7e2a86d259aba885ad405a61248536beea19da54d90cf5ae312d842848a7d5c2

Analysis

max time kernel
120s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ee518919587dc6394d495f9affaf2350N.exe
Size

468KB
MD5

ee518919587dc6394d495f9affaf2350
SHA1

7862778d8ffd16693e99296f0cb77d64c30c8d78
SHA256

7e2a86d259aba885ad405a61248536beea19da54d90cf5ae312d842848a7d5c2
SHA512

81ace51267ca20b2a5fc7fa159e6ac4591227d3193df1123f78d2107fffb6435ec65345c420ee8bf010e936fc5dd99c2caf1aad329c569c0a9ea90283699c777
SSDEEP

3072:MJGTogIOnd5UtbYrPvtycf8+PCnzwWpwnmHeifqoroAd8mpubjlA:MJyoUbUt8PFycfr2KIroYrpub

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
60	Unicorn-19224.exe
4420	Unicorn-53816.exe
116	Unicorn-5170.exe
1204	Unicorn-27496.exe
1536	Unicorn-52747.exe
3812	Unicorn-945.exe
1072	Unicorn-46883.exe
2780	Unicorn-35228.exe
3964	Unicorn-64371.exe
3392	Unicorn-61770.exe
2924	Unicorn-2363.exe
1084	Unicorn-6447.exe
4368	Unicorn-10266.exe
2964	Unicorn-25052.exe
1472	Unicorn-23005.exe
2384	Unicorn-20392.exe
4144	Unicorn-21330.exe
1484	Unicorn-13375.exe
2880	Unicorn-13375.exe
840	Unicorn-1123.exe
3852	Unicorn-1123.exe
808	Unicorn-33417.exe
1384	Unicorn-36218.exe
4440	Unicorn-22482.exe
4052	Unicorn-42083.exe
4588	Unicorn-39800.exe
2456	Unicorn-56691.exe
3620	Unicorn-11019.exe
3492	Unicorn-6670.exe
2196	Unicorn-10635.exe
3156	Unicorn-59836.exe
3640	Unicorn-39970.exe
732	Unicorn-61874.exe
1276	Unicorn-49099.exe
1572	Unicorn-38522.exe
3220	Unicorn-32016.exe
1724	Unicorn-3790.exe
3164	Unicorn-7319.exe
4352	Unicorn-9026.exe
2760	Unicorn-61564.exe
1336	Unicorn-4195.exe
868	Unicorn-49239.exe
4564	Unicorn-33722.exe
836	Unicorn-29084.exe
5088	Unicorn-29084.exe
2108	Unicorn-58227.exe
452	Unicorn-12555.exe
4196	Unicorn-20724.exe
2248	Unicorn-18677.exe
3336	Unicorn-40374.exe
3896	Unicorn-56910.exe
3292	Unicorn-59016.exe
3612	Unicorn-13899.exe
4108	Unicorn-13899.exe
2536	Unicorn-17984.exe
1460	Unicorn-43234.exe
2476	Unicorn-24489.exe
4820	Unicorn-25773.exe
4148	Unicorn-14838.exe
2276	Unicorn-26344.exe
5076	Unicorn-18346.exe
1396	Unicorn-42488.exe
832	Unicorn-21876.exe
1320	Unicorn-21876.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
2612	3336	WerFault.exe	142
16224	16740	WerFault.exe	813
19288	16812	WerFault.exe	820
18980	16760	WerFault.exe	814

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7017.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64858.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-769.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19292.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35859.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26693.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9535.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16208.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11041.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38878.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5989.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24122.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43944.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31234.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13134.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6469.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47502.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16937.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40162.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28510.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31149.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8676.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37312.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61078.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15709.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20990.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40674.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65178.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50908.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16326.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16580	dwm.exe
Token: SeChangeNotifyPrivilege	16580	dwm.exe
Token: 33	16580	dwm.exe
Token: SeIncBasePriorityPrivilege	16580	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
464	ee518919587dc6394d495f9affaf2350N.exe
60	Unicorn-19224.exe
116	Unicorn-5170.exe
4420	Unicorn-53816.exe
1204	Unicorn-27496.exe
1536	Unicorn-52747.exe
3812	Unicorn-945.exe
1072	Unicorn-46883.exe
2780	Unicorn-35228.exe
2924	Unicorn-2363.exe
3392	Unicorn-61770.exe
4368	Unicorn-10266.exe
3964	Unicorn-64371.exe
1084	Unicorn-6447.exe
2964	Unicorn-25052.exe
1472	Unicorn-23005.exe
2384	Unicorn-20392.exe
4144	Unicorn-21330.exe
1484	Unicorn-13375.exe
2880	Unicorn-13375.exe
840	Unicorn-1123.exe
4052	Unicorn-42083.exe
3852	Unicorn-1123.exe
4440	Unicorn-22482.exe
1384	Unicorn-36218.exe
808	Unicorn-33417.exe
4588	Unicorn-39800.exe
2456	Unicorn-56691.exe
3620	Unicorn-11019.exe
3492	Unicorn-6670.exe
2196	Unicorn-10635.exe
3156	Unicorn-59836.exe
3640	Unicorn-39970.exe
732	Unicorn-61874.exe
1276	Unicorn-49099.exe
1572	Unicorn-38522.exe
3220	Unicorn-32016.exe
3164	Unicorn-7319.exe
1724	Unicorn-3790.exe
4352	Unicorn-9026.exe
2760	Unicorn-61564.exe
1336	Unicorn-4195.exe
4564	Unicorn-33722.exe
452	Unicorn-12555.exe
2248	Unicorn-18677.exe
3896	Unicorn-56910.exe
5088	Unicorn-29084.exe
868	Unicorn-49239.exe
836	Unicorn-29084.exe
2108	Unicorn-58227.exe
3336	Unicorn-40374.exe
4196	Unicorn-20724.exe
3292	Unicorn-59016.exe
1460	Unicorn-43234.exe
4108	Unicorn-13899.exe
3612	Unicorn-13899.exe
2536	Unicorn-17984.exe
4820	Unicorn-25773.exe
4148	Unicorn-14838.exe
2476	Unicorn-24489.exe
2276	Unicorn-26344.exe
5076	Unicorn-18346.exe
832	Unicorn-21876.exe
1320	Unicorn-21876.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 464 wrote to memory of 60	464	ee518919587dc6394d495f9affaf2350N.exe	90
PID 464 wrote to memory of 60	464	ee518919587dc6394d495f9affaf2350N.exe	90
PID 464 wrote to memory of 60	464	ee518919587dc6394d495f9affaf2350N.exe	90
PID 60 wrote to memory of 4420	60	Unicorn-19224.exe	92
PID 60 wrote to memory of 4420	60	Unicorn-19224.exe	92
PID 60 wrote to memory of 4420	60	Unicorn-19224.exe	92
PID 464 wrote to memory of 116	464	ee518919587dc6394d495f9affaf2350N.exe	93
PID 464 wrote to memory of 116	464	ee518919587dc6394d495f9affaf2350N.exe	93
PID 464 wrote to memory of 116	464	ee518919587dc6394d495f9affaf2350N.exe	93
PID 116 wrote to memory of 1204	116	Unicorn-5170.exe	96
PID 116 wrote to memory of 1204	116	Unicorn-5170.exe	96
PID 116 wrote to memory of 1204	116	Unicorn-5170.exe	96
PID 60 wrote to memory of 1536	60	Unicorn-19224.exe	97
PID 60 wrote to memory of 1536	60	Unicorn-19224.exe	97
PID 60 wrote to memory of 1536	60	Unicorn-19224.exe	97
PID 464 wrote to memory of 3812	464	ee518919587dc6394d495f9affaf2350N.exe	98
PID 464 wrote to memory of 3812	464	ee518919587dc6394d495f9affaf2350N.exe	98
PID 464 wrote to memory of 3812	464	ee518919587dc6394d495f9affaf2350N.exe	98
PID 4420 wrote to memory of 1072	4420	Unicorn-53816.exe	99
PID 4420 wrote to memory of 1072	4420	Unicorn-53816.exe	99
PID 4420 wrote to memory of 1072	4420	Unicorn-53816.exe	99
PID 1204 wrote to memory of 2780	1204	Unicorn-27496.exe	100
PID 1204 wrote to memory of 2780	1204	Unicorn-27496.exe	100
PID 1204 wrote to memory of 2780	1204	Unicorn-27496.exe	100
PID 116 wrote to memory of 3964	116	Unicorn-5170.exe	101
PID 116 wrote to memory of 3964	116	Unicorn-5170.exe	101
PID 116 wrote to memory of 3964	116	Unicorn-5170.exe	101
PID 60 wrote to memory of 3392	60	Unicorn-19224.exe	102
PID 60 wrote to memory of 3392	60	Unicorn-19224.exe	102
PID 60 wrote to memory of 3392	60	Unicorn-19224.exe	102
PID 1536 wrote to memory of 2924	1536	Unicorn-52747.exe	103
PID 1536 wrote to memory of 2924	1536	Unicorn-52747.exe	103
PID 1536 wrote to memory of 2924	1536	Unicorn-52747.exe	103
PID 3812 wrote to memory of 1084	3812	Unicorn-945.exe	104
PID 3812 wrote to memory of 1084	3812	Unicorn-945.exe	104
PID 3812 wrote to memory of 1084	3812	Unicorn-945.exe	104
PID 464 wrote to memory of 4368	464	ee518919587dc6394d495f9affaf2350N.exe	105
PID 464 wrote to memory of 4368	464	ee518919587dc6394d495f9affaf2350N.exe	105
PID 464 wrote to memory of 4368	464	ee518919587dc6394d495f9affaf2350N.exe	105
PID 1072 wrote to memory of 2964	1072	Unicorn-46883.exe	106
PID 1072 wrote to memory of 2964	1072	Unicorn-46883.exe	106
PID 1072 wrote to memory of 2964	1072	Unicorn-46883.exe	106
PID 4420 wrote to memory of 1472	4420	Unicorn-53816.exe	107
PID 4420 wrote to memory of 1472	4420	Unicorn-53816.exe	107
PID 4420 wrote to memory of 1472	4420	Unicorn-53816.exe	107
PID 2780 wrote to memory of 2384	2780	Unicorn-35228.exe	108
PID 2780 wrote to memory of 2384	2780	Unicorn-35228.exe	108
PID 2780 wrote to memory of 2384	2780	Unicorn-35228.exe	108
PID 1204 wrote to memory of 4144	1204	Unicorn-27496.exe	109
PID 1204 wrote to memory of 4144	1204	Unicorn-27496.exe	109
PID 1204 wrote to memory of 4144	1204	Unicorn-27496.exe	109
PID 4368 wrote to memory of 1484	4368	Unicorn-10266.exe	110
PID 3964 wrote to memory of 2880	3964	Unicorn-64371.exe	111
PID 3964 wrote to memory of 2880	3964	Unicorn-64371.exe	111
PID 3964 wrote to memory of 2880	3964	Unicorn-64371.exe	111
PID 4368 wrote to memory of 1484	4368	Unicorn-10266.exe	110
PID 4368 wrote to memory of 1484	4368	Unicorn-10266.exe	110
PID 3392 wrote to memory of 3852	3392	Unicorn-61770.exe	113
PID 3392 wrote to memory of 3852	3392	Unicorn-61770.exe	113
PID 2924 wrote to memory of 840	2924	Unicorn-2363.exe	112
PID 3392 wrote to memory of 3852	3392	Unicorn-61770.exe	113
PID 2924 wrote to memory of 840	2924	Unicorn-2363.exe	112
PID 2924 wrote to memory of 840	2924	Unicorn-2363.exe	112
PID 464 wrote to memory of 808	464	ee518919587dc6394d495f9affaf2350N.exe	114

C:\Users\Admin\AppData\Local\Temp\ee518919587dc6394d495f9affaf2350N.exe
"C:\Users\Admin\AppData\Local\Temp\ee518919587dc6394d495f9affaf2350N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19224.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19224.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:60
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53816.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46883.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25052.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39800.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17984.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7615.exe
        8⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27984.exe
        9⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19736.exe
        10⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51427.exe
        10⤵
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22365.exe
        10⤵
        
        PID:15924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38086.exe
        10⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33694.exe
        9⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37691.exe
        9⤵
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51958.exe
        9⤵
        
        PID:17224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8801.exe
        9⤵
        
        PID:5160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34986.exe
        8⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34780.exe
        9⤵
        
        PID:9824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8874.exe
        9⤵
        
        PID:13676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8676.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26522.exe
        8⤵
        
        PID:12456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9187.exe
        8⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37200.exe
        8⤵
        
        PID:17968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50355.exe
        7⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42216.exe
        8⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13134.exe
        9⤵
        
        PID:10844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8769.exe
        9⤵
        
        PID:15352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46830.exe
        9⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        8⤵
        
        PID:8976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20725.exe
        8⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12574.exe
        8⤵
        
        PID:16156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54693.exe
        8⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54342.exe
        7⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22980.exe
        8⤵
        
        PID:16548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6233.exe
        8⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5350.exe
        7⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
        7⤵
        
        PID:12760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52958.exe
        7⤵
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        7⤵
        
        PID:17704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14838.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53884.exe
        7⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26648.exe
        8⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12839.exe
        9⤵
        
        PID:16420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23145.exe
        9⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50135.exe
        8⤵
        
        PID:9664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65458.exe
        8⤵
        
        PID:13660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8298.exe
        8⤵
        
        PID:17112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62861.exe
        8⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45459.exe
        7⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59544.exe
        8⤵
        
        PID:16860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14401.exe
        8⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57989.exe
        8⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29993.exe
        7⤵
        
        PID:11052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9398.exe
        7⤵
        
        PID:14852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34080.exe
        7⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11574.exe
        6⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe
        7⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13134.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49995.exe
        7⤵
        
        PID:16320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        7⤵
        
        PID:7904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2829.exe
        6⤵
        
        PID:8752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50835.exe
        6⤵
        
        PID:12012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41860.exe
        6⤵
        
        PID:16304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49452.exe
        6⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30493.exe
        6⤵
        
        PID:18492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56691.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59016.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53116.exe
        7⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5874.exe
        8⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37188.exe
        9⤵
        
        PID:11824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8926.exe
        9⤵
        
        PID:17044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57877.exe
        9⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40982.exe
        8⤵
        
        PID:11852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19366.exe
        8⤵
        
        PID:15832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34611.exe
        8⤵
        
        PID:17804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60067.exe
        7⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5387.exe
        8⤵
        
        PID:14604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45110.exe
        8⤵
        
        PID:18684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39366.exe
        7⤵
        
        PID:9572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42735.exe
        7⤵
        
        PID:13480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57002.exe
        7⤵
        
        PID:17040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13461.exe
        7⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41418.exe
        6⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17136.exe
        7⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1443.exe
        8⤵
        
        PID:16484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44970.exe
        8⤵
        
        PID:18024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        7⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20725.exe
        7⤵
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12574.exe
        7⤵
        
        PID:16348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54693.exe
        7⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13309.exe
        6⤵
        
        PID:7832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9434.exe
        6⤵
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
        6⤵
        
        PID:12348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21437.exe
        6⤵
        
        PID:17096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24489.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4683.exe
        6⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9543.exe
        7⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15599.exe
        8⤵
        
        PID:9384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59699.exe
        8⤵
        
        PID:12888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18769.exe
        8⤵
        
        PID:16956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26218.exe
        8⤵
        
        PID:892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20725.exe
        7⤵
        
        PID:12444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12574.exe
        7⤵
        
        PID:15820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe
        7⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34986.exe
        6⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52740.exe
        7⤵
        
        PID:9476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10357.exe
        7⤵
        
        PID:5108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22133.exe
        7⤵
        
        PID:17116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10777.exe
        6⤵
        
        PID:9720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43695.exe
        6⤵
        
        PID:13800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65170.exe
        6⤵
        
        PID:17108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5293.exe
        6⤵
        
        PID:17888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62555.exe
        5⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48796.exe
        6⤵
        
        PID:7640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63539.exe
        6⤵
        
        PID:10008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43223.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55374.exe
        6⤵
        
        PID:17684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
        5⤵
        
        PID:7952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60627.exe
        5⤵
        
        PID:9020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62908.exe
        5⤵
        
        PID:15100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29032.exe
        5⤵
        
        PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23005.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11019.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13899.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7807.exe
        7⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5874.exe
        8⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25268.exe
        9⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8526.exe
        9⤵
        
        PID:14124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47597.exe
        9⤵
        
        PID:792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24462.exe
        9⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31846.exe
        8⤵
        
        PID:10908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55316.exe
        8⤵
        
        PID:4160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6316.exe
        8⤵
        
        PID:17944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55407.exe
        7⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62948.exe
        8⤵
        
        PID:14976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26653.exe
        8⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59786.exe
        7⤵
        
        PID:9636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5786.exe
        7⤵
        
        PID:13644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65170.exe
        7⤵
        
        PID:17124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1017.exe
        7⤵
        
        PID:3256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38870.exe
        6⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29912.exe
        7⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33576.exe
        8⤵
        
        PID:11564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25209.exe
        8⤵
        
        PID:16612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57737.exe
        8⤵
        
        PID:18992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58251.exe
        7⤵
        
        PID:10860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49995.exe
        7⤵
        
        PID:16256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55374.exe
        7⤵
        
        PID:17700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59490.exe
        6⤵
        
        PID:8660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55423.exe
        6⤵
        
        PID:11572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60598.exe
        6⤵
        
        PID:16340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53918.exe
        6⤵
        
        PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43234.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4683.exe
        6⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61411.exe
        7⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49070.exe
        7⤵
        
        PID:9624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49279.exe
        7⤵
        
        PID:14260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45181.exe
        7⤵
        
        PID:16748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        7⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35178.exe
        6⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16436.exe
        7⤵
        
        PID:15768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47458.exe
        7⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30813.exe
        6⤵
        
        PID:9800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
        6⤵
        
        PID:13988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16208.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        6⤵
        
        PID:17636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64858.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62008.exe
        6⤵
        
        PID:7288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65178.exe
        6⤵
        
        PID:15160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47675.exe
        5⤵
        
        PID:8588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25827.exe
        6⤵
        
        PID:18644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38049.exe
        5⤵
        
        PID:12168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3030.exe
        5⤵
        
        PID:15916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17698.exe
        5⤵
        
        PID:7176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6670.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13899.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49800.exe
        6⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42024.exe
        7⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61396.exe
        8⤵
        
        PID:11308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60379.exe
        8⤵
        
        PID:14748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11992.exe
        8⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53103.exe
        7⤵
        
        PID:9276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12557.exe
        7⤵
        
        PID:12304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-514.exe
        7⤵
        
        PID:16556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55077.exe
        7⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34986.exe
        6⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26522.exe
        6⤵
        
        PID:12464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9187.exe
        6⤵
        
        PID:16036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49452.exe
        6⤵
        
        PID:664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59291.exe
        5⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17712.exe
        6⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41168.exe
        7⤵
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60571.exe
        7⤵
        
        PID:15320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32220.exe
        7⤵
        
        PID:17788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11737.exe
        6⤵
        
        PID:9324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28475.exe
        6⤵
        
        PID:13844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2376.exe
        6⤵
        
        PID:8148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65058.exe
        5⤵
        
        PID:7080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1915.exe
        6⤵
        
        PID:9588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25105.exe
        6⤵
        
        PID:15112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58698.exe
        6⤵
        
        PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-114.exe
        5⤵
        
        PID:10028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7017.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44597.exe
        5⤵
        
        PID:212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25773.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4875.exe
        5⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38132.exe
        6⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7675.exe
        7⤵
        
        PID:8732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56435.exe
        7⤵
        
        PID:12176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44130.exe
        7⤵
        
        PID:16296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1329.exe
        7⤵
        
        PID:19008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34357.exe
        6⤵
        
        PID:8128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47011.exe
        6⤵
        
        PID:12924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15393.exe
        6⤵
        
        PID:17240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9761.exe
        6⤵
        
        PID:17904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40606.exe
        5⤵
        
        PID:7720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65022.exe
        5⤵
        
        PID:9172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34557.exe
        5⤵
        
        PID:14012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37581.exe
        5⤵
        
        PID:15796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49606.exe
      4⤵
      PID:2336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38900.exe
        5⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13259.exe
        6⤵
        
        PID:12420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37514.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28136.exe
        6⤵
        
        PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25630.exe
        5⤵
        
        PID:9560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16222.exe
        5⤵
        
        PID:13976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62861.exe
        5⤵
        
        PID:5360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52072.exe
      4⤵
      PID:7748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28828.exe
        5⤵
        
        PID:12892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11090.exe
        5⤵
        
        PID:16728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15037.exe
        5⤵
        
        PID:17600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41221.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59010.exe
      4⤵
      PID:13512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35873.exe
      4⤵
      PID:15868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31462.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52747.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52747.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2363.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1123.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61564.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22608.exe
        7⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19240.exe
        8⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43944.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1059.exe
        10⤵
        
        PID:14892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8213.exe
        10⤵
        
        PID:17920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48355.exe
        9⤵
        
        PID:10388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64602.exe
        9⤵
        
        PID:14184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5989.exe
        9⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31234.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14425.exe
        8⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5506.exe
        8⤵
        
        PID:15092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42249.exe
        8⤵
        
        PID:17960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38878.exe
        7⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5870.exe
        8⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17602.exe
        7⤵
        
        PID:9644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6689.exe
        7⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        7⤵
        
        PID:18928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11102.exe
        6⤵
        
        PID:5024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51720.exe
        7⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        8⤵
        
        PID:9988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65178.exe
        8⤵
        
        PID:15116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11250.exe
        7⤵
        
        PID:9344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25709.exe
        7⤵
        
        PID:11800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19854.exe
        7⤵
        
        PID:16776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30527.exe
        7⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52614.exe
        6⤵
        
        PID:2556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15652.exe
        7⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63871.exe
        7⤵
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22365.exe
        7⤵
        
        PID:15908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13581.exe
        7⤵
        
        PID:6916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45127.exe
        6⤵
        
        PID:8952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55886.exe
        6⤵
        
        PID:12392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12734.exe
        6⤵
        
        PID:14660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29951.exe
        6⤵
        
        PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33722.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52348.exe
        6⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64356.exe
        7⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
        8⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32879.exe
        9⤵
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        8⤵
        
        PID:11256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20253.exe
        8⤵
        
        PID:15044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
        8⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7462.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57186.exe
        7⤵
        
        PID:12140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe
        7⤵
        
        PID:16040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4916.exe
        7⤵
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38878.exe
        6⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50244.exe
        7⤵
        
        PID:8480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8962.exe
        7⤵
        
        PID:12856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24825.exe
        7⤵
        
        PID:16708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62782.exe
        7⤵
        
        PID:17504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1301.exe
        6⤵
        
        PID:9260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
        6⤵
        
        PID:13472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36813.exe
        6⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        6⤵
        
        PID:7708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13161.exe
        5⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11455.exe
        6⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37100.exe
        7⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39673.exe
        7⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36190.exe
        6⤵
        
        PID:376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52438.exe
        6⤵
        
        PID:12648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52455.exe
        6⤵
        
        PID:14860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45565.exe
        6⤵
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        6⤵
        
        PID:19036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46419.exe
        5⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58864.exe
        6⤵
        
        PID:15008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16381.exe
        6⤵
        
        PID:17936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56986.exe
        5⤵
        
        PID:9628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62459.exe
        5⤵
        
        PID:13568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57532.exe
        5⤵
        
        PID:17064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49452.exe
        5⤵
        
        PID:6972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38522.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25960.exe
        5⤵
        
        PID:2844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24912.exe
        6⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62008.exe
        7⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        7⤵
        
        PID:11168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52734.exe
        7⤵
        
        PID:14912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15796.exe
        7⤵
        
        PID:18588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3954.exe
        6⤵
        
        PID:8328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61078.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe
        6⤵
        
        PID:16048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4916.exe
        6⤵
        
        PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59867.exe
        5⤵
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43856.exe
        6⤵
        
        PID:8472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43450.exe
        6⤵
        
        PID:12092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22365.exe
        6⤵
        
        PID:15968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13581.exe
        6⤵
        
        PID:16348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55598.exe
        5⤵
        
        PID:8896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29025.exe
        5⤵
        
        PID:11964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35614.exe
        5⤵
        
        PID:17400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51139.exe
        5⤵
        
        PID:17032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55399.exe
      4⤵
      PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14182.exe
        5⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34780.exe
        6⤵
        
        PID:9312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25105.exe
        6⤵
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26410.exe
        6⤵
        
        PID:19268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17602.exe
        5⤵
        
        PID:10036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
        5⤵
        
        PID:3092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46709.exe
        5⤵
        
        PID:7048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49814.exe
      4⤵
      PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34780.exe
        5⤵
        
        PID:6492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16937.exe
        5⤵
        
        PID:14288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
        5⤵
        
        PID:6596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47502.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10287.exe
      4⤵
      PID:13216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48445.exe
      4⤵
      PID:15776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11829.exe
      4⤵
      PID:17896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61770.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61770.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1123.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29084.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4670.exe
        6⤵
        
        PID:7276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54997.exe
        6⤵
        
        PID:7900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44246.exe
        5⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe
        6⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55371.exe
        6⤵
        
        PID:9700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22609.exe
        6⤵
        
        PID:13636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11041.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54919.exe
        5⤵
        
        PID:7876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15709.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45842.exe
        5⤵
        
        PID:15176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38695.exe
        5⤵
        
        PID:8104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58227.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19292.exe
        5⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43552.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11759.exe
        7⤵
        
        PID:8776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35438.exe
        7⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47638.exe
        7⤵
        
        PID:15588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35256.exe
        7⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35038.exe
        6⤵
        
        PID:9164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26399.exe
        6⤵
        
        PID:12776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32689.exe
        6⤵
        
        PID:16016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-633.exe
        6⤵
        
        PID:7360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46471.exe
        5⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6679.exe
        6⤵
        
        PID:12104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33902.exe
        6⤵
        
        PID:15624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45049.exe
        6⤵
        
        PID:8132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17602.exe
        5⤵
        
        PID:9996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
        5⤵
        
        PID:13308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48681.exe
        5⤵
        
        PID:14040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33773.exe
      4⤵
      PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38132.exe
        5⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26176.exe
        6⤵
        
        PID:12024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8630.exe
        6⤵
        
        PID:16060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61001.exe
        6⤵
        
        PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11737.exe
        5⤵
        
        PID:9860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34557.exe
        5⤵
        
        PID:14044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33497.exe
        5⤵
        
        PID:6836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60207.exe
      4⤵
      PID:7756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-769.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3274.exe
      4⤵
      PID:13600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62623.exe
      4⤵
      PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60332.exe
      4⤵
      PID:18016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42083.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42083.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20724.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15015.exe
        5⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38582.exe
        6⤵
        
        PID:8076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35859.exe
        6⤵
        
        PID:11124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23642.exe
        6⤵
        
        PID:16084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7950.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34986.exe
        5⤵
        
        PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31199.exe
        5⤵
        
        PID:10576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61802.exe
        5⤵
        
        PID:14144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54494.exe
        5⤵
        
        PID:6084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40162.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45480.exe
        5⤵
        
        PID:7872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-690.exe
        5⤵
        
        PID:9820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65178.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50914.exe
        5⤵
        
        PID:18900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27063.exe
      4⤵
      PID:8564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54386.exe
      4⤵
      PID:12116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3030.exe
      4⤵
      PID:15992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54032.exe
      4⤵
      PID:19428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56910.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56910.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36204.exe
      4⤵
      PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32068.exe
        5⤵
        
        PID:6704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38546.exe
        6⤵
        
        PID:8224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59262.exe
        6⤵
        
        PID:12796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30691.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16760
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16760 -s 436
        7⤵
        Program crash
        
        PID:18980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        6⤵
        
        PID:17764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18318.exe
        5⤵
        
        PID:9152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26399.exe
        5⤵
        
        PID:12808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32689.exe
        5⤵
        
        PID:17368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21437.exe
        5⤵
        
        PID:17068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34986.exe
      4⤵
      PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47660.exe
        5⤵
        
        PID:13932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46114.exe
        5⤵
        
        PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18596.exe
        5⤵
        
        PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8501.exe
      4⤵
      PID:11680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7498.exe
      4⤵
      PID:15612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50563.exe
      4⤵
      PID:17772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39326.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39326.exe
    3⤵
    PID:5268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47636.exe
      4⤵
      PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15652.exe
        5⤵
        
        PID:8412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51427.exe
        5⤵
        
        PID:12204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22365.exe
        5⤵
        
        PID:15940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38086.exe
        5⤵
        
        PID:6152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13082.exe
      4⤵
      PID:8992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58686.exe
      4⤵
      PID:12424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37935.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37935.exe
      4⤵
      PID:15592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46525.exe
      4⤵
      PID:5652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50344.exe
    3⤵
    PID:5476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22092.exe
      4⤵
      PID:12236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8630.exe
      4⤵
      PID:15976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
      4⤵
      PID:6048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43037.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43037.exe
    3⤵
    PID:8784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57126.exe
    3⤵
    PID:12364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47310.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47310.exe
    3⤵
    PID:15828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5205.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6440
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5170.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5170.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27496.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27496.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35228.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20392.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10635.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26344.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4683.exe
        8⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54660.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57712.exe
        10⤵
        
        PID:13188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50154.exe
        10⤵
        
        PID:18596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49019.exe
        9⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12557.exe
        9⤵
        
        PID:13088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-514.exe
        9⤵
        
        PID:16580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46525.exe
        9⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20378.exe
        8⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57430.exe
        8⤵
        
        PID:10236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28475.exe
        8⤵
        
        PID:13504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58393.exe
        8⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55207.exe
        7⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62008.exe
        8⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58464.exe
        9⤵
        
        PID:11540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-321.exe
        9⤵
        
        PID:16572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38086.exe
        9⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        8⤵
        
        PID:11152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65178.exe
        8⤵
        
        PID:15144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29367.exe
        7⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64822.exe
        7⤵
        
        PID:12996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5490.exe
        7⤵
        
        PID:16788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18658.exe
        7⤵
        
        PID:17836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18346.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4683.exe
        7⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19816.exe
        8⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15652.exe
        9⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51427.exe
        9⤵
        
        PID:12060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22365.exe
        9⤵
        
        PID:15880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15796.exe
        9⤵
        
        PID:18564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37482.exe
        8⤵
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9486.exe
        8⤵
        
        PID:12020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43790.exe
        8⤵
        
        PID:16408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34073.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35178.exe
        7⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19980.exe
        8⤵
        
        PID:10956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2818.exe
        8⤵
        
        PID:14664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53409.exe
        8⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51234.exe
        7⤵
        
        PID:9780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2854.exe
        7⤵
        
        PID:13880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56274.exe
        7⤵
        
        PID:3536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        7⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3405.exe
        6⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3679.exe
        7⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48096.exe
        8⤵
        
        PID:12560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26694.exe
        8⤵
        
        PID:16248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21477.exe
        8⤵
        
        PID:18732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63539.exe
        7⤵
        
        PID:10060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30971.exe
        7⤵
        
        PID:14804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34080.exe
        7⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30031.exe
        6⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64910.exe
        6⤵
        
        PID:10556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54971.exe
        6⤵
        
        PID:15328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58731.exe
        6⤵
        
        PID:17952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39970.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47496.exe
        6⤵
        
        PID:1848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62436.exe
        7⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3679.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38864.exe
        9⤵
        
        PID:9352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16937.exe
        9⤵
        
        PID:14032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63539.exe
        8⤵
        
        PID:9852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30971.exe
        8⤵
        
        PID:13768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40293.exe
        8⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10430.exe
        7⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32720.exe
        8⤵
        
        PID:12784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11090.exe
        8⤵
        
        PID:16768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52833.exe
        8⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2173.exe
        7⤵
        
        PID:10396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5506.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38165.exe
        7⤵
        
        PID:18464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49151.exe
        6⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24256.exe
        7⤵
        
        PID:11344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35874.exe
        7⤵
        
        PID:14848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52833.exe
        7⤵
        
        PID:2352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8701.exe
        6⤵
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37691.exe
        6⤵
        
        PID:12580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47874.exe
        6⤵
        
        PID:16276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17545.exe
        6⤵
        
        PID:6384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4417.exe
        5⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9151.exe
        6⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16700.exe
        7⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-826.exe
        8⤵
        
        PID:2116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37062.exe
        7⤵
        
        PID:10924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32889.exe
        7⤵
        
        PID:14636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5989.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14181.exe
        6⤵
        
        PID:8636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55423.exe
        6⤵
        
        PID:11456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23841.exe
        6⤵
        
        PID:16112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51378.exe
        6⤵
        
        PID:8040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11190.exe
        5⤵
        
        PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9741.exe
        5⤵
        
        PID:7396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15231.exe
        6⤵
        
        PID:12600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60483.exe
        6⤵
        
        PID:16560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21477.exe
        6⤵
        
        PID:18700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20990.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32436.exe
        5⤵
        
        PID:14096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44216.exe
        5⤵
        
        PID:4484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54997.exe
        5⤵
        
        PID:7472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21330.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59836.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21876.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9535.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12807.exe
        8⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34308.exe
        9⤵
        
        PID:16468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14401.exe
        9⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62073.exe
        9⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11982.exe
        8⤵
        
        PID:11216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20253.exe
        8⤵
        
        PID:15060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13581.exe
        8⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23990.exe
        7⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57186.exe
        7⤵
        
        PID:12156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe
        7⤵
        
        PID:15888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33504.exe
        7⤵
        
        PID:18004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65103.exe
        6⤵
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
        7⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30504.exe
        8⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16937.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13581.exe
        8⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        7⤵
        
        PID:11244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41635.exe
        7⤵
        
        PID:16352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50033.exe
        7⤵
        
        PID:4372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31173.exe
        6⤵
        
        PID:9332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9174.exe
        6⤵
        
        PID:12936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36920.exe
        6⤵
        
        PID:16748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58004.exe
        6⤵
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15570.exe
        5⤵
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
        6⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62008.exe
        7⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        7⤵
        
        PID:11160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52734.exe
        7⤵
        
        PID:14960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42746.exe
        7⤵
        
        PID:17464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28074.exe
        6⤵
        
        PID:8528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57186.exe
        6⤵
        
        PID:12148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe
        6⤵
        
        PID:15844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29420.exe
        6⤵
        
        PID:17828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
        5⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15599.exe
        6⤵
        
        PID:9400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63783.exe
        6⤵
        
        PID:13324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64602.exe
        6⤵
        
        PID:14156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54998.exe
        6⤵
        
        PID:17028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64535.exe
        5⤵
        
        PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58766.exe
        5⤵
        
        PID:12960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16154.exe
        5⤵
        
        PID:17360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14048.exe
        5⤵
        
        PID:7980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61874.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21876.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5451.exe
        6⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49756.exe
        7⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54956.exe
        8⤵
        
        PID:11920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8630.exe
        8⤵
        
        PID:15952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52833.exe
        8⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28510.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52734.exe
        7⤵
        
        PID:14928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6372.exe
        7⤵
        
        PID:17592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19906.exe
        6⤵
        
        PID:8440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57186.exe
        6⤵
        
        PID:12108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe
        6⤵
        
        PID:16068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe
        6⤵
        
        PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31854.exe
        5⤵
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60472.exe
        6⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57888.exe
        7⤵
        
        PID:11756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37794.exe
        7⤵
        
        PID:15800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
        7⤵
        
        PID:6648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51182.exe
        6⤵
        
        PID:10876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55475.exe
        6⤵
        
        PID:14840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6469.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49054.exe
        5⤵
        
        PID:7828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24375.exe
        5⤵
        
        PID:9224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62378.exe
        5⤵
        
        PID:15184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12885.exe
        5⤵
        
        PID:17856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5814.exe
      4⤵
      PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47444.exe
        5⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62008.exe
        6⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15127.exe
        7⤵
        
        PID:10656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42698.exe
        7⤵
        
        PID:14284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49133.exe
        7⤵
        
        PID:16776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        6⤵
        
        PID:11176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52734.exe
        6⤵
        
        PID:14952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-769.exe
        5⤵
        
        PID:3152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14667.exe
        5⤵
        
        PID:14596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8420.exe
        5⤵
        
        PID:17812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60086.exe
      4⤵
      PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47224.exe
        5⤵
        
        PID:9872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16937.exe
        5⤵
        
        PID:12908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58698.exe
        5⤵
        
        PID:6808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1810.exe
      4⤵
      PID:9140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50168.exe
      4⤵
      PID:12640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31149.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61414.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64371.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64371.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13375.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7319.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10163.exe
        6⤵
        
        PID:2664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44128.exe
        7⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10747.exe
        8⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18090.exe
        8⤵
        
        PID:12480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1473.exe
        8⤵
        
        PID:17164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55075.exe
        7⤵
        
        PID:8948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47778.exe
        7⤵
        
        PID:13180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31459.exe
        7⤵
        
        PID:16980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17744.exe
        7⤵
        
        PID:19048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38878.exe
        6⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11567.exe
        7⤵
        
        PID:8348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51427.exe
        7⤵
        
        PID:12036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22365.exe
        7⤵
        
        PID:15932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38086.exe
        7⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35178.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29025.exe
        6⤵
        
        PID:12556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35614.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22742.exe
        6⤵
        
        PID:17848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39690.exe
        5⤵
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4670.exe
        6⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13155.exe
        7⤵
        
        PID:11552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25209.exe
        7⤵
        
        PID:16624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58670.exe
        6⤵
        
        PID:8388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1894.exe
        6⤵
        
        PID:12944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32689.exe
        6⤵
        
        PID:17376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45941.exe
        6⤵
        
        PID:16336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
        5⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34780.exe
        6⤵
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25105.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46253.exe
        6⤵
        
        PID:19452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64535.exe
        5⤵
        
        PID:2364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58766.exe
        5⤵
        
        PID:13040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16154.exe
        5⤵
        
        PID:17348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6406.exe
        5⤵
        
        PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9026.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10163.exe
        5⤵
        
        PID:3332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26640.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20784.exe
        7⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16258.exe
        7⤵
        
        PID:11084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48843.exe
        7⤵
        
        PID:16144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56045.exe
        7⤵
        
        PID:7424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38826.exe
        6⤵
        
        PID:2820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2173.exe
        6⤵
        
        PID:10564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13674.exe
        6⤵
        
        PID:15224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38653.exe
        6⤵
        
        PID:9116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49151.exe
        5⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15652.exe
        6⤵
        
        PID:8604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63871.exe
        6⤵
        
        PID:11276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22365.exe
        6⤵
        
        PID:16008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6372.exe
        6⤵
        
        PID:17616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35178.exe
        5⤵
        
        PID:8916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64551.exe
        5⤵
        
        PID:12436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29269.exe
        5⤵
        
        PID:15780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33497.exe
        5⤵
        
        PID:6744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21713.exe
      4⤵
      PID:4024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19240.exe
        5⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49756.exe
        6⤵
        
        PID:7208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11982.exe
        6⤵
        
        PID:11224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20253.exe
        6⤵
        
        PID:15052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19906.exe
        5⤵
        
        PID:8448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57186.exe
        5⤵
        
        PID:12132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28231.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34080.exe
        5⤵
        
        PID:17040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58479.exe
      4⤵
      PID:7108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9995.exe
        5⤵
        
        PID:14880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
        5⤵
        
        PID:17864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59954.exe
      4⤵
      PID:8596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20339.exe
      4⤵
      PID:13488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23604.exe
      4⤵
      PID:4672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54997.exe
      4⤵
      PID:7992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36218.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4195.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60708.exe
        5⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52488.exe
        6⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-623.exe
        7⤵
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8926.exe
        7⤵
        
        PID:17056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19968.exe
        7⤵
        
        PID:7468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23938.exe
        6⤵
        
        PID:8220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7129.exe
        6⤵
        
        PID:11992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52455.exe
        6⤵
        
        PID:17180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe
        6⤵
        
        PID:16408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5909.exe
        5⤵
        
        PID:8032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62948.exe
        6⤵
        
        PID:15020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49002.exe
        6⤵
        
        PID:7596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35859.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-733.exe
        5⤵
        
        PID:14896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17545.exe
        5⤵
        
        PID:17208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36182.exe
      4⤵
      PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18458.exe
        5⤵
        
        PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        5⤵
        
        PID:9748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27167.exe
        5⤵
        
        PID:13824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56274.exe
        5⤵
        
        PID:16960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        5⤵
        
        PID:8176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56890.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11515.exe
        5⤵
        
        PID:9328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14774.exe
        5⤵
        
        PID:12900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39190.exe
        5⤵
        
        PID:3800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5989.exe
        5⤵
        
        PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20534.exe
      4⤵
      PID:9596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59150.exe
      4⤵
      PID:14004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40513.exe
      4⤵
      PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
      4⤵
      PID:6816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49239.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49239.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64792.exe
      4⤵
      PID:5284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19432.exe
        5⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29912.exe
        6⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11707.exe
        7⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23134.exe
        7⤵
        
        PID:13540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10793.exe
        7⤵
        
        PID:17080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38662.exe
        7⤵
        
        PID:6616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51479.exe
        6⤵
        
        PID:10308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18717.exe
        6⤵
        
        PID:13944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46638.exe
        6⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57431.exe
        5⤵
        
        PID:8768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49174.exe
        5⤵
        
        PID:12268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
        5⤵
        
        PID:15668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50033.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38878.exe
      4⤵
      PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42435.exe
        5⤵
        
        PID:17820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62754.exe
      4⤵
      PID:9420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1510.exe
      4⤵
      PID:13376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15969.exe
      4⤵
      PID:724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34073.exe
      4⤵
      PID:6028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30973.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30973.exe
    3⤵
    PID:5464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62252.exe
      4⤵
      PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41360.exe
        5⤵
        
        PID:11096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43851.exe
        5⤵
        
        PID:13912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63854.exe
        5⤵
        
        PID:9204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28790.exe
      4⤵
      PID:9452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36870.exe
      4⤵
      PID:13532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16658.exe
      4⤵
      PID:17024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe
      4⤵
      PID:15828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35006.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35006.exe
    3⤵
    PID:7740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62752.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62752.exe
    3⤵
    PID:9708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64346.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64346.exe
    3⤵
    PID:13528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19421.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19421.exe
    3⤵
    PID:2244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59198.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59198.exe
    3⤵
    PID:8012
- C:\Users\Admin\AppData\Local\Temp\Unicorn-945.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-945.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6447.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6447.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49099.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42488.exe
        5⤵
        Executes dropped EXE
        
        PID:1396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8575.exe
        6⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53043.exe
        6⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37312.exe
        7⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18688.exe
        8⤵
        
        PID:13256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4266.exe
        8⤵
        
        PID:17208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53409.exe
        8⤵
        
        PID:15656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        7⤵
        
        PID:11200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52734.exe
        7⤵
        
        PID:14944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38662.exe
        7⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41810.exe
        6⤵
        
        PID:8536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63051.exe
        6⤵
        
        PID:12072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19565.exe
        6⤵
        
        PID:15984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33497.exe
        6⤵
        
        PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55591.exe
        5⤵
        
        PID:864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25636.exe
        6⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18408.exe
        7⤵
        
        PID:14724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18485.exe
        7⤵
        
        PID:17796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16258.exe
        6⤵
        
        PID:11100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40674.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62782.exe
        6⤵
        
        PID:17740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9521.exe
        5⤵
        
        PID:8368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5490.exe
        5⤵
        
        PID:12216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19565.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-633.exe
        5⤵
        
        PID:4952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16861.exe
      4⤵
      PID:692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19240.exe
        5⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2979.exe
        6⤵
        
        PID:12676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11090.exe
        6⤵
        
        PID:16804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7716.exe
        6⤵
        
        PID:17996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26678.exe
        5⤵
        
        PID:9148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14145.exe
        5⤵
        
        PID:12748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30691.exe
        5⤵
        
        PID:16740
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16740 -s 464
        6⤵
        Program crash
        
        PID:16224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54117.exe
        5⤵
        
        PID:19252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58479.exe
      4⤵
      PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34780.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16937.exe
        5⤵
        
        PID:14256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57939.exe
      4⤵
      PID:10228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20339.exe
      4⤵
      PID:12804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48300.exe
      4⤵
      PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54997.exe
      4⤵
      PID:18548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29084.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4670.exe
        5⤵
        
        PID:7268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54997.exe
        5⤵
        
        PID:18584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24122.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14374.exe
        5⤵
        
        PID:6792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65480.exe
        6⤵
        
        PID:10316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60379.exe
        6⤵
        
        PID:14744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7908.exe
        6⤵
        
        PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23029.exe
        5⤵
        
        PID:9756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27167.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27685.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
        5⤵
        
        PID:7184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53190.exe
      4⤵
      PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24412.exe
        5⤵
        
        PID:16020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6233.exe
        5⤵
        
        PID:6632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48391.exe
      4⤵
      PID:9444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1013.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
      4⤵
      PID:15788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18677.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18677.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19292.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5874.exe
        5⤵
        
        PID:8236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40982.exe
        5⤵
        
        PID:11844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3030.exe
        5⤵
        
        PID:15900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18274.exe
        5⤵
        
        PID:17912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51323.exe
      4⤵
      PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49544.exe
        5⤵
        
        PID:14276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14401.exe
        5⤵
        
        PID:6236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44969.exe
        5⤵
        
        PID:8844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59786.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5786.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5786.exe
      4⤵
      PID:13652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21437.exe
      4⤵
      PID:16164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39639.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39639.exe
    3⤵
    PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15539.exe
      4⤵
      PID:6660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe
        5⤵
        
        PID:7784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13134.exe
        5⤵
        
        PID:10836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49995.exe
        5⤵
        
        PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64798.exe
        5⤵
        
        PID:18940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57431.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59454.exe
      4⤵
      PID:12948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30691.exe
      4⤵
      PID:16812
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16812 -s 436
        5⤵
        Program crash
        
        PID:19288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21828.exe
      4⤵
      PID:8120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54090.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54090.exe
    3⤵
    PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63856.exe
      4⤵
      PID:11884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30394.exe
      4⤵
      PID:16264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15037.exe
      4⤵
      PID:17568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60871.exe
    3⤵
    PID:9604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34600.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34600.exe
    3⤵
    PID:13496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64590.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64590.exe
    3⤵
    PID:1772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56945.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56945.exe
    3⤵
    PID:17928
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10266.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10266.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13375.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13375.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31160.exe
        5⤵
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34424.exe
        6⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62008.exe
        7⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        7⤵
        
        PID:4660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65178.exe
        7⤵
        
        PID:15132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6372.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19417.exe
        6⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7950.exe
        6⤵
        
        PID:12988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22025.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13461.exe
        6⤵
        
        PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35938.exe
        5⤵
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62008.exe
        6⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13441.exe
        7⤵
        
        PID:3420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        6⤵
        
        PID:11192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52734.exe
        6⤵
        
        PID:14936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25283.exe
        5⤵
        
        PID:8624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64822.exe
        5⤵
        
        PID:12980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5490.exe
        5⤵
        
        PID:16696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21782.exe
        5⤵
        
        PID:6220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47667.exe
      4⤵
      PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34808.exe
        5⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15652.exe
        6⤵
        
        PID:8404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51427.exe
        6⤵
        
        PID:12196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22365.exe
        6⤵
        
        PID:15872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58698.exe
        6⤵
        
        PID:6824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21442.exe
        5⤵
        
        PID:8936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50135.exe
        5⤵
        
        PID:11428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52150.exe
        5⤵
        
        PID:17324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10781.exe
        5⤵
        
        PID:17988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51462.exe
      4⤵
      PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65044.exe
        5⤵
        
        PID:8700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56435.exe
        5⤵
        
        PID:12184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44130.exe
        5⤵
        
        PID:16288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56829.exe
        5⤵
        
        PID:18528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38111.exe
      4⤵
      PID:9188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11345.exe
      4⤵
      PID:12724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5490.exe
      4⤵
      PID:16716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54647.exe
      4⤵
      PID:6284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3790.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3790.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47688.exe
      4⤵
      PID:3416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19240.exe
        5⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25828.exe
        6⤵
        
        PID:7736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29086.exe
        6⤵
        
        PID:11148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57586.exe
        6⤵
        
        PID:13956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        6⤵
        
        PID:18656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57431.exe
        5⤵
        
        PID:8788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4633.exe
        5⤵
        
        PID:11996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49995.exe
        5⤵
        
        PID:16328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50033.exe
        5⤵
        
        PID:7364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38878.exe
      4⤵
      PID:7100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23068.exe
        5⤵
        
        PID:14692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
        5⤵
        
        PID:17880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1301.exe
      4⤵
      PID:9268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18422.exe
      4⤵
      PID:12272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3909.exe
      4⤵
      PID:15868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54494.exe
      4⤵
      PID:5304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53426.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53426.exe
    3⤵
    PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44128.exe
      4⤵
      PID:6160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55724.exe
        5⤵
        
        PID:6844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33362.exe
        5⤵
        
        PID:10816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34233.exe
        5⤵
        
        PID:14836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56829.exe
        5⤵
        
        PID:18512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-254.exe
      4⤵
      PID:8828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50312.exe
        5⤵
        
        PID:12380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27229.exe
        5⤵
        
        PID:17780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24861.exe
      4⤵
      PID:11872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25107.exe
      4⤵
      PID:15808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5492.exe
      4⤵
      PID:5376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58479.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58479.exe
    3⤵
    PID:7092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11515.exe
      4⤵
      PID:9368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26693.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11041.exe
      4⤵
      PID:7264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64038.exe
    3⤵
    PID:9236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58759.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58759.exe
    3⤵
    PID:12100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4439.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4439.exe
    3⤵
    PID:15540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29608.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29608.exe
    3⤵
    PID:5580
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33417.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33417.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12555.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12555.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56624.exe
      4⤵
      PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47636.exe
        5⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62008.exe
        6⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13155.exe
        7⤵
        
        PID:11528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25209.exe
        7⤵
        
        PID:16668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
        7⤵
        
        PID:1240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53015.exe
        6⤵
        
        PID:11184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52734.exe
        6⤵
        
        PID:14920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38662.exe
        6⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23501.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7950.exe
        5⤵
        
        PID:12968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22025.exe
        5⤵
        
        PID:16796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6902.exe
        5⤵
        
        PID:17732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38878.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17240.exe
        5⤵
        
        PID:11512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13098.exe
        5⤵
        
        PID:15636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36881.exe
        5⤵
        
        PID:8684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17602.exe
      4⤵
      PID:9868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
      4⤵
      PID:12212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6689.exe
      4⤵
      PID:4976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16326.exe
      4⤵
      PID:18708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20038.exe
    3⤵
    PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38582.exe
      4⤵
      PID:8084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21516.exe
        5⤵
        
        PID:11612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3342.exe
        5⤵
        
        PID:12512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40430.exe
        5⤵
        
        PID:14712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6372.exe
        5⤵
        
        PID:17580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35859.exe
      4⤵
      PID:11116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-733.exe
      4⤵
      PID:14868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21053.exe
      4⤵
      PID:18040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20517.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20517.exe
    3⤵
    PID:7056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17240.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17240.exe
      4⤵
      PID:11500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9014.exe
      4⤵
      PID:15648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-865.exe
      4⤵
      PID:18716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45231.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45231.exe
    3⤵
    PID:9544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34069.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34069.exe
    3⤵
    PID:13516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56995.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56995.exe
    3⤵
    PID:16272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50908.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50908.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7976
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40374.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3336
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3336 -s 716
    3⤵
    - Program crash
    PID:2612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20403.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20403.exe
  2⤵
  PID:5692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62252.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62252.exe
    3⤵
    PID:6400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39352.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30394.exe
      4⤵
      PID:16280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65494.exe
      4⤵
      PID:18448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28790.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28790.exe
    3⤵
    PID:9464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45038.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45038.exe
    3⤵
    PID:13412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16658.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16658.exe
    3⤵
    PID:17072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe
    3⤵
    PID:16752
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30541.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30541.exe
  2⤵
  PID:7728
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35886.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35886.exe
  2⤵
  PID:8960
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63211.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63211.exe
  2⤵
  PID:13552
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60846.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60846.exe
  2⤵
  PID:3800

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3336 -ip 3336
1⤵
PID:2432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 16740 -ip 16740
1⤵
PID:17236

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16580

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 16812 -ip 16812
1⤵
PID:7372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 16760 -ip 16760
1⤵
PID:17460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10266.exe

Filesize
468KB

MD5
cf97b4d9c25d71fbe1d0739a5d38dba3

SHA1
256d60cb903852e896330c834de69c0c597a5989

SHA256
3f926dd0b23ba512f5e9b3d4295baa237bbf4151791778a0ac25abd2b6c48b8e

SHA512
92c6519c0a949ac9816509be3bb89a684c8160eec4d308691e42d266d39d631f6075446d318ed5bf7641eaa6109e48963dc6575e204bbcc8d34e4d1c1daaf36c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10635.exe

Filesize
468KB

MD5
5e8cfcfe39f33161f26d9ae11f330124

SHA1
9cb146460666782d4630c022d0cec3a7c74af8ae

SHA256
8d961fae594a3b74bc02ade1a91748915ae48f0972f0f99b44047c9f88fe7304

SHA512
163f5bc4f9b1a120140b6663b69ee04e8eda2cc10f7c69634dbcd118da0a2661a0faeb89c89b2a0fdf7d89055ffbd354d2e760e7a3c9c31de19189d21ebe7544

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11019.exe

Filesize
468KB

MD5
acdc1b844038fa45aeb0b0fd7b20b2f5

SHA1
6b162ded24f5426e6f07578fe9f534eb64406039

SHA256
c8ec164644f04237f3ef4ffc27f6a90f58f756eccefaaed04687a813c2894f4d

SHA512
3bcfa2d92663dd7ff1be0b9dd7f41a9f1e06e9f1d18eb6b0d15a534636eb15ba746bdded517ace2d5d40e6404b5e43974d6d61a28bf6e224f9a820b901daf7de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1123.exe

Filesize
468KB

MD5
3ea631ec9b9e127bb4b0430801255a37

SHA1
2bf7ae65aea871333d3f4b5cece406918ba46470

SHA256
6b5083be3465387700cb0bcba370320e292c168f78412bcb55fc046c1a3fa5db

SHA512
4bdad840de9cfcd877d467ef7f15a31494c91638d128a057cef5ee73bc004a9581f8a5437089e4f5260b70343ed323bc4346530c98c1f08468be3f5ec9e346f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13375.exe

Filesize
468KB

MD5
3079ec423079f85d53a40fe15497c7e1

SHA1
67813ca875b9e198d0757a78d4282d378dc0677e

SHA256
7ef327894e94a4d38b94e7a560761c8ccd9f81c4fed6ce6f7d83c1d3e92aef5d

SHA512
2f8fe0f8c23e323db324ee98e6a63f4b174e997c2ba1a6be6b40407ed10104c7bdf6700a725e7673b64b12428868620bb1a204dfda1498abea5bd67b33979470

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19224.exe

Filesize
468KB

MD5
7c13d2ecae9b9ed0e9994de5d8aedcb5

SHA1
fcd411534eae66be026d7588bb3a5b9bcf281ea5

SHA256
6111e10c1bedc505c0f5863d0917e4b417028d140628db8da34e0f4bc175a98b

SHA512
e1a42ac81cbcac9326b99f386b3a442649d2ae5c07bcfb82f55f1b7949f8b18c81d60e02ab93e6f5de2c7f5bd1c5bea30c5c2e9c4f725fb493614237de592f92

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20392.exe

Filesize
468KB

MD5
ce088afad8467f20b63326b70a164856

SHA1
e3227fc80587f5617c54d4557a17d98ee6add986

SHA256
744457643674f62729bd1d5edc98813e9b1329def652946700fd04d9b8158aa7

SHA512
1f87de3de62997b30a08278af80492085904788d6fce09ddffe803ec7201c0f0cc3a453a2ccd660dd00062ec563377313af779af646b7418aa25ab35ca1b651d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21330.exe

Filesize
468KB

MD5
f6a2d511458f137b3795909ec3aab564

SHA1
2819ff3477fc758b471718634074b67b75dfe740

SHA256
5f231abdbe2f96d3fa263f3b754c8570695fa22b7377dad0a524d4355b6d98e7

SHA512
cf60de0c428360b8ddff70539396e63af8aadb3dac69bad14a7367b86ccc1002831604631becf33cbc28864a74ccacb41bce0939186db2888fc83bd6a471d0bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe

Filesize
468KB

MD5
59598f0cd3789994dead9729abce5b7b

SHA1
2a472425cefc1a0530f46e9224a156f7786eba01

SHA256
ca8dc2e46f028a102f7d15f7d9e4e23caa212b119d7843fdce23289394743b03

SHA512
8d6688dd34bb03d21a7f64f246179daae848bfb99176f2a1baf084a4f00356a585ffec2410f0ce515bfde0cb860ff220a1060ff9eeea940ab16b983649cd4fe9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23005.exe

Filesize
468KB

MD5
e03d1f8f9a351bf56000380b0385e4ac

SHA1
ea35882036e8e0706bdd65cdbe47c8b4c2bc91cb

SHA256
e3979a0c875a86fe5a263ccbfa38fee7d911a93ccc6950741019d23141248960

SHA512
01f175ea2ada9d335662c0ac3a85a754e6716471356b2499491713168d7534a478b23dad94e4652054681c1e3261970612f07f36b578a6ab5646d3b502dd62b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2363.exe

Filesize
468KB

MD5
441a933910344513c53ce0c905dd622a

SHA1
f9aac767bbd416d0f5c9d258f9acc1fadd2f538b

SHA256
efcc539960baf1f6d6f4c1a0962f4c537f477d0ea319577b0ce8dd359592a16f

SHA512
87898f99855f191115d6aeb8cf6f6e26135e2fea775317fbe9bab95e05f39c293fa157ed858ae7b660a75ed0ea00c07a893cb0b2eb0278f835def57dd9422e87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25052.exe

Filesize
468KB

MD5
9c31e197549deac35c4dd7146ba9320b

SHA1
3065a834c5ca71dc761644bc3c9349e0cbe75402

SHA256
2694b0b5451bfdec9eace4cdeff0a4eabf76d283b2620a784e5a9179d1f4b50d

SHA512
118267c92db06d790efc7c43c0174a31b623b0aac7f18b16c271d978be43551913b7f08064c56aed20e97e533351eba0b6da110d04f3e8e7fd24e85227e31a4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27496.exe

Filesize
468KB

MD5
e6aab8a7e19567b2e1f3ae7d248cb95a

SHA1
cfa118e6e7694e5031e1393c463dd4577c349949

SHA256
562401c8d091133c2fc6b7a1e8287ebd7734393e52e0ad4fc081ee51a13f3543

SHA512
53b9acb23b6fc414fa71ad51388880792f520f6779be50a43a62e01d2dd05189bfa72ce32a8b4e131c3ab22243e8c6ea7265609a5ce4d71f26ed11d953f142f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28510.exe

Filesize
468KB

MD5
aa5395bc0f4a0dd94f39ec13ec36c6ab

SHA1
53f45b1c348ed691ab362eeddefa0920b091c4b6

SHA256
54d368f55b8b1e2210ccce0dd87a271f48d9533dc0af644e2b368b7ef48f2ece

SHA512
3785c38fbeea0fc10613ad8843c82dc947a94bdf6b28b76d15e6d90ab1d9d81ffdde9cc2fe14157284df4ea9eca649985f001cc827d98873b48ae505d4660106

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33417.exe

Filesize
468KB

MD5
7c49e40b705a91928397184f72794309

SHA1
81e89c4a4b92714ee94735eebb25348884053a47

SHA256
ec36b7a6d7287ddf7720c1f6b9840895a8474b9246319f9bb05d3e0235a972ec

SHA512
ef2872e88eb8c39e6746ca2ebf37ca1290bd616af0ee515656268d6611de342e33ef57c57b91fc2b1a664904c86b8fe6f20977ef2f388b5f11c177bbfa645e88

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35228.exe

Filesize
468KB

MD5
3fd17081c687c5bafc5b982721e494eb

SHA1
bd39ce22ddb09aca5eed6f2b47c7c6abe5693f68

SHA256
e010753e906a1637c795fe93736866a4f564d3e24d182dfc941ecdfdea3efa76

SHA512
30afcc24d21b9acf9689a65fc5fa096ff3f0e18ffa3701773f6f137942525be27ca7d1b020229671d19131782f2645d054c53b7a912a1558a0e0b20f10c3cdd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe

Filesize
468KB

MD5
4cc9f7c478e39fd804d26597e3147170

SHA1
b5cb16f40576cc1209a7008aad04f919ad1af59a

SHA256
b6918184864c099302454a87015018e8708580cc4a2f30bdee863d96ae9a6be5

SHA512
6b4968b0911e1c9ade68dbfddad2205fa5953f23582dad059ae7878c70d104bb40c0477b8d65c1fa6bc1316fb90e420f52e36eeaaa4f7a01b5abe5cbe92e07e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36218.exe

Filesize
468KB

MD5
ab65eb7b126b2153f39a6fa61eb2901f

SHA1
9207becd39f41c91a745f8af2bac054aeee2e75f

SHA256
e5d91fda0ea68a37cd028ffd50969de26e89edbefb9f93c8247646768d4501fe

SHA512
32322e94aa52274c55dddf26e0b3bdac3f3a2647c1de915fedf25dcbab54fcb2b9969098ab3eba5491c849d12249df9aad9be16c498cf710cd4195bb1906ece8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39800.exe

Filesize
468KB

MD5
868fc041fdfe9e18474e31c01d2fcc95

SHA1
439f653ae225f960477162aa75663a16f81fc0d2

SHA256
8fe7a1a67f0e47df3d1460441481274510e09c9547df81b5fd01dfc4499eb2fd

SHA512
da524e95c2281f7b9007aaafe2efe7359b418d73637b2c07a186b489a5f293c3f844ebe06bc190fb017b90ecc1a5b35288a1f7d80beed9f2b2f70d3a8fa7fc29

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39970.exe

Filesize
468KB

MD5
511bc583d19a21f89d652aa7042cc9b6

SHA1
59bddce0a37260fa6c832b00553083e5e405c217

SHA256
c7bf8916dc41ba02607a65e5afb64a201bd16ce3156c4cf1717ce614c4960b8e

SHA512
7f97c65535b9131ce74c0783e7ad742e9a37c60ca3c52ad3e6c5601b96134e53452a5591dd12e676a37c4ae321b6de52f825d9ffd3296b119b55bbfc61901250

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42083.exe

Filesize
468KB

MD5
613926e8dbc8afe74789cfca262afce0

SHA1
c0076937a2bf61b38cf7d8b08416e2d2db2675fc

SHA256
2dee70a8d30d41ea27233d79a8d324672f603509b6345e110f1838a122911992

SHA512
03703adc7521c78e28a207de97095dc3da301e528d39d2779b2e39e8c7df6c79de31abe34fc0a624874eef3ff2a1e0039a3e253efe34a19b1add9d557550b59b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46883.exe

Filesize
468KB

MD5
f7a7023a276edf1545d752a8ab3cd2cc

SHA1
e8810746110ec4d713e22e73738bdbbb6a95f000

SHA256
524c2719defff2c0d8646b058ba470e0beb197bdfd54a714f6b356f74006c09b

SHA512
af919df304914c25cd0322f1db84564aaba72246550485d8cb93d7f1b54f1856f5410cd2c58c912ea7e903ee4a3f4b0bfa1427e2a2917e1917f20f170c52fac9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5170.exe

Filesize
468KB

MD5
30caddc08cfa4419badbe7c10b591299

SHA1
c21e18dd220922811490a8aa6c56c413ec68f5a8

SHA256
03927589445223c56360f33b0dec461106a7b3b134b0cc796493ceea889ccc6d

SHA512
7db617c4002706745356e0877e4579cf3b0d6c2a11c6abb91e4f683505aa7149250b54b957e12fb7313df40d78b420c667289c8c510d78a22fe230f6a74370f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52747.exe

Filesize
468KB

MD5
625ff916fc71b4692d7dedc46840f521

SHA1
c2afa6b69a53a4a8f905ae281846fc82febcc9ff

SHA256
824c82c6c23e018b434ba1371afc8c9f6ba27f38c83226366e982a8b70379f3e

SHA512
4ee44be09bf66e62ac4714a2f8237602d4b2f1bc1c96bc5b2a3f60dd1285fdce64bc13f9822150c200e702d06404e738af45cfc7acaab7ff0a222b6ec9a95606

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53816.exe

Filesize
468KB

MD5
2b5e435820a83370786f83410b8a9ee2

SHA1
e5ef21878dc0ac0a8945652b85190f18a70c98eb

SHA256
01c143ccfee1192f57ed5b52957ac1df671b54e1d075ec8a873107108144ab8b

SHA512
301c97be6affa657b86c5c0078c656fb9b6434481d82d443a6e6c0c7c85c7d1ec5d0a4894ea57667039914817b9ec1e25d8cbc667d3a19e79972971825220cfd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56691.exe

Filesize
468KB

MD5
5e055d9c5452d03b59e0a0f0c96ccfb0

SHA1
c0e999a992a852616c01819206d3ded4a29d4eed

SHA256
c5351cc133677cebbefef2e07dc95796a8c7efbff0f4418d956275f84926add8

SHA512
cc2586b5365a1f5023c323a19b01d0c8891358ccb00872c72b4d26ca8e40437fa7f1c480cb495f02823bf4d8c981707f18f70758903e0402985008a3e5117788

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58670.exe

Filesize
468KB

MD5
f25d05ebce5c676429d06881c171ced5

SHA1
9b07839ead1d1d0831d7f100d4acf15dae90534b

SHA256
c94b72ff5c78f4719b90126918d3efe6e1aef1957dfb9354cef0d834aeaa9e69

SHA512
f51c433773e93bdd70c93e66bba96268e3bb8b5be70b6c8eeda0a1d192c7406d9c4da2ccb21107ee7e20d392d0b58f0fe0a039294891444b16cac6a531705435

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59836.exe

Filesize
468KB

MD5
ee7be14bdfb21831dfafd29d5d7084fc

SHA1
42387efb25be25493f689426eb5f487972474b88

SHA256
a0e8c1ffd2afa614ca5c3926b4e0c6e2eabc96416247514205bdb5d679bb9359

SHA512
cf8342484031e7dc0b90e3f99c48772afc5568a1418a740d1baf092e7091ba9c617bd79c3318ec5f9d8cd1ec4a65135581bb93293103318bbf95cd4568323028

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61770.exe

Filesize
468KB

MD5
d1cb94d27de916580864c59dc2241d02

SHA1
e4c5c1bd72e59816f62693364deb76abf1653807

SHA256
4f30dea0427bd6ae27aedca0dd64adeb718b69c775473f44eeb869aadb05e268

SHA512
fe758d7cb331888818872297179e670936900c651ebec840bf5413b3dea067c48fdf4398d128ba1db08cec74b1f0bad26f9091e622eb73308a7f3becca5260e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62436.exe

Filesize
468KB

MD5
10bb1cb073e979c6695e92f04cce7b69

SHA1
91fedd0e01e83777b3806321b091826ff00145a2

SHA256
fd26657a4aa8da300520fd40bc595c0ebf045826b9073fab4906f8d67359a2bb

SHA512
2bbe0411f84a389cfe005c0f4bca8c0926ba63dc7b7154814870435c3b3c763f6497f8cf5668600f57871ee235817973244e2466456b00cc253d0730880cf05e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64371.exe

Filesize
468KB

MD5
be1ee194106d4bff6756380844d25a92

SHA1
7743c2b5589cc123df2849bdc639811ac0323988

SHA256
fc89d0930263e74bfcf5b2b3cf2c6fb13ce41665e864d64d333fe04e76701be7

SHA512
8ca844255745b69d8f8eb25fcd70cfafacdfda8beb0e835919c431e8122942984974b7a9c1ac62a77792b13d23fbd8a0ea142e58721e4caccff5c656070a2d79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6447.exe

Filesize
468KB

MD5
828bd8c223815dd2291ff067e7ea0d3b

SHA1
139396d5853568a4577c399584fac2bc1f44a02d

SHA256
6c1cc0748879b819794221270e7572726ce84b12f5a23c49cfba9a1f7df324db

SHA512
19344d21d58bc2bb6315c0d9e1e691d73ab7976f978a7072bfc46e7941dd882cb2d58e4cc67a0a1daa69585a1fbb59a51718a2eed06dec5089a6d9b321669e54

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6670.exe

Filesize
468KB

MD5
c41d70fe4027688bc94c18764b264e8e

SHA1
fdcc0a8d7f0d6322d48a69b5b2de48523748aca3

SHA256
2a6934972d9ce3da7b9dce5b7bd4ca88b382c0a85141aa17cf6897e7a3b5d366

SHA512
5f47bff2b37aed9243ec6f94beb10f713b528f43808be5ed678bdde9e55be58e72f71010ddcc528723da42a7909f12f8b1936b50041387daf606dd4647e437cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-945.exe

Filesize
468KB

MD5
a034783ce5dcff703aaf7a228e6f5e3d

SHA1
bda610c8a1282a898cdeeb7232a875cdf821d688

SHA256
638e604b7a7397702ed0c60afa76f625ee88dc3fc61f64cbbeb5932da9ddce58

SHA512
8e1a1cd95fcb2d3fd359b6a0a1fc636dc053c0e1dcce9409a296b6931fa9ea494a520a238bf9a589f3290a5e2c7b47440caefbcb5d01ee3ce0cc69668ac7508c

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads