8a2e39943be53a4b27610N.exe	92
PID 5112 wrote to memory of 4128	5112	864f6086a9a8a2e39943be53a4b27610N.exe	92
PID 5112 wrote to memory of 4128	5112	864f6086a9a8a2e39943be53a4b27610N.exe	92
PID 2144 wrote to memory of 5032	2144	Unicorn-37146.exe	94
PID 2144 wrote to memory of 5032	2144	Unicorn-37146.exe	94
PID 2144 wrote to memory of 5032	2144	Unicorn-37146.exe	94
PID 4324 wrote to memory of 4768	4324	Unicorn-19959.exe	95
PID 4324 wrote to memory of 4768	4324	Unicorn-19959.exe	95
PID 4324 wrote to memory of 4768	4324	Unicorn-19959.exe	95
PID 4128 wrote to memory of 2176	4128	Unicorn-14265.exe	96
PID 4128 wrote to memory of 2176	4128	Unicorn-14265.exe	96
PID 4128 wrote to memory of 2176	4128	Unicorn-14265.exe	96
PID 5112 wrote to memory of 1240	5112	864f6086a9a8a2e39943be53a4b27610N.exe	97
PID 5112 wrote to memory of 1240	5112	864f6086a9a8a2e39943be53a4b27610N.exe	97
PID 5112 wrote to memory of 1240	5112	864f6086a9a8a2e39943be53a4b27610N.exe	97
PID 4768 wrote to memory of 3276	4768	Unicorn-37181.exe	101
PID 2176 wrote to memory of 2140	2176	Unicorn-57047.exe	100
PID 4768 wrote to memory of 3276	4768	Unicorn-37181.exe	101
PID 2176 wrote to memory of 2140	2176	Unicorn-57047.exe	100
PID 2176 wrote to memory of 2140	2176	Unicorn-57047.exe	100
PID 4768 wrote to memory of 3276	4768	Unicorn-37181.exe	101
PID 4324 wrote to memory of 4880	4324	Unicorn-19959.exe	102
PID 4324 wrote to memory of 4880	4324	Unicorn-19959.exe	102
PID 4324 wrote to memory of 4880	4324	Unicorn-19959.exe	102
PID 1240 wrote to memory of 3820	1240	Unicorn-30496.exe	103
PID 5032 wrote to memory of 2648	5032	Unicorn-7654.exe	104
PID 1240 wrote to memory of 3820	1240	Unicorn-30496.exe	103
PID 1240 wrote to memory of 3820	1240	Unicorn-30496.exe	103
PID 5032 wrote to memory of 2648	5032	Unicorn-7654.exe	104
PID 5032 wrote to memory of 2648	5032	Unicorn-7654.exe	104
PID 4128 wrote to memory of 4764	4128	Unicorn-14265.exe	105
PID 4128 wrote to memory of 4764	4128	Unicorn-14265.exe	105
PID 4128 wrote to memory of 4764	4128	Unicorn-14265.exe	105
PID 5112 wrote to memory of 4112	5112	864f6086a9a8a2e39943be53a4b27610N.exe	106
PID 5112 wrote to memory of 4112	5112	864f6086a9a8a2e39943be53a4b27610N.exe	106
PID 5112 wrote to memory of 4112	5112	864f6086a9a8a2e39943be53a4b27610N.exe	106
PID 2144 wrote to memory of 2476	2144	Unicorn-37146.exe	107
PID 2144 wrote to memory of 2476	2144	Unicorn-37146.exe	107
PID 2144 wrote to memory of 2476	2144	Unicorn-37146.exe	107
PID 2648 wrote to memory of 4604	2648	Unicorn-48215.exe	108
PID 2648 wrote to memory of 4604	2648	Unicorn-48215.exe	108
PID 2648 wrote to memory of 4604	2648	Unicorn-48215.exe	108
PID 3276 wrote to memory of 1764	3276	Unicorn-2906.exe	109
PID 3276 wrote to memory of 1764	3276	Unicorn-2906.exe	109
PID 3276 wrote to memory of 1764	3276	Unicorn-2906.exe	109
PID 2140 wrote to memory of 4588	2140	Unicorn-2906.exe	110
PID 2140 wrote to memory of 4588	2140	Unicorn-2906.exe	110
PID 2140 wrote to memory of 4588	2140	Unicorn-2906.exe	110
PID 5032 wrote to memory of 4564	5032	Unicorn-7654.exe	111
PID 5032 wrote to memory of 4564	5032	Unicorn-7654.exe	111
PID 5032 wrote to memory of 4564	5032	Unicorn-7654.exe	111
PID 2476 wrote to memory of 5044	2476	Unicorn-16097.exe	112
PID 2476 wrote to memory of 5044	2476	Unicorn-16097.exe	112
PID 2476 wrote to memory of 5044	2476	Unicorn-16097.exe	112
PID 4768 wrote to memory of 4680	4768	Unicorn-37181.exe	113
PID 4768 wrote to memory of 4680	4768	Unicorn-37181.exe	113
PID 4768 wrote to memory of 4680	4768	Unicorn-37181.exe	113
PID 2144 wrote to memory of 1916	2144	Unicorn-37146.exe	114

C:\Users\Admin\AppData\Local\Temp\864f6086a9a8a2e39943be53a4b27610N.exe
"C:\Users\Admin\AppData\Local\Temp\864f6086a9a8a2e39943be53a4b27610N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5112
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19959.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19959.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37146.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37146.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7654.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48215.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24967.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10166.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        9⤵
        
        PID:392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-898.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56674.exe
        11⤵
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52221.exe
        11⤵
        
        PID:14988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64842.exe
        10⤵
        
        PID:9320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64561.exe
        10⤵
        
        PID:14332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36074.exe
        10⤵
        
        PID:15532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36585.exe
        9⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43727.exe
        10⤵
        
        PID:12932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20050.exe
        10⤵
        
        PID:15800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57529.exe
        9⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53332.exe
        9⤵
        
        PID:3572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9760.exe
        8⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64759.exe
        9⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22901.exe
        9⤵
        
        PID:11432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64862.exe
        9⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54510.exe
        8⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35751.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58452.exe
        9⤵
        
        PID:15552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59398.exe
        8⤵
        
        PID:13616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
        8⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50702.exe
        8⤵
        
        PID:17284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        8⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32139.exe
        9⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33971.exe
        10⤵
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46394.exe
        10⤵
        
        PID:13628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47493.exe
        10⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36266.exe
        10⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16409.exe
        9⤵
        
        PID:9804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25469.exe
        10⤵
        
        PID:16396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8152.exe
        9⤵
        
        PID:15052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7493.exe
        9⤵
        
        PID:1960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14577.exe
        8⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27007.exe
        9⤵
        
        PID:12584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1773.exe
        9⤵
        
        PID:11732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        9⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1852.exe
        8⤵
        
        PID:11324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50317.exe
        8⤵
        
        PID:3180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9264.exe
        7⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39259.exe
        8⤵
        
        PID:12616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7990.exe
        8⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56694.exe
        7⤵
        
        PID:10356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55639.exe
        7⤵
        
        PID:15884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30373.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2958.exe
        7⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35159.exe
        8⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40115.exe
        9⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-338.exe
        10⤵
        
        PID:14020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10293.exe
        10⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18956.exe
        9⤵
        
        PID:11976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
        9⤵
        
        PID:15912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47442.exe
        8⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
        8⤵
        
        PID:12952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50317.exe
        8⤵
        
        PID:16056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39797.exe
        7⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29399.exe
        8⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14176.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:17236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29533.exe
        8⤵
        
        PID:9788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3210.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58053.exe
        7⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21505.exe
        7⤵
        
        PID:9872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29321.exe
        7⤵
        
        PID:15752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34352.exe
        6⤵
        
        PID:1828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59279.exe
        7⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22901.exe
        8⤵
        
        PID:11332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        8⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25625.exe
        7⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34856.exe
        7⤵
        
        PID:13348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56594.exe
        7⤵
        
        PID:14320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32912.exe
        7⤵
        
        PID:15468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6689.exe
        6⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4894.exe
        7⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6970.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        8⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29533.exe
        7⤵
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53113.exe
        7⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43687.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22580.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25469.exe
        6⤵
        
        PID:12192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55931.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39397.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1038.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19487.exe
        7⤵
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30883.exe
        8⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47551.exe
        9⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38771.exe
        10⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4889.exe
        10⤵
        
        PID:15108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1406.exe
        10⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34089.exe
        9⤵
        
        PID:10696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29321.exe
        9⤵
        
        PID:15780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21785.exe
        8⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63483.exe
        9⤵
        
        PID:13528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7109.exe
        9⤵
        
        PID:16120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39185.exe
        8⤵
        
        PID:4140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
        8⤵
        
        PID:15988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6828.exe
        7⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53467.exe
        8⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21121.exe
        8⤵
        
        PID:13512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12255.exe
        8⤵
        
        PID:17148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35626.exe
        7⤵
        
        PID:10208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61761.exe
        7⤵
        
        PID:12992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65392.exe
        7⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61650.exe
        6⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20167.exe
        7⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61111.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        9⤵
        
        PID:12900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16158.exe
        9⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16513.exe
        8⤵
        
        PID:11112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5997.exe
        8⤵
        
        PID:13540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16730.exe
        8⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55226.exe
        7⤵
        
        PID:8308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44879.exe
        8⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62039.exe
        8⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
        7⤵
        
        PID:13108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47.exe
        7⤵
        
        PID:1412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19621.exe
        6⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56062.exe
        7⤵
        
        PID:14668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6712.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5743.exe
        7⤵
        
        PID:16888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50261.exe
        6⤵
        
        PID:10972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38275.exe
        7⤵
        
        PID:15896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50510.exe
        6⤵
        
        PID:16564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43533.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45719.exe
        6⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-898.exe
        7⤵
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34739.exe
        8⤵
        
        PID:10072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29038.exe
        9⤵
        
        PID:15952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47318.exe
        8⤵
        
        PID:14224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26748.exe
        8⤵
        
        PID:11440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        8⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21156.exe
        7⤵
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55921.exe
        7⤵
        
        PID:15852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24333.exe
        6⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34703.exe
        7⤵
        
        PID:13248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62039.exe
        7⤵
        
        PID:15668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2316.exe
        6⤵
        
        PID:12844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44053.exe
        6⤵
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49730.exe
        5⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26363.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44059.exe
        7⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41957.exe
        7⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13093.exe
        6⤵
        
        PID:10428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12491.exe
        6⤵
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7448.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7982.exe
        6⤵
        
        PID:11744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50735.exe
        6⤵
        
        PID:8080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6253.exe
        5⤵
        
        PID:9604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41868.exe
        5⤵
        
        PID:13956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6046.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16097.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63347.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29435.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54079.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36223.exe
        8⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62678.exe
        9⤵
        
        PID:10168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41957.exe
        9⤵
        
        PID:2908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37789.exe
        8⤵
        
        PID:10040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29148.exe
        8⤵
        
        PID:13208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44058.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
        7⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54443.exe
        8⤵
        
        PID:11956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4975.exe
        8⤵
        
        PID:15396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
        7⤵
        
        PID:12968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12491.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49974.exe
        6⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4982.exe
        7⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38787.exe
        8⤵
        
        PID:13472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22953.exe
        8⤵
        
        PID:13648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52802.exe
        8⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24577.exe
        7⤵
        
        PID:9844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-944.exe
        7⤵
        
        PID:15324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17260.exe
        7⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54405.exe
        6⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44879.exe
        7⤵
        
        PID:12500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22953.exe
        7⤵
        
        PID:12080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        7⤵
        
        PID:1364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16156.exe
        6⤵
        
        PID:11960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22875.exe
        6⤵
        
        PID:16000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46029.exe
        5⤵
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26415.exe
        6⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19835.exe
        7⤵
        
        PID:8992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22901.exe
        7⤵
        
        PID:11564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        7⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29709.exe
        6⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34856.exe
        6⤵
        
        PID:13364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57668.exe
        6⤵
        
        PID:7124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42486.exe
        5⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        6⤵
        
        PID:9104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22901.exe
        6⤵
        
        PID:12240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19937.exe
        6⤵
        
        PID:1060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40645.exe
        5⤵
        
        PID:9128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4422.exe
        6⤵
        
        PID:14056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44227.exe
        6⤵
        
        PID:13016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15521.exe
        5⤵
        
        PID:13164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18874.exe
        5⤵
        
        PID:1000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29435.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57011.exe
        6⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24251.exe
        7⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44199.exe
        8⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34983.exe
        9⤵
        
        PID:13152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        9⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10981.exe
        8⤵
        
        PID:12796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31801.exe
        8⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62818.exe
        7⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39185.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47214.exe
        7⤵
        
        PID:3348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41080.exe
        7⤵
        
        PID:15376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14857.exe
        6⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34931.exe
        7⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54562.exe
        7⤵
        
        PID:13792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61275.exe
        7⤵
        
        PID:1416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38313.exe
        6⤵
        
        PID:9712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6809.exe
        6⤵
        
        PID:15284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42057.exe
        6⤵
        
        PID:13872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52029.exe
        6⤵
        
        PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54634.exe
        5⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50675.exe
        6⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39975.exe
        7⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50826.exe
        7⤵
        
        PID:11632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28603.exe
        7⤵
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62294.exe
        6⤵
        
        PID:10340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56594.exe
        6⤵
        
        PID:14372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
        6⤵
        
        PID:16416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34560.exe
        5⤵
        
        PID:7960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53107.exe
        6⤵
        
        PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36114.exe
        5⤵
        
        PID:11136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41431.exe
        6⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39619.exe
        6⤵
        
        PID:17228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63822.exe
        5⤵
        
        PID:15208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42149.exe
        5⤵
        
        PID:15700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8557.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45911.exe
        5⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26363.exe
        6⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51267.exe
        7⤵
        
        PID:9640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54562.exe
        7⤵
        
        PID:13784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53096.exe
        7⤵
        
        PID:16256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9096.exe
        6⤵
        
        PID:10188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65008.exe
        6⤵
        
        PID:16096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49798.exe
        5⤵
        
        PID:8056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39975.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53140.exe
        6⤵
        
        PID:15404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15536.exe
        5⤵
        
        PID:10456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52029.exe
        5⤵
        
        PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3540.exe
      4⤵
      PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        5⤵
        
        PID:7304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42523.exe
        6⤵
        
        PID:9256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34703.exe
        7⤵
        
        PID:13688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62039.exe
        7⤵
        
        PID:15684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25781.exe
        6⤵
        
        PID:13748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56111.exe
        6⤵
        
        PID:16176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24961.exe
        5⤵
        
        PID:9500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8344.exe
        5⤵
        
        PID:14396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16730.exe
        5⤵
        
        PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62262.exe
      4⤵
      PID:6176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16494.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55639.exe
      4⤵
      PID:15904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37181.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37181.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2906.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34759.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-270.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1998.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50535.exe
        8⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6518.exe
        9⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56062.exe
        10⤵
        
        PID:14364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8666.exe
        10⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38173.exe
        9⤵
        
        PID:10716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17260.exe
        9⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42205.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39185.exe
        8⤵
        
        PID:11352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45740.exe
        8⤵
        
        PID:16480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22117.exe
        7⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32139.exe
        8⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34879.exe
        9⤵
        
        PID:11164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53113.exe
        9⤵
        
        PID:13440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28674.exe
        9⤵
        
        PID:16660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe
        8⤵
        
        PID:11224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8023.exe
        8⤵
        
        PID:716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16060.exe
        7⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40663.exe
        8⤵
        
        PID:14252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54031.exe
        8⤵
        
        PID:17008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41734.exe
        7⤵
        
        PID:11812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12708.exe
        7⤵
        
        PID:13332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22597.exe
        7⤵
        
        PID:13856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50317.exe
        7⤵
        
        PID:5276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55838.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        7⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51635.exe
        8⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46031.exe
        9⤵
        
        PID:9304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44227.exe
        10⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54562.exe
        9⤵
        
        PID:13816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36074.exe
        9⤵
        
        PID:15416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24961.exe
        8⤵
        
        PID:9512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12491.exe
        8⤵
        
        PID:15692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21785.exe
        7⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14946.exe
        8⤵
        
        PID:12696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5473.exe
        8⤵
        
        PID:13564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28603.exe
        8⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39185.exe
        7⤵
        
        PID:11360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12491.exe
        7⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15625.exe
        6⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64183.exe
        7⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38275.exe
        8⤵
        
        PID:15928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63358.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        7⤵
        
        PID:1164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46421.exe
        6⤵
        
        PID:9656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48961.exe
        6⤵
        
        PID:13672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40479.exe
        6⤵
        
        PID:16668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11816.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55475.exe
        6⤵
        Executes dropped EXE
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        7⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48475.exe
        8⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10426.exe
        9⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46394.exe
        9⤵
        
        PID:13776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7990.exe
        9⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29621.exe
        8⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34770.exe
        8⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8023.exe
        8⤵
        
        PID:436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
        7⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38107.exe
        8⤵
        
        PID:11824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16158.exe
        8⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
        7⤵
        
        PID:13116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8023.exe
        7⤵
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59258.exe
        6⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5558.exe
        7⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21387.exe
        8⤵
        
        PID:11716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4975.exe
        8⤵
        
        PID:15476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29237.exe
        7⤵
        
        PID:9616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51085.exe
        7⤵
        
        PID:17212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33984.exe
        6⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54021.exe
        7⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53357.exe
        7⤵
        
        PID:15280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
        7⤵
        
        PID:15740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57390.exe
        6⤵
        
        PID:10272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35319.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29884.exe
        5⤵
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        6⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32139.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44059.exe
        8⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14453.exe
        8⤵
        
        PID:14276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28219.exe
        8⤵
        
        PID:16108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21453.exe
        7⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1904.exe
        7⤵
        
        PID:14880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8023.exe
        7⤵
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10685.exe
        6⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34703.exe
        7⤵
        
        PID:15188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14356.exe
        7⤵
        
        PID:14016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7109.exe
        7⤵
        
        PID:16136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65392.exe
        6⤵
        
        PID:13008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13321.exe
        5⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56591.exe
        6⤵
        
        PID:8964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6970.exe
        7⤵
        
        PID:11712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20050.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22901.exe
        6⤵
        
        PID:12256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        6⤵
        
        PID:1112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48813.exe
        5⤵
        
        PID:9004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44227.exe
        6⤵
        
        PID:3272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15521.exe
        5⤵
        
        PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18874.exe
        5⤵
        
        PID:412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51650.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-462.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53311.exe
        6⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10270.exe
        7⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        8⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63483.exe
        9⤵
        
        PID:15244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52802.exe
        9⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15781.exe
        8⤵
        
        PID:10480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36689.exe
        8⤵
        
        PID:11732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62022.exe
        8⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60223.exe
        8⤵
        
        PID:17476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29953.exe
        7⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39185.exe
        7⤵
        
        PID:11192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40504.exe
        7⤵
        
        PID:15940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24037.exe
        6⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19259.exe
        7⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30493.exe
        7⤵
        
        PID:11512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37342.exe
        7⤵
        
        PID:15008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15972.exe
        6⤵
        
        PID:8956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56482.exe
        6⤵
        
        PID:13456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60882.exe
        6⤵
        
        PID:16288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41229.exe
        5⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64707.exe
        6⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56591.exe
        7⤵
        
        PID:8972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22901.exe
        7⤵
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        7⤵
        
        PID:1208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30825.exe
        6⤵
        
        PID:9140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20467.exe
        7⤵
        
        PID:15080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43601.exe
        6⤵
        
        PID:13736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20049.exe
        6⤵
        
        PID:12692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60753.exe
        6⤵
        
        PID:17468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32676.exe
        5⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18787.exe
        6⤵
        
        PID:9764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54562.exe
        6⤵
        
        PID:13824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56111.exe
        6⤵
        
        PID:16196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20633.exe
        5⤵
        
        PID:9692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63681.exe
        5⤵
        
        PID:15316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15091.exe
        5⤵
        
        PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35557.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-602.exe
        5⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55719.exe
        6⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42959.exe
        7⤵
        
        PID:13000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        7⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15781.exe
        6⤵
        
        PID:10544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36689.exe
        6⤵
        
        PID:15188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65348.exe
        6⤵
        
        PID:16568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25869.exe
        5⤵
        
        PID:7988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42871.exe
        6⤵
        
        PID:15264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62039.exe
        6⤵
        
        PID:15676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39185.exe
        5⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8215.exe
        5⤵
        
        PID:14652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12205.exe
      4⤵
      PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30447.exe
        5⤵
        
        PID:3024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39975.exe
        6⤵
        
        PID:8804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20467.exe
        6⤵
        
        PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62294.exe
        5⤵
        
        PID:10332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20275.exe
        5⤵
        
        PID:17180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11532.exe
      4⤵
      PID:7992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50511.exe
      4⤵
      PID:11904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6655.exe
      4⤵
      PID:15764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38001.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38001.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30867.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41879.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15402.exe
        6⤵
        
        PID:3132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25839.exe
        7⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-898.exe
        8⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47847.exe
        9⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5989.exe
        9⤵
        
        PID:11576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        9⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35485.exe
        8⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2760.exe
        8⤵
        
        PID:13848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9284.exe
        8⤵
        
        PID:16012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20249.exe
        7⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14282.exe
        8⤵
        
        PID:14000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62095.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24822.exe
        7⤵
        
        PID:11984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61267.exe
        7⤵
        
        PID:13460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1889.exe
        6⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46591.exe
        7⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6970.exe
        8⤵
        
        PID:11900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53107.exe
        8⤵
        
        PID:3720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29237.exe
        7⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61993.exe
        7⤵
        
        PID:16232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30476.exe
        6⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62287.exe
        7⤵
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31454.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50418.exe
        6⤵
        
        PID:3348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32912.exe
        6⤵
        
        PID:15432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36569.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34007.exe
        6⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        7⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15781.exe
        7⤵
        
        PID:10180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45503.exe
        7⤵
        
        PID:448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29953.exe
        6⤵
        
        PID:8116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39185.exe
        6⤵
        
        PID:11216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16876.exe
        6⤵
        
        PID:16244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36045.exe
        5⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47551.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51895.exe
        7⤵
        
        PID:11756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5743.exe
        7⤵
        
        PID:16904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19097.exe
        6⤵
        
        PID:11240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17260.exe
        6⤵
        
        PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61806.exe
        5⤵
        
        PID:7504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24132.exe
        5⤵
        
        PID:11300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23451.exe
        5⤵
        
        PID:16040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1209.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-602.exe
        5⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64707.exe
        6⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        7⤵
        
        PID:9040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6.exe
        8⤵
        
        PID:11652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        8⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22901.exe
        7⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        7⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42205.exe
        6⤵
        
        PID:2112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38906.exe
        6⤵
        
        PID:14820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62569.exe
        6⤵
        
        PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21732.exe
        5⤵
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47811.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41815.exe
        6⤵
        
        PID:17188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63394.exe
        5⤵
        
        PID:9940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60882.exe
        5⤵
        
        PID:16280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2221.exe
      4⤵
      PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        5⤵
        
        PID:9048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22901.exe
        5⤵
        
        PID:11316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14356.exe
        5⤵
        
        PID:14420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21340.exe
      4⤵
      PID:9124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42871.exe
        5⤵
        
        PID:13956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7493.exe
        5⤵
        
        PID:544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31281.exe
      4⤵
      PID:13448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6030.exe
      4⤵
      PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20618.exe
      4⤵
      PID:15640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9989.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9989.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:544
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 544 -s 464
      4⤵
      Program crash
      PID:4720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9212.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49995.exe
      4⤵
      PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4982.exe
        5⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42959.exe
        6⤵
        
        PID:13040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        6⤵
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1033.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-944.exe
        5⤵
        
        PID:15336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41957.exe
        5⤵
        
        PID:1600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36289.exe
      4⤵
      PID:8352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24895.exe
        5⤵
        
        PID:11272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3448.exe
        5⤵
        
        PID:14844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
        5⤵
        
        PID:15172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64966.exe
        5⤵
        
        PID:17084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28138.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31609.exe
      4⤵
      PID:4840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52542.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52542.exe
    3⤵
    PID:5788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63119.exe
      4⤵
      PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9658.exe
        5⤵
        
        PID:7452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53269.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62615.exe
        5⤵
        
        PID:16856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23809.exe
      4⤵
      PID:7792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-450.exe
        5⤵
        
        PID:15840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27612.exe
      4⤵
      PID:12412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21373.exe
      4⤵
      PID:15188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39133.exe
      4⤵
      PID:13860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27906.exe
      4⤵
      PID:11160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61263.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61263.exe
    3⤵
    PID:8048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43012.exe
    3⤵
    PID:4808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
    3⤵
    PID:14404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54786.exe
    3⤵
    PID:15960
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14265.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14265.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57047.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57047.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2906.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18231.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-462.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13046.exe
        7⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64707.exe
        8⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        9⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6181.exe
        9⤵
        
        PID:12332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8562.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54946.exe
        8⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63483.exe
        9⤵
        
        PID:15220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16346.exe
        9⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2760.exe
        8⤵
        
        PID:13760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53332.exe
        8⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17981.exe
        7⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55351.exe
        8⤵
        
        PID:9736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58696.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54562.exe
        8⤵
        
        PID:13840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45119.exe
        8⤵
        
        PID:17196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14768.exe
        7⤵
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38226.exe
        7⤵
        
        PID:12060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65392.exe
        7⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49974.exe
        6⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34531.exe
        7⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55351.exe
        8⤵
        
        PID:9700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54562.exe
        8⤵
        
        PID:13800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46200.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9096.exe
        7⤵
        
        PID:10424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9284.exe
        7⤵
        
        PID:16064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18416.exe
        6⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33971.exe
        7⤵
        
        PID:9532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54562.exe
        7⤵
        
        PID:13832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56687.exe
        7⤵
        
        PID:6268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40094.exe
        6⤵
        
        PID:9824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13520.exe
        6⤵
        
        PID:15232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2455.exe
        6⤵
        
        PID:15820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1401.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45911.exe
        6⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28823.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54443.exe
        8⤵
        
        PID:11972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        8⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43794.exe
        7⤵
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57756.exe
        7⤵
        
        PID:13664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31384.exe
        6⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38787.exe
        7⤵
        
        PID:15348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62039.exe
        7⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27510.exe
        6⤵
        
        PID:13240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21427.exe
        6⤵
        
        PID:17204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61397.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8542.exe
        6⤵
        
        PID:1792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34703.exe
        7⤵
        
        PID:15196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55218.exe
        7⤵
        
        PID:16632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12953.exe
        6⤵
        
        PID:12984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62615.exe
        6⤵
        
        PID:16688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38629.exe
        5⤵
        
        PID:7700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25919.exe
        5⤵
        
        PID:14260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2948.exe
        5⤵
        
        PID:13980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23451.exe
        5⤵
        
        PID:15460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27337.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21267.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53887.exe
        6⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47146.exe
        7⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14702.exe
        8⤵
        
        PID:9772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54562.exe
        8⤵
        
        PID:13808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46200.exe
        8⤵
        
        PID:15524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59501.exe
        7⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31609.exe
        7⤵
        
        PID:15600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21732.exe
        6⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56062.exe
        7⤵
        
        PID:14376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6712.exe
        7⤵
        
        PID:14676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7990.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44745.exe
        6⤵
        
        PID:11908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2455.exe
        6⤵
        
        PID:15812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49974.exe
        5⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53223.exe
        6⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29399.exe
        7⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63483.exe
        8⤵
        
        PID:13540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7109.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25449.exe
        7⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41349.exe
        7⤵
        
        PID:14016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46079.exe
        7⤵
        
        PID:17100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11645.exe
        6⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21660.exe
        7⤵
        
        PID:17220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44805.exe
        6⤵
        
        PID:12272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-195.exe
        6⤵
        
        PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49397.exe
        5⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62891.exe
        6⤵
        
        PID:10172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44442.exe
        6⤵
        
        PID:1940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25678.exe
        5⤵
        
        PID:10532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27042.exe
        5⤵
        
        PID:17260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43725.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48843.exe
        5⤵
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16083.exe
        6⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44199.exe
        7⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47545.exe
        7⤵
        
        PID:11924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32912.exe
        7⤵
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10685.exe
        6⤵
        
        PID:8488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35869.exe
        6⤵
        
        PID:11820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27894.exe
        6⤵
        
        PID:13476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50408.exe
        6⤵
        
        PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10773.exe
        5⤵
        
        PID:6840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4266.exe
        6⤵
        
        PID:1928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3876.exe
        6⤵
        
        PID:14912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19937.exe
        6⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13040.exe
        5⤵
        
        PID:9228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4889.exe
        5⤵
        
        PID:13184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50317.exe
        5⤵
        
        PID:15588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45454.exe
      4⤵
      PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4982.exe
        5⤵
        
        PID:7128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10426.exe
        6⤵
        
        PID:9684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54562.exe
        6⤵
        
        PID:13716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46200.exe
        6⤵
        
        PID:15648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12325.exe
        5⤵
        
        PID:9628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8152.exe
        5⤵
        
        PID:15060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7493.exe
        5⤵
        
        PID:13952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31184.exe
      4⤵
      PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44059.exe
        5⤵
        
        PID:8440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8023.exe
        5⤵
        
        PID:13976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45401.exe
      4⤵
      PID:10504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12743.exe
      4⤵
      PID:17268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3845.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3845.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37966.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41687.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8962.exe
        6⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21785.exe
        7⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49347.exe
        8⤵
        
        PID:14040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10293.exe
        8⤵
        
        PID:1456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39185.exe
        7⤵
        
        PID:11212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53140.exe
        7⤵
        
        PID:16048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42205.exe
        6⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6970.exe
        7⤵
        
        PID:11500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4975.exe
        7⤵
        
        PID:15512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22272.exe
        6⤵
        
        PID:11596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37873.exe
        6⤵
        
        PID:1160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61893.exe
        5⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44339.exe
        6⤵
        
        PID:9072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2125.exe
        7⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22901.exe
        6⤵
        
        PID:11344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61847.exe
        6⤵
        
        PID:14228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30006.exe
        5⤵
        
        PID:8064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16158.exe
        6⤵
        
        PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40801.exe
        5⤵
        
        PID:13700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6030.exe
        5⤵
        
        PID:15204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31609.exe
        5⤵
        
        PID:15772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29989.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-602.exe
        5⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50675.exe
        6⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13358.exe
        7⤵
        
        PID:9232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25781.exe
        7⤵
        
        PID:13768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57756.exe
        7⤵
        
        PID:1436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61334.exe
        6⤵
        
        PID:9540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53653.exe
        6⤵
        
        PID:14780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52610.exe
        6⤵
        
        PID:15580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20825.exe
        5⤵
        
        PID:7952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7162.exe
        6⤵
        
        PID:13224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64570.exe
        6⤵
        
        PID:14784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5743.exe
        6⤵
        
        PID:16912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25588.exe
        5⤵
        
        PID:9248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36074.exe
        5⤵
        
        PID:6360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6340.exe
      4⤵
      PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9642.exe
        5⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62678.exe
        6⤵
        
        PID:10160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10264.exe
        6⤵
        
        PID:14220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53908.exe
        6⤵
        
        PID:17252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37789.exe
        5⤵
        
        PID:10048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6070.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38275.exe
        6⤵
        
        PID:15968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39429.exe
        5⤵
        
        PID:13524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12491.exe
        5⤵
        
        PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36342.exe
      4⤵
      PID:7920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22788.exe
      4⤵
      PID:2924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49014.exe
      4⤵
      PID:4120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4124.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50239.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25324.exe
        5⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21785.exe
        6⤵
        
        PID:7856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39185.exe
        6⤵
        
        PID:11156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42149.exe
        6⤵
        
        PID:15628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55941.exe
        5⤵
        
        PID:7888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6970.exe
        6⤵
        
        PID:11580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
        6⤵
        
        PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45050.exe
        5⤵
        
        PID:10028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61267.exe
        5⤵
        
        PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4281.exe
      4⤵
      PID:1068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6954.exe
        5⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44199.exe
        6⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56171.exe
        7⤵
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15774.exe
        7⤵
        
        PID:16216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47545.exe
        6⤵
        
        PID:11916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49741.exe
        6⤵
        
        PID:15828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
        5⤵
        
        PID:8228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3004.exe
        5⤵
        
        PID:11640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33626.exe
        5⤵
        
        PID:13872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-195.exe
        5⤵
        
        PID:14924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58577.exe
      4⤵
      PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41215.exe
        5⤵
        
        PID:7556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53269.exe
        5⤵
        
        PID:15144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        5⤵
        
        PID:6024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43602.exe
      4⤵
      PID:10124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25388.exe
      4⤵
      PID:14268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43861.exe
      4⤵
      PID:5644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49398.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49398.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57203.exe
      4⤵
      PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59087.exe
        5⤵
        
        PID:6308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28823.exe
        6⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44059.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12491.exe
        7⤵
        
        PID:13380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5885.exe
        6⤵
        
        PID:10472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53140.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15345.exe
        5⤵
        
        PID:8424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14296.exe
        5⤵
        
        PID:11536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56495.exe
        5⤵
        
        PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35329.exe
      4⤵
      PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        5⤵
        
        PID:9088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22901.exe
        5⤵
        
        PID:11548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        5⤵
        
        PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48453.exe
      4⤵
      PID:7436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40722.exe
      4⤵
      PID:13076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41038.exe
      4⤵
      PID:15504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52165.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52165.exe
    3⤵
    PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61007.exe
      4⤵
      PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64759.exe
        5⤵
        
        PID:9060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22901.exe
        5⤵
        
        PID:12248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61847.exe
        5⤵
        
        PID:15560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34909.exe
      4⤵
      PID:8280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe
      4⤵
      PID:13656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11961.exe
      4⤵
      PID:868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4405.exe
    3⤵
    PID:6464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28963.exe
      4⤵
      PID:8912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38275.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64474.exe
      4⤵
      PID:3516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14662.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14662.exe
    3⤵
    PID:8816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56999.exe
      4⤵
      PID:14036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63268.exe
      4⤵
      PID:17004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40760.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40760.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:13300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54981.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54981.exe
    3⤵
    PID:368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6655.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6655.exe
    3⤵
    PID:15788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30496.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30496.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48215.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48215.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47203.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3705.exe
        5⤵
        
        PID:1080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43135.exe
        6⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        7⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22901.exe
        7⤵
        
        PID:12140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19937.exe
        7⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25625.exe
        6⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38330.exe
        6⤵
        
        PID:14944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39133.exe
        6⤵
        
        PID:14420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36074.exe
        6⤵
        
        PID:428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4524.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32139.exe
        6⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42959.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63121.exe
        7⤵
        
        PID:13448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17331.exe
        7⤵
        
        PID:16984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39517.exe
        6⤵
        
        PID:11116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42917.exe
        6⤵
        
        PID:17172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21925.exe
        5⤵
        
        PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15964.exe
        5⤵
        
        PID:10376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48448.exe
        5⤵
        
        PID:13144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3799.exe
        5⤵
        
        PID:17140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22450.exe
      4⤵
      PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44199.exe
        5⤵
        
        PID:7608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34703.exe
        6⤵
        
        PID:15176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3085.exe
        6⤵
        
        PID:17152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39378.exe
        5⤵
        
        PID:12304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63145.exe
        5⤵
        
        PID:16876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53141.exe
      4⤵
      PID:7912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16151.exe
        5⤵
        
        PID:11420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49787.exe
        5⤵
        
        PID:15660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19849.exe
      4⤵
      PID:10064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39079.exe
      4⤵
      PID:13472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54786.exe
      4⤵
      PID:15872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11001.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11001.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50239.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19487.exe
        5⤵
        
        PID:3396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17597.exe
        6⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60099.exe
        7⤵
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63358.exe
        7⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52610.exe
        7⤵
        
        PID:15444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43985.exe
        6⤵
        
        PID:9324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8625.exe
        6⤵
        
        PID:13664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48326.exe
        6⤵
        
        PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56326.exe
        5⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53467.exe
        6⤵
        
        PID:8140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53269.exe
        6⤵
        
        PID:15136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64862.exe
        6⤵
        
        PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43445.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41741.exe
        6⤵
        
        PID:12200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16158.exe
        6⤵
        
        PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11557.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19165.exe
        5⤵
        
        PID:15004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4281.exe
      4⤵
      PID:696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20167.exe
        5⤵
        
        PID:6868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36031.exe
        6⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6970.exe
        7⤵
        
        PID:12712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28603.exe
        7⤵
        
        PID:13956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1460.exe
        6⤵
        
        PID:14384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38065.exe
        6⤵
        
        PID:15572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35189.exe
        5⤵
        
        PID:8256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4422.exe
        6⤵
        
        PID:14068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19530.exe
        6⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
        5⤵
        
        PID:12976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20083.exe
        5⤵
        
        PID:1272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
      4⤵
      PID:6472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15751.exe
        5⤵
        
        PID:8944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22901.exe
        5⤵
        
        PID:10636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19937.exe
        5⤵
        
        PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5501.exe
      4⤵
      PID:4244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40801.exe
      4⤵
      PID:13708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53202.exe
      4⤵
      PID:2320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59869.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21215.exe
      4⤵
      PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26363.exe
        5⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
        6⤵
        
        PID:13172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4975.exe
        6⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41681.exe
        5⤵
        
        PID:10412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55381.exe
        5⤵
        
        PID:13860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62569.exe
        5⤵
        
        PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49798.exe
      4⤵
      PID:8068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31579.exe
        5⤵
        
        PID:13724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7109.exe
        5⤵
        
        PID:16128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1276.exe
      4⤵
      PID:8560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-195.exe
      4⤵
      PID:4744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53814.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53814.exe
    3⤵
    PID:5556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64707.exe
      4⤵
      PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56591.exe
        5⤵
        
        PID:8980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10293.exe
        6⤵
        
        PID:14392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22901.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52610.exe
        5⤵
        
        PID:15452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50949.exe
      4⤵
      PID:3172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63410.exe
      4⤵
      PID:14560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33704.exe
      4⤵
      PID:3368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57668.exe
      4⤵
      PID:3544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28916.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28916.exe
    3⤵
    PID:6744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27199.exe
      4⤵
      PID:12748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
      4⤵
      PID:1772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60970.exe
    3⤵
    PID:9716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
    3⤵
    PID:15304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32396.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32396.exe
    3⤵
    PID:2616
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21437.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21437.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10742.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4302.exe
        5⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10109.exe
        6⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63483.exe
        7⤵
        
        PID:15208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7109.exe
        7⤵
        
        PID:16152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
        6⤵
        
        PID:13124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20467.exe
        6⤵
        
        PID:12200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6601.exe
        5⤵
        
        PID:8204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
        5⤵
        
        PID:12960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12491.exe
        5⤵
        
        PID:15484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58142.exe
      4⤵
      PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63119.exe
        5⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27531.exe
        6⤵
        
        PID:10092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47318.exe
        6⤵
        
        PID:14232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41427.exe
        6⤵
        
        PID:6068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9969.exe
        5⤵
        
        PID:10488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65392.exe
        5⤵
        
        PID:5272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
      4⤵
      PID:8124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3078.exe
        5⤵
        
        PID:12640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5743.exe
        5⤵
        
        PID:16896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56342.exe
      4⤵
      PID:10268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34656.exe
      4⤵
      PID:13520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49206.exe
      4⤵
      PID:16024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32816.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21947.exe
      4⤵
      PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe
        5⤵
        
        PID:6456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27147.exe
        6⤵
        
        PID:8896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12491.exe
        6⤵
        
        PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33513.exe
        5⤵
        
        PID:10396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33680.exe
        5⤵
        
        PID:17300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42205.exe
      4⤵
      PID:8364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42886.exe
      4⤵
      PID:13132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12491.exe
      4⤵
      PID:16032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41718.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41718.exe
    3⤵
    PID:5436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54183.exe
      4⤵
      PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35367.exe
        5⤵
        
        PID:12768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42229.exe
        5⤵
        
        PID:15272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18580.exe
        5⤵
        
        PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7990.exe
        5⤵
        
        PID:5540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12325.exe
      4⤵
      PID:9728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8152.exe
      4⤵
      PID:15068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3257.exe
      4⤵
      PID:13952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64862.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35268.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35268.exe
    3⤵
    PID:7592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43919.exe
      4⤵
      PID:13204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7109.exe
      4⤵
      PID:16144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38193.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38193.exe
    3⤵
    PID:9908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
    3⤵
    PID:15044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48071.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48071.exe
    3⤵
    PID:15980
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1324.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1324.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24583.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24583.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44183.exe
      4⤵
      PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25647.exe
        5⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41437.exe
        6⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12066.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24638.exe
        7⤵
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5246.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14733.exe
        6⤵
        
        PID:13860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63145.exe
        6⤵
        
        PID:16748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8765.exe
        5⤵
        
        PID:8024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4038.exe
        6⤵
        
        PID:13168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16158.exe
        6⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42118.exe
        5⤵
        
        PID:12076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12491.exe
        5⤵
        
        PID:3936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17929.exe
      4⤵
      PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38771.exe
        5⤵
        
        PID:11096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28674.exe
        5⤵
        
        PID:16848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7692.exe
      4⤵
      PID:10368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48459.exe
      4⤵
      PID:11936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55362.exe
      4⤵
      PID:15608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3897.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3897.exe
    3⤵
    PID:1276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41983.exe
      4⤵
      PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37131.exe
        5⤵
        
        PID:8864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57494.exe
        5⤵
        
        PID:13032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23630.exe
        5⤵
        
        PID:17164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5692.exe
      4⤵
      PID:13324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37489.exe
      4⤵
      PID:16084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7456.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7456.exe
    3⤵
    PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6518.exe
      4⤵
      PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44059.exe
        5⤵
        
        PID:8784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65392.exe
        5⤵
        
        PID:3388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14245.exe
      4⤵
      PID:10640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45740.exe
      4⤵
      PID:16472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19648.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19648.exe
    3⤵
    PID:8200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-581.exe
    3⤵
    PID:12324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23451.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23451.exe
    3⤵
    PID:15388
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41109.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41109.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:396
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 396 -s 632
    3⤵
    - Program crash
    PID:1612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48995.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48995.exe
  2⤵
  PID:4428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54930.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54930.exe
    3⤵
    PID:6700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57551.exe
      4⤵
      PID:8932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41038.exe
      4⤵
      PID:15616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-596.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-596.exe
    3⤵
    PID:7696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46306.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46306.exe
    3⤵
    PID:14300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17260.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17260.exe
    3⤵
    PID:2680
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51304.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51304.exe
  2⤵
  PID:7156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64759.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64759.exe
    3⤵
    PID:7680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44227.exe
      4⤵
      PID:5936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6181.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6181.exe
    3⤵
    PID:12344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61847.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61847.exe
    3⤵
    PID:15492
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19509.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19509.exe
  2⤵
  PID:7560
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35193.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35193.exe
  2⤵
  PID:13636
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44910.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44910.exe
  2⤵
  PID:16188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 544 -ip 544
1⤵
PID:4428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 396 -ip 396
1⤵
PID:3252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 15336 -ip 15336
1⤵
PID:14864

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -u -p 1016 -s 11092
1⤵
PID:13980

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17120

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:19208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11001.exe

Filesize
468KB

MD5
f5a5236c1e97b843a1ab3864ace62609

SHA1
5d670cf3c305268dcc9830a083d472f4fb79835b

SHA256
cfa5ea89b9411d3b7641629641adde9b9a0a0d38f14870b8a698c3c0239466d0

SHA512
43b8e533df252954abba7b0ff067307fb499200afdca893b7a223f9d372851a224c5b362ce7808d421f4f719697dc7e8bbfcbd3f788eda9feb4c2d293da32ee1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1324.exe

Filesize
468KB

MD5
2dae870620be8c32cf781b96ff3204f4

SHA1
fe0038bc4f0b19d6290b3c048414b5eb07d4f658

SHA256
22a17e0579f91662aada6d7b714fe5944eaf248d0093c95de9dae631043a6330

SHA512
a78e44efd6177a6af3075ee6d81a1ca2008c32498ec0c07c9ed027918db4a73a85adc722635c9454f86a5b98608f67c93c9099b2fa4daa7949b9c538dca06604

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14265.exe

Filesize
468KB

MD5
1200e3a1aa7ecb07b1b68c7bde8225ef

SHA1
b679f0deadda25834fae0287fcc7cfbbd1230cf1

SHA256
a0298ff8081a235a8c4327be97dbbc38a74ff0244a38eb7375a17221225759c5

SHA512
7976c14b157c145e070a3d3816e099ea447aafb9fc4b8d18beee0ceb63e2fc181dd2ca08beba76f1147c6dd2b9dcc79ad0bfab1f98f7987a30426982bd475179

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16097.exe

Filesize
468KB

MD5
2761ce4584d4cc14d299110e354e8fd1

SHA1
d3a7b09fbfe270a4c61260802aa554d8f6190daa

SHA256
274726648faf387167768c90c6cf8c360ec96631dd8cf9c396494d4febc784c2

SHA512
de7a4a896abb7533852260d208f5ec94b3c41604a973d05387f54bdfc15e25bfd06458785c2a254577fe6b455bab9b936dc306a32a378e5feb80bc9a3fc3d1ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18231.exe

Filesize
468KB

MD5
3615592a2f9421dfb10e746827c18941

SHA1
48f62ecad7ac37a48b54e306c0e5b9d1c37c090d

SHA256
e74a1807ed31728354957f9945395cbb9a47148646e9e77955612670bc62c511

SHA512
700bb5c46abf46325902badbbe0cab402a249c2846dc197bfffeaab914970311517a60790ccb541ac65efbde945633201ab3a8c8b316c92cf9140e4e973cdeb8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19959.exe

Filesize
468KB

MD5
e0c1e2bc86c6f042da5dbcb90342c665

SHA1
bf944afafce6e7939fbc0c2e42b6ad7e30042cea

SHA256
0de82f7912b2644e39d124454a68f5508e11a50571174c14fc10b54d94e984b9

SHA512
cd6c89bb8fea6bf22a178a4ceb018add6305b186d8edd4c673b924e169338fbe1f266ae229ff72402cffe6857efa8f3d8170b568a15cf86edb55d3b53f7b3660

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21437.exe

Filesize
468KB

MD5
c45f17c8248146a2926bded458ffcafc

SHA1
2e05e6513ad8fbf5c9f930f5d517fb6b79c54fbe

SHA256
786c7a15251126cc9e96d392f3708c5e9a2080234a773c8f13dd4cfe03c8905c

SHA512
1c34b5ecd95de6f50ad1bb00eea9faaaa9d46072abf74f75c3e9670807fed19e731fd6219cd98c8418f8e27d4710bc5b11e6030e90a2e53d28194e2544794aae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24967.exe

Filesize
468KB

MD5
bacb9cc8aff80a00e1ac438332fb517a

SHA1
8cd580bf429672e052276de918b21f5c656e7975

SHA256
0a6bc0d3e0283c9de939187c55a59151851735f543c8d677f061499c17e79088

SHA512
ab0b0fcc656a53b23585819fd54582f7d2942287d80b60f60163193b056fe9d3682ecd849e3328804e9db6ec9849c47e51314e89f6bcfde489394d5fc9524e29

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27337.exe

Filesize
468KB

MD5
77f49deb16286a0552338bfe2ec1cfd8

SHA1
a49014ab7b0dd6a5518ae5f5754cb351c44b22ab

SHA256
9539accdadce36f811cf7281f5885ddf951fc32a1ad41c54af62d74a3df950c4

SHA512
a76460a06602cd1c3e2d9eeb963ab0b0840481b72ee4cb56db7409af825d1a79608bb7b54a1aac5c799783d11b3ad99b63d901ecd09ad772777be54a030543c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27530.exe

Filesize
468KB

MD5
d514a3563f5d2e0e59d5519a796adfd6

SHA1
9723abf95067858a27947fd3c913581030a602a9

SHA256
db4be12a546d7197d5c63459e245a6a616d4f8ec428ff5fe2355f053fafe2dde

SHA512
5b33a315e435eed92ac7c1555f20d862b92def2b3d8c86a3449dca2e599b30245f8c80297e651fbd8674fb8c12511537eae9e2f6e2b354eb1f6d009016a2f54c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2906.exe

Filesize
468KB

MD5
931131ee49e53fdbc67ea1933f211b7a

SHA1
75d6dfc6f7083106d7079568eee72f011ee72b31

SHA256
2cee25eef4e2f67c707c5c4a9b1d2adea4b8c7196fa4a140dd8bb01ab8247fb5

SHA512
fea91f015bc47afb828015db28ba0693f78d2cba276b325cb0b251c88c77e236cb4e630d33d0921058ed16e5002985e69646baeb8ef08c2877009390d955cfd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29399.exe

Filesize
468KB

MD5
e0cb20e2d16f7c88ff9435c4e9fea1ba

SHA1
4904d29b07b8512239b936b73b7f881be96b883d

SHA256
308a70faca738bdbe5b14a41ebe0abff4a525966cdbfe58efa0f2fbc92aa5241

SHA512
236cd94bf6723cc8e4d450dd88491b023042d073b28a8dda41be0afa2f5687c50cc3cc4064ed885c185a01a3b63f78c7875917c5cc35e0962235d73e9a1d7616

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30496.exe

Filesize
468KB

MD5
b4c12bcc73901ae94e00089913fb83aa

SHA1
eeb8a90e2b1e8a4032d266d20e0e880d7ee99524

SHA256
2da8b81d6d64a828852b47204f8d6cdf326b4d93f66cbae6d45f70e360d3761e

SHA512
d2d3467c8cd2b3e3dfa9782ff15b85dd3bb5767f3fbf0a3d6f03f10c0579bf163c0648a2874dfd7479a13b03fb8658c102938566aea531b8839fb190be4b6c95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30867.exe

Filesize
468KB

MD5
902cb6770bce6afacb7a980a2116fe70

SHA1
010f9617394be8e19556c8f2873550cd3dc38be8

SHA256
b45e4dfac4c1d246cb7135c0f432fa8d3c105d92808f4a53c779b376640cca59

SHA512
899d455ea8a4aabeb2f3b4542e5752bb8cfc29a1d05939fc7062a11050adc47543afb9f445922dd85c3b6c7180fdcbd113c01b326d4a8ff9146f826f793843aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34759.exe

Filesize
468KB

MD5
676d6e92683eb5cb40e7aa1d7c17fb02

SHA1
ba7e0ad72e486b9ea1ed9526784bc2977967a78f

SHA256
54be9df7383c45db00dbeb99b3ff6b3f59f6818ec97c0e9cff670dcce35bb0a0

SHA512
38e4721476f599b31292171ce59911bba7a49d0c0eb9e6c99ff2466ba5f728f28523b0cc7fb660cc6d0897aa3108f53341ab3a53da08ac6bfa96332f22653abc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37146.exe

Filesize
468KB

MD5
3012c197924467f3f15ddd1be89fe26f

SHA1
5c685723a2c2af578e86a59d8dcb3865e817efb8

SHA256
677d92ecb1c8bc645ec2adb1a5f9d103fd9be8ce0a4144cb8ac2fdd78d12c9a1

SHA512
3c5fe5f95894f56cb2dc76205657e3242e95001418319648fc2740726fb73170eb1345778f06a963b5d7247a18ee0b694b49aec81c2bd6f0a846d6a1795a804c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37181.exe

Filesize
468KB

MD5
fa1f6fe0736f181e8215ebfec132181b

SHA1
53b6a9a53a66f0adecedca2502b60775d02af0c9

SHA256
082b52e5f44c3b9770c51b67dd48e018395afee11ea54e1744ede19619e46e03

SHA512
ab0f24fc49d71fd70228901e409d18d10181384d7c6b03a65d4cb46670ebca9125247c278e343ebb46a2aa7c5e8fb9bf1a37345f36afd075ea78fbd4af20edf5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37966.exe

Filesize
468KB

MD5
3ddf71086ab3c1d54413890f1cf4681d

SHA1
147488a7a8c4ae7b70954e428739b8c37d61fb57

SHA256
73084119fb12318cc191725a1a9203c8d139266532a13ca4994ccabab47ddd4a

SHA512
67ff6709fff089b6ad5561c4dc29502ca033c408b01f3cb3d52480b41e4ce9c0e5f3c811539f3b8688139bab9f67178884c70bcc7db21cb5db2b0603f86e7e60

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38001.exe

Filesize
468KB

MD5
9028ab3e4e7f6ccdb87451f72e3ea7e8

SHA1
e024ee51a349110154e1903d09e8b0ec29305f21

SHA256
c8ce8ce5407ad18dff2f90fabd1919270700c0c5ae45c8c9ce065af2acc4047f

SHA512
9c1e7715ff1b81c2e7b653c19f615e52148f6bb56e967fe978d7204c4fdee788d6bf4605327332952b2658b0d2c302b013de1f27919c6274bebdb56b90bf6aea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3845.exe

Filesize
468KB

MD5
c4754146a6a7c1a4cb17d0a00d4128e0

SHA1
81b4246b0ba49e2b6c5d35e97347760b337a2911

SHA256
a406206b268db2bae6cf9e9c82432913db303a54981019baa502f95b8ce09267

SHA512
2d11d561562c408fe8dfe56fa0cbee770c9d5b4d3f8ffa7ced0c6b5cd276235c4a86040429f7d81b381f3e4d3acc4031b724496a63346fabafbb83f6e5d17f5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39397.exe

Filesize
468KB

MD5
8fa9cc438c551e79fd808bdf413d969d

SHA1
d17261f2d54403a5d87c1d8ea9f8ce8e62066b72

SHA256
14db72f26e3208aae1acd21eda90ac835f9f82c9ec5f10c3d63bf85cfd34bdb2

SHA512
04aa2e928cbe58f1e44267bb2b3c350e1b9086fc0ddc6089df97f30a1b1f434f6845b79adb001e4639941f41dd0cb2e60bef9dfbd8e98e7e1caabcfd02c00935

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41073.exe

Filesize
468KB

MD5
d6c4ff29c1d18a305be913f8cfa42009

SHA1
52c96181f2edb19ee84d59f099ac538976a558a5

SHA256
d241d396e76943635edb7a750eab14e553a6c798b9b12dbc34addc075ce5b22e

SHA512
55cb995f4ee1c10bd74cd59ec9543c214adae12c2a9bd59ca3e0ee5562ffe986a8b12909aa5454e9fa0d27347d176b8023e38cb439cf7df8cb26261663059aa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4124.exe

Filesize
468KB

MD5
57bfd6da28dd7a748714881df121c6fd

SHA1
62447c3610fe661ec5fec2b83256d7d65c0311a0

SHA256
ea7305a95baa2dd07ac24947f6a92e3463272a6c45a56a11fff6df16d2206ac8

SHA512
1b2d01cbabd5ed4332b9914370e7d279024ce1fe4019b7f2906eba462b6f09bc918d18d06844fba098df05d04deb0c24d948e8db509b88be30004d57a4c9d375

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47203.exe

Filesize
468KB

MD5
54b371e2ab58b240fc65c371dd45d95c

SHA1
d3ed24443f0c631d581c0f9deb8c58b251c0ba42

SHA256
3900e7c33e5f87ad9a2a1823be5b3700789985ce178348e77c05c15cce08b099

SHA512
a17a695e7fdc9a0601d30d7ba62db08eb535a066048d916a0ca71297f2cd34a6ed47a7bc9a24ec2567e34430ca8dae26d7d488c209f0aa9470d0ea3e7bf3b1ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48023.exe

Filesize
468KB

MD5
9d73abd4a2b7aa3a875743013cdd2458

SHA1
35481337d09403cfc8bc6d92b8580ffde866a325

SHA256
3f7ed135075c79f203680decde9f4bf5e014a545790afd817584dbfaad91ea6c

SHA512
6529d8f8514b381c0f14b2f7eb6e5eec47c30593de3d6be919cd69d7351efa456820d5353cf991dd1305d059679bd0626becfaa9533694e3b03dfd09b57267fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48215.exe

Filesize
468KB

MD5
3e53c3dfaff6117fad153c6a90a26ed9

SHA1
1dc7bd8bdab875f5f79545d5d0ff7fee81c36e0c

SHA256
eb786c007e6e9d40d580a496a2c8fd731e419b3db162deae3b37e7d140966ee2

SHA512
fa1a858b8aa1c08c1cf4b94ee18aa1095cf372bae1eb7d2f443f8b8a09e9137f44f4b712f1cf2857560c6c8bdd23f48ed30b84d63bfb1122d40f5b3d853acbb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe

Filesize
468KB

MD5
f23aef390cf07a225f49feb26644207a

SHA1
d790cfb3b5fe8db330c477b9996095e32646525a

SHA256
8156284ee282119a5a738d5088c87a1426305a01bfcb4bd3992c7b41bb51574f

SHA512
dbf9bb8e499e57ca4a8e820fbd07488d8e5933557ce122d416cd74665433c5582a70d71fccd7bfa93c685af7e22708c46f4b17c544ba1e9719cb955d04d9f67e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51267.exe

Filesize
468KB

MD5
7ac7d59f27343fb52b14516e68cdb0a0

SHA1
7f29f02e38678a26104309dd6d425a854f6df6cd

SHA256
2193dcb9ec648e6d33d02688c96bbc17bbe571e76acc460ee3d50a8dffd8fea7

SHA512
c546b08604e81619916720a7333174ebd4c6866cc49f55b8eed2099ce9fc8412fce3db213faa6776fdaae821036a2e80e522545e421b3aade809e28dd85a9e65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51650.exe

Filesize
468KB

MD5
2f0113aeffa6420a375197a5cfae8645

SHA1
42d6159b39ccf5ac8e6b85a8ce474a8de8efff6a

SHA256
9cd3e97d025576df69d629f4ab6449a923834ed963f205ca4bf0017549db5ed9

SHA512
68b418ab1b85e2a0b5b19392f7d7fed173c9e7a51475e4b71d56e6e39036699db746beccc234e85aa709775bbd6799076e46f0813d8187cd5ee3cc1840c87fa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57047.exe

Filesize
468KB

MD5
3aaa9f307ac19aa1a321a387321a69d1

SHA1
f4a6b53a0b4c3a3a8367dfdfe9fa5055d4903509

SHA256
b274051437a0909aa9793074f765eea0760316255f390f2231a96bf9ce33ddfe

SHA512
63604834c6fbaff5f17240f7c58f64ceb701133682788b4ad4e0c509d703d2f539093747a4eca3afe99e639ce53e3b6cb8dcc76b71d2f08970abddfc71b9fec8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63347.exe

Filesize
468KB

MD5
2728407c4b37f2bea80bbf6e1596a692

SHA1
ac86fc34379dccc3ca541b1b4a1ff5bc4aa58eac

SHA256
124f68f843b77bf6040661f8eacef82fe41b0d03ed44d3cddde7db539e56dd47

SHA512
d20b31d7e3ab822856c3c3b71ebbfb13738df466da23905d2e9cb8afb025fef8e5c72a1e1b0d99e5ee9c969c56f627fa50bd039e7b166d0fad31aaad1e3f558c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7654.exe

Filesize
468KB

MD5
1e145fb6ca1fb15a489060cdc4f3cc16

SHA1
b1c6eb6d497937e54381d81e56a70d0235b49ab2

SHA256
13591ecbb12ddae4874034a4f05b40f018f5f6563e77cc37832c28746f0a4943

SHA512
747c73b7519c38c4d6638138646ae1074748befd81f0658127ca0be7782c0d941edff11a63d3e45dd71df5356960622b32a3fdd5eac63addc97a985bcbb0c730

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9989.exe

Filesize
468KB

MD5
c3314df8b66966b77c0f892af6b722b8

SHA1
237860b400156c3f5133d632fac979511c001986

SHA256
bb533a6b2011649f4bc686f895b16f349d853f78e403ae27d0b433b5658f0044

SHA512
83dc2d5a30ff35a3a73104a20c44cb3b8acae6b51f7305bd5645434c19daec71a3d1420a6e48fc5c14f3a5f32d9ae2e8bef881f88a145b77faa43ea8998038c4

Download Submit
memory/228-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/396-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/544-190-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/672-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/748-221-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1068-444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1080-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1240-49-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1276-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1372-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1396-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1700-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1764-2606-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1764-113-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1824-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1828-437-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1916-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1932-189-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1992-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2012-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2140-62-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2144-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2176-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2196-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2312-463-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2352-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2468-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2476-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2480-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2544-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2972-355-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3000-299-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3008-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3040-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3116-273-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3132-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3148-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3188-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3232-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3240-417-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3396-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3400-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3628-434-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3684-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3768-356-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3820-73-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4004-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4112-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4128-20-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4232-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4324-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4340-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4356-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4388-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4400-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4428-436-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4556-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4564-145-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4588-125-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4588-2607-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4596-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4604-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4624-160-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4680-158-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4748-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4752-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4764-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4768-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4880-67-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4904-255-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4924-425-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4940-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4948-2612-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4948-162-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5032-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5044-154-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5092-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5112-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5156-466-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5172-467-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5192-468-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5204-469-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5224-482-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5236-486-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5252-487-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5292-489-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5332-529-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5340-490-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5392-531-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5412-552-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5428-558-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5472-565-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5480-561-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5508-566-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5556-567-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5564-576-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5668-580-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5676-577-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/11732-2742-0x00007FF861170000-0x00007FF8611C9000-memory.dmp

Filesize
356KB

Download
memory/13980-3002-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14056-2850-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14372-2639-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15232-2428-0x00007FF861170000-0x00007FF8611C9000-memory.dmp

Filesize
356KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads