d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f

Analysis

max time kernel
150s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 02:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe
Size

468KB
MD5

542d173857a3de30831ef5d34729166e
SHA1

54f9f8fb34d54ef1d6466f1bd0550f31b7cd0bac
SHA256

d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f
SHA512

3835603a0abdcab31ad2c163fec2842313d16735e55dc43dfc6049ff7e2aca929d6847ac7e2f812d55c2cbaed57c66a096a1390d3f562e9da309d7ae6d7d6188
SSDEEP

3072:S8X+o15+PC8e2aY2Pziirf8/vCmDZ4pahdHeZVrPnrgbSN6ImcjsY0:S8OoC7e2OPeirf4EnvrgbeLmcj

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2636	Unicorn-6998.exe
2628	Unicorn-4061.exe
3056	Unicorn-23927.exe
3432	Unicorn-10486.exe
212	Unicorn-53365.exe
3224	Unicorn-62510.exe
4132	Unicorn-39437.exe
5112	Unicorn-22503.exe
1752	Unicorn-5517.exe
3660	Unicorn-28206.exe
456	Unicorn-5133.exe
4416	Unicorn-41335.exe
1860	Unicorn-8205.exe
664	Unicorn-8470.exe
4872	Unicorn-21691.exe
220	Unicorn-30526.exe
1932	Unicorn-7261.exe
2616	Unicorn-10598.exe
1324	Unicorn-53285.exe
1580	Unicorn-61719.exe
3508	Unicorn-57998.exe
3580	Unicorn-12326.exe
4264	Unicorn-57806.exe
3880	Unicorn-61143.exe
3920	Unicorn-28279.exe
2476	Unicorn-60951.exe
2016	Unicorn-60951.exe
2848	Unicorn-2077.exe
4100	Unicorn-58949.exe
784	Unicorn-61749.exe
4300	Unicorn-48014.exe
1128	Unicorn-11766.exe
2012	Unicorn-8045.exe
1492	Unicorn-557.exe
3128	Unicorn-10571.exe
1208	Unicorn-16318.exe
4440	Unicorn-62119.exe
4488	Unicorn-64293.exe
4728	Unicorn-31486.exe
4556	Unicorn-65383.exe
4660	Unicorn-48149.exe
5052	Unicorn-6006.exe
3712	Unicorn-54823.exe
1244	Unicorn-48309.exe
2912	Unicorn-28973.exe
3668	Unicorn-40023.exe
1900	Unicorn-56359.exe
748	Unicorn-59182.exe
1652	Unicorn-3437.exe
2136	Unicorn-23303.exe
4428	Unicorn-55975.exe
4404	Unicorn-55783.exe
3940	Unicorn-42327.exe
4624	Unicorn-22461.exe
2348	Unicorn-58149.exe
1588	Unicorn-12477.exe
3984	Unicorn-55356.exe
32	Unicorn-61486.exe
4628	Unicorn-38413.exe
384	Unicorn-5963.exe
1556	Unicorn-49349.exe
4796	Unicorn-58014.exe
4840	Unicorn-59239.exe
4220	Unicorn-59047.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
15900	15412	WerFault.exe	764

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6310.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15190.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41756.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10671.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37623.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6892.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59406.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-976.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54501.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41173.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61397.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61989.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55573.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55598.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54677.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7005.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9252.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21670.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6134.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38404.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9533.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21547.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41808.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49342.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62599.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64133.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-445.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51630.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22368.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31201.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27367.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21670.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37093.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	6244	dwm.exe
Token: SeChangeNotifyPrivilege	6244	dwm.exe
Token: 33	6244	dwm.exe
Token: SeIncBasePriorityPrivilege	6244	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
440	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe
2636	Unicorn-6998.exe
2628	Unicorn-4061.exe
3056	Unicorn-23927.exe
3432	Unicorn-10486.exe
212	Unicorn-53365.exe
3224	Unicorn-62510.exe
4132	Unicorn-39437.exe
5112	Unicorn-22503.exe
1752	Unicorn-5517.exe
3660	Unicorn-28206.exe
4416	Unicorn-41335.exe
456	Unicorn-5133.exe
664	Unicorn-8470.exe
1860	Unicorn-8205.exe
4872	Unicorn-21691.exe
220	Unicorn-30526.exe
1932	Unicorn-7261.exe
2616	Unicorn-10598.exe
1324	Unicorn-53285.exe
1580	Unicorn-61719.exe
3508	Unicorn-57998.exe
3580	Unicorn-12326.exe
4264	Unicorn-57806.exe
4100	Unicorn-58949.exe
2016	Unicorn-60951.exe
2476	Unicorn-60951.exe
3880	Unicorn-61143.exe
3920	Unicorn-28279.exe
4300	Unicorn-48014.exe
2848	Unicorn-2077.exe
784	Unicorn-61749.exe
1128	Unicorn-11766.exe
2012	Unicorn-8045.exe
1492	Unicorn-557.exe
3128	Unicorn-10571.exe
1208	Unicorn-16318.exe
4440	Unicorn-62119.exe
4488	Unicorn-64293.exe
4728	Unicorn-31486.exe
4556	Unicorn-65383.exe
4660	Unicorn-48149.exe
5052	Unicorn-6006.exe
3712	Unicorn-54823.exe
2912	Unicorn-28973.exe
1244	Unicorn-48309.exe
3668	Unicorn-40023.exe
1900	Unicorn-56359.exe
3940	Unicorn-42327.exe
2136	Unicorn-23303.exe
1652	Unicorn-3437.exe
4404	Unicorn-55783.exe
748	Unicorn-59182.exe
4428	Unicorn-55975.exe
4624	Unicorn-22461.exe
1588	Unicorn-12477.exe
2348	Unicorn-58149.exe
1556	Unicorn-49349.exe
3984	Unicorn-55356.exe
384	Unicorn-5963.exe
4628	Unicorn-38413.exe
32	Unicorn-61486.exe
4796	Unicorn-58014.exe
4840	Unicorn-59239.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 440 wrote to memory of 2636	440	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe	84
PID 440 wrote to memory of 2636	440	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe	84
PID 440 wrote to memory of 2636	440	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe	84
PID 440 wrote to memory of 2628	440	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe	88
PID 440 wrote to memory of 2628	440	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe	88
PID 440 wrote to memory of 2628	440	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe	88
PID 2636 wrote to memory of 3056	2636	Unicorn-6998.exe	87
PID 2636 wrote to memory of 3056	2636	Unicorn-6998.exe	87
PID 2636 wrote to memory of 3056	2636	Unicorn-6998.exe	87
PID 2628 wrote to memory of 3432	2628	Unicorn-4061.exe	92
PID 2628 wrote to memory of 3432	2628	Unicorn-4061.exe	92
PID 2628 wrote to memory of 3432	2628	Unicorn-4061.exe	92
PID 440 wrote to memory of 212	440	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe	93
PID 440 wrote to memory of 212	440	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe	93
PID 440 wrote to memory of 212	440	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe	93
PID 3056 wrote to memory of 3224	3056	Unicorn-23927.exe	94
PID 3056 wrote to memory of 3224	3056	Unicorn-23927.exe	94
PID 3056 wrote to memory of 3224	3056	Unicorn-23927.exe	94
PID 2636 wrote to memory of 4132	2636	Unicorn-6998.exe	95
PID 2636 wrote to memory of 4132	2636	Unicorn-6998.exe	95
PID 2636 wrote to memory of 4132	2636	Unicorn-6998.exe	95
PID 3432 wrote to memory of 5112	3432	Unicorn-10486.exe	96
PID 3432 wrote to memory of 5112	3432	Unicorn-10486.exe	96
PID 3432 wrote to memory of 5112	3432	Unicorn-10486.exe	96
PID 2628 wrote to memory of 1752	2628	Unicorn-4061.exe	97
PID 2628 wrote to memory of 1752	2628	Unicorn-4061.exe	97
PID 2628 wrote to memory of 1752	2628	Unicorn-4061.exe	97
PID 3224 wrote to memory of 3660	3224	Unicorn-62510.exe	98
PID 3224 wrote to memory of 3660	3224	Unicorn-62510.exe	98
PID 3224 wrote to memory of 3660	3224	Unicorn-62510.exe	98
PID 3056 wrote to memory of 456	3056	Unicorn-23927.exe	99
PID 3056 wrote to memory of 456	3056	Unicorn-23927.exe	99
PID 3056 wrote to memory of 456	3056	Unicorn-23927.exe	99
PID 212 wrote to memory of 4416	212	Unicorn-53365.exe	100
PID 212 wrote to memory of 4416	212	Unicorn-53365.exe	100
PID 212 wrote to memory of 4416	212	Unicorn-53365.exe	100
PID 440 wrote to memory of 1860	440	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe	101
PID 440 wrote to memory of 1860	440	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe	101
PID 440 wrote to memory of 1860	440	d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe	101
PID 4132 wrote to memory of 664	4132	Unicorn-39437.exe	102
PID 4132 wrote to memory of 664	4132	Unicorn-39437.exe	102
PID 4132 wrote to memory of 664	4132	Unicorn-39437.exe	102
PID 2636 wrote to memory of 4872	2636	Unicorn-6998.exe	103
PID 2636 wrote to memory of 4872	2636	Unicorn-6998.exe	103
PID 2636 wrote to memory of 4872	2636	Unicorn-6998.exe	103
PID 5112 wrote to memory of 220	5112	Unicorn-22503.exe	104
PID 5112 wrote to memory of 220	5112	Unicorn-22503.exe	104
PID 5112 wrote to memory of 220	5112	Unicorn-22503.exe	104
PID 3432 wrote to memory of 1932	3432	Unicorn-10486.exe	105
PID 3432 wrote to memory of 1932	3432	Unicorn-10486.exe	105
PID 3432 wrote to memory of 1932	3432	Unicorn-10486.exe	105
PID 1752 wrote to memory of 2616	1752	Unicorn-5517.exe	106
PID 1752 wrote to memory of 2616	1752	Unicorn-5517.exe	106
PID 1752 wrote to memory of 2616	1752	Unicorn-5517.exe	106
PID 2628 wrote to memory of 1324	2628	Unicorn-4061.exe	107
PID 2628 wrote to memory of 1324	2628	Unicorn-4061.exe	107
PID 2628 wrote to memory of 1324	2628	Unicorn-4061.exe	107
PID 4416 wrote to memory of 1580	4416	Unicorn-41335.exe	108
PID 4416 wrote to memory of 1580	4416	Unicorn-41335.exe	108
PID 4416 wrote to memory of 1580	4416	Unicorn-41335.exe	108
PID 212 wrote to memory of 3508	212	Unicorn-53365.exe	109
PID 212 wrote to memory of 3508	212	Unicorn-53365.exe	109
PID 212 wrote to memory of 3508	212	Unicorn-53365.exe	109
PID 3660 wrote to memory of 3580	3660	Unicorn-28206.exe	110

C:\Users\Admin\AppData\Local\Temp\d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe
"C:\Users\Admin\AppData\Local\Temp\d7b8a44963c3a420d6a334577951f63863e50866a6468b950598242eb69b157f.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:440
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6998.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6998.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23927.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23927.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62510.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28206.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12326.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40023.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42919.exe
        8⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61614.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46055.exe
        10⤵
        
        PID:8776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
        10⤵
        
        PID:12800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6043.exe
        10⤵
        
        PID:15988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22368.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48421.exe
        9⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2715.exe
        9⤵
        
        PID:12688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30861.exe
        8⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31447.exe
        9⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55861.exe
        9⤵
        
        PID:13088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14519.exe
        9⤵
        
        PID:4252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19364.exe
        8⤵
        
        PID:9920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45742.exe
        8⤵
        
        PID:13676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18166.exe
        8⤵
        
        PID:16144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54501.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28948.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32295.exe
        8⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28775.exe
        9⤵
        
        PID:10288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18461.exe
        9⤵
        
        PID:14756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19524.exe
        9⤵
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3917.exe
        8⤵
        
        PID:10464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36764.exe
        8⤵
        
        PID:15036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40894.exe
        8⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29044.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12854.exe
        8⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10637.exe
        7⤵
        
        PID:11208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-139.exe
        7⤵
        
        PID:14460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22399.exe
        7⤵
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22461.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39943.exe
        7⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40551.exe
        8⤵
        
        PID:3064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26142.exe
        9⤵
        
        PID:13196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54277.exe
        9⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61797.exe
        9⤵
        
        PID:13548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16493.exe
        9⤵
        
        PID:16588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13460.exe
        8⤵
        
        PID:10416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2539.exe
        8⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38206.exe
        8⤵
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20628.exe
        7⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33399.exe
        8⤵
        
        PID:11652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8804.exe
        8⤵
        
        PID:15344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24742.exe
        8⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18612.exe
        7⤵
        
        PID:11012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44357.exe
        7⤵
        
        PID:15516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21045.exe
        7⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35173.exe
        6⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46631.exe
        7⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32669.exe
        7⤵
        
        PID:12488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44460.exe
        7⤵
        
        PID:14404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exe
        7⤵
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56926.exe
        6⤵
        
        PID:7600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14907.exe
        6⤵
        
        PID:12020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47038.exe
        6⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57806.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6006.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35031.exe
        7⤵
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4909.exe
        8⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49070.exe
        9⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61781.exe
        9⤵
        
        PID:13860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7446.exe
        9⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40724.exe
        8⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        8⤵
        
        PID:12172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31877.exe
        8⤵
        
        PID:15668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50613.exe
        8⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42381.exe
        7⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49838.exe
        8⤵
        
        PID:8348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32669.exe
        8⤵
        
        PID:12396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57223.exe
        8⤵
        
        PID:15940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26852.exe
        7⤵
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55726.exe
        7⤵
        
        PID:13152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22116.exe
        7⤵
        
        PID:14436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59830.exe
        7⤵
        
        PID:14816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34324.exe
        6⤵
        
        PID:4412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49367.exe
        7⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30103.exe
        8⤵
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
        8⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10295.exe
        8⤵
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35981.exe
        7⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57637.exe
        7⤵
        
        PID:11372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31877.exe
        7⤵
        
        PID:15692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41808.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28644.exe
        6⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17063.exe
        7⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5789.exe
        7⤵
        
        PID:15328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15287.exe
        7⤵
        
        PID:1636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46501.exe
        6⤵
        
        PID:10204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52204.exe
        6⤵
        
        PID:14124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32916.exe
        6⤵
        
        PID:2908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33360.exe
        6⤵
        
        PID:16572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48309.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53095.exe
        6⤵
        
        PID:3264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        7⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
        8⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58046.exe
        8⤵
        
        PID:13688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45804.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17407.exe
        8⤵
        
        PID:16644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12541.exe
        7⤵
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21844.exe
        7⤵
        
        PID:13544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8331.exe
        7⤵
        
        PID:15608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8751.exe
        7⤵
        
        PID:1076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10877.exe
        6⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32039.exe
        7⤵
        
        PID:10812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29748.exe
        7⤵
        
        PID:15020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
        7⤵
        
        PID:15576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36028.exe
        6⤵
        
        PID:9932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38078.exe
        6⤵
        
        PID:15260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        6⤵
        
        PID:14644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52446.exe
        5⤵
        
        PID:1460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27863.exe
        6⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31447.exe
        7⤵
        
        PID:9036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5035.exe
        7⤵
        
        PID:14104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40894.exe
        7⤵
        
        PID:15412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58478.exe
        6⤵
        
        PID:10004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55772.exe
        6⤵
        
        PID:13792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13229.exe
        6⤵
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40894.exe
        6⤵
        
        PID:15660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47765.exe
        5⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17063.exe
        6⤵
        
        PID:11616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8804.exe
        6⤵
        
        PID:12592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4461.exe
        5⤵
        
        PID:10644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39486.exe
        5⤵
        
        PID:14548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30318.exe
        5⤵
        
        PID:15532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5133.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60951.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55783.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56663.exe
        7⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27863.exe
        8⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37623.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27163.exe
        9⤵
        
        PID:16004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        9⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22292.exe
        8⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60396.exe
        8⤵
        
        PID:15264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40894.exe
        8⤵
        
        PID:16024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43741.exe
        7⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38775.exe
        8⤵
        
        PID:10340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11492.exe
        8⤵
        
        PID:14360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16694.exe
        8⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36028.exe
        7⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57813.exe
        7⤵
        
        PID:15044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
        7⤵
        
        PID:15464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8982.exe
        7⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32100.exe
        6⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50990.exe
        7⤵
        
        PID:8928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56053.exe
        7⤵
        
        PID:13012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
        7⤵
        
        PID:16280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10621.exe
        6⤵
        
        PID:8604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28171.exe
        6⤵
        
        PID:13764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21045.exe
        6⤵
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38413.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-685.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28071.exe
        7⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20.exe
        7⤵
        
        PID:11632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22539.exe
        7⤵
        
        PID:15232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15824.exe
        7⤵
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-621.exe
        6⤵
        
        PID:7228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16827.exe
        6⤵
        
        PID:12272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45509.exe
        6⤵
        
        PID:15924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27220.exe
        6⤵
        
        PID:16288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        6⤵
        
        PID:16416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8011.exe
        5⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        6⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53941.exe
        6⤵
        
        PID:12920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64296.exe
        6⤵
        
        PID:6384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30990.exe
        5⤵
        
        PID:9064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1259.exe
        5⤵
        
        PID:13048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-334.exe
        5⤵
        
        PID:6388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61749.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12477.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53207.exe
        6⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-701.exe
        7⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47150.exe
        8⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17236.exe
        8⤵
        
        PID:13784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25517.exe
        8⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19572.exe
        7⤵
        
        PID:10740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40901.exe
        7⤵
        
        PID:15104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54343.exe
        7⤵
        
        PID:9788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3965.exe
        6⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20654.exe
        7⤵
        
        PID:11512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8804.exe
        7⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9942.exe
        7⤵
        
        PID:16412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10445.exe
        6⤵
        
        PID:10500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49340.exe
        6⤵
        
        PID:14276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22399.exe
        6⤵
        
        PID:3888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51790.exe
        5⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42663.exe
        6⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41390.exe
        7⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5332.exe
        7⤵
        
        PID:708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57623.exe
        7⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18525.exe
        6⤵
        
        PID:10508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22212.exe
        6⤵
        
        PID:14476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8029.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4836.exe
        5⤵
        
        PID:7912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25511.exe
        6⤵
        
        PID:10856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47621.exe
        6⤵
        
        PID:15180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49559.exe
        6⤵
        
        PID:16012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2381.exe
        5⤵
        
        PID:11820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35691.exe
        5⤵
        
        PID:15572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23406.exe
        5⤵
        
        PID:16692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58014.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40327.exe
        5⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42663.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8214.exe
        7⤵
        
        PID:11092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4253.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49559.exe
        7⤵
        
        PID:15976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5396.exe
        6⤵
        
        PID:9984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25227.exe
        6⤵
        
        PID:14128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21869.exe
        6⤵
        
        PID:15664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10644.exe
        5⤵
        
        PID:7892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62053.exe
        5⤵
        
        PID:11812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10438.exe
        5⤵
        
        PID:15720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16036.exe
      4⤵
      PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46631.exe
        5⤵
        
        PID:8516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54517.exe
        5⤵
        
        PID:12732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exe
        5⤵
        
        PID:1416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34740.exe
      4⤵
      PID:7220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15437.exe
      4⤵
      PID:11420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2211.exe
      4⤵
      PID:15684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25807.exe
      4⤵
      PID:516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39437.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39437.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8470.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61143.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55975.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10285.exe
        7⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
        8⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4182.exe
        9⤵
        
        PID:11204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        9⤵
        
        PID:15392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18525.exe
        8⤵
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59820.exe
        8⤵
        
        PID:15092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5533.exe
        8⤵
        
        PID:14472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10644.exe
        7⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27270.exe
        8⤵
        
        PID:15240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12852.exe
        7⤵
        
        PID:11864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44357.exe
        7⤵
        
        PID:15544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54677.exe
        7⤵
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21437.exe
        6⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46055.exe
        7⤵
        
        PID:8576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51502.exe
        7⤵
        
        PID:12836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
        7⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57605.exe
        6⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5942.exe
        7⤵
        
        PID:16668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7044.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23211.exe
        6⤵
        
        PID:15580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39647.exe
        6⤵
        
        PID:9384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56524.exe
        5⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6134.exe
        6⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21847.exe
        7⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe
        7⤵
        
        PID:15196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16212.exe
        7⤵
        
        PID:15544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1702.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19604.exe
        6⤵
        
        PID:10124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe
        6⤵
        
        PID:14320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5533.exe
        6⤵
        
        PID:13144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39710.exe
        5⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7565.exe
        6⤵
        
        PID:11176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2939.exe
        6⤵
        
        PID:14484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24365.exe
        6⤵
        
        PID:208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40924.exe
        5⤵
        
        PID:10332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22420.exe
        5⤵
        
        PID:14408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7014.exe
        5⤵
        
        PID:516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-869.exe
        5⤵
        
        PID:14632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48014.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61486.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:32
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7462.exe
        6⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51630.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34878.exe
        8⤵
        
        PID:11588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33206.exe
        8⤵
        
        PID:16700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10637.exe
        7⤵
        
        PID:10436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41756.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5341.exe
        7⤵
        
        PID:15880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20109.exe
        6⤵
        
        PID:6868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43724.exe
        6⤵
        
        PID:10348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47621.exe
        6⤵
        
        PID:14396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21670.exe
        6⤵
        
        PID:15844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
        5⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16263.exe
        6⤵
        
        PID:8980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50734.exe
        6⤵
        
        PID:12940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60412.exe
        6⤵
        
        PID:15548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26278.exe
        6⤵
        
        PID:15992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54076.exe
        5⤵
        
        PID:7668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23381.exe
        5⤵
        
        PID:12176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23211.exe
        5⤵
        
        PID:15592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10822.exe
        5⤵
        
        PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5963.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55511.exe
        5⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
        6⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35437.exe
        6⤵
        
        PID:11196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41756.exe
        6⤵
        
        PID:12980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5533.exe
        6⤵
        
        PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10644.exe
        5⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29958.exe
        6⤵
        
        PID:16092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52270.exe
        5⤵
        
        PID:12504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50230.exe
        5⤵
        
        PID:16676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56030.exe
      4⤵
      PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6589.exe
        5⤵
        
        PID:7372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6237.exe
        5⤵
        
        PID:10748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19300.exe
        5⤵
        
        PID:15472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16685.exe
        5⤵
        
        PID:16636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54805.exe
      4⤵
      PID:7624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63909.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63909.exe
      4⤵
      PID:11564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23741.exe
      4⤵
      PID:15604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4534.exe
      4⤵
      PID:6180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21691.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21691.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60951.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56359.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6310.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51630.exe
        7⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27566.exe
        8⤵
        
        PID:10080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25524.exe
        8⤵
        
        PID:15252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38184.exe
        8⤵
        
        PID:12880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25053.exe
        7⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19067.exe
        7⤵
        
        PID:12832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14903.exe
        7⤵
        
        PID:7012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23316.exe
        6⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24935.exe
        7⤵
        
        PID:10372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57223.exe
        7⤵
        
        PID:15580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27195.exe
        6⤵
        
        PID:10400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24164.exe
        6⤵
        
        PID:16204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55694.exe
        6⤵
        
        PID:16724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
        5⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30103.exe
        6⤵
        
        PID:8468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32669.exe
        6⤵
        
        PID:12456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7446.exe
        6⤵
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7444.exe
        5⤵
        
        PID:8424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5565.exe
        5⤵
        
        PID:12640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35653.exe
        5⤵
        
        PID:15380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3437.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe
        5⤵
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9533.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6973.exe
        7⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39677.exe
        7⤵
        
        PID:11304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10479.exe
        7⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12541.exe
        6⤵
        
        PID:8676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19051.exe
        6⤵
        
        PID:12660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64334.exe
        6⤵
        
        PID:15644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14672.exe
        6⤵
        
        PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39844.exe
        5⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25214.exe
        6⤵
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3149.exe
        6⤵
        
        PID:16556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23604.exe
        5⤵
        
        PID:10700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47621.exe
        5⤵
        
        PID:14420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21670.exe
        5⤵
        
        PID:4480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8836.exe
      4⤵
      PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30487.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32669.exe
        5⤵
        
        PID:12480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44460.exe
        5⤵
        
        PID:15240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exe
        5⤵
        
        PID:3828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54622.exe
      4⤵
      PID:7704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51765.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25447.exe
      4⤵
      PID:916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44542.exe
      4⤵
      PID:5280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2077.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2077.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42327.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48814.exe
        5⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27655.exe
        6⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46055.exe
        7⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54517.exe
        7⤵
        
        PID:12652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54343.exe
        7⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11389.exe
        6⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4059.exe
        6⤵
        
        PID:13056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-356.exe
        6⤵
        
        PID:16248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42814.exe
        6⤵
        
        PID:5108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4852.exe
        5⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46631.exe
        6⤵
        
        PID:8496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54517.exe
        6⤵
        
        PID:12772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14903.exe
        6⤵
        
        PID:7260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
        5⤵
        
        PID:8372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36837.exe
        5⤵
        
        PID:13800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9903.exe
        5⤵
        
        PID:4256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50062.exe
      4⤵
      PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36503.exe
        5⤵
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46055.exe
        6⤵
        
        PID:9004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53941.exe
        6⤵
        
        PID:12912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56455.exe
        6⤵
        
        PID:15560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7549.exe
        5⤵
        
        PID:10188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61148.exe
        5⤵
        
        PID:13716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40656.exe
        5⤵
        
        PID:15608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59340.exe
      4⤵
      PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5142.exe
        5⤵
        
        PID:8160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45509.exe
        5⤵
        
        PID:15308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46871.exe
        5⤵
        
        PID:3040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16772.exe
      4⤵
      PID:10668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33764.exe
      4⤵
      PID:15132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49877.exe
      4⤵
      PID:15996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49349.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49349.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39559.exe
      4⤵
      PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26327.exe
        5⤵
        
        PID:7292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19367.exe
        6⤵
        
        PID:11756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24564.exe
        6⤵
        
        PID:15452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5396.exe
        5⤵
        
        PID:10300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25227.exe
        5⤵
        
        PID:14340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49542.exe
        5⤵
        
        PID:16660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10644.exe
      4⤵
      PID:7904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34878.exe
        5⤵
        
        PID:11412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25332.exe
        5⤵
        
        PID:15240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62760.exe
        5⤵
        
        PID:7348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62053.exe
      4⤵
      PID:11856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44357.exe
      4⤵
      PID:15552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54677.exe
      4⤵
      PID:5980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53061.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53061.exe
    3⤵
    PID:5584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44462.exe
      4⤵
      PID:10048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64133.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58988.exe
      4⤵
      PID:15616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17069.exe
      4⤵
      PID:16444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38039.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38039.exe
    3⤵
    PID:8364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22604.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22604.exe
    3⤵
    PID:12432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4918.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4918.exe
    3⤵
    PID:1584
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4061.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4061.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10486.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10486.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22503.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30526.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11766.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59047.exe
        7⤵
        Executes dropped EXE
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47063.exe
        8⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
        9⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29118.exe
        10⤵
        
        PID:11340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45141.exe
        10⤵
        
        PID:15672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10141.exe
        10⤵
        
        PID:14656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13133.exe
        9⤵
        
        PID:11000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32196.exe
        9⤵
        
        PID:12928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40894.exe
        9⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26077.exe
        8⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6134.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62053.exe
        8⤵
        
        PID:11884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44357.exe
        8⤵
        
        PID:15532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28741.exe
        8⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56414.exe
        7⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
        8⤵
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21547.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36596.exe
        8⤵
        
        PID:3172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41461.exe
        7⤵
        
        PID:9100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18571.exe
        7⤵
        
        PID:14140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5871.exe
        7⤵
        
        PID:2416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29389.exe
        6⤵
        
        PID:2972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11821.exe
        7⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-701.exe
        8⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48375.exe
        9⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24621.exe
        9⤵
        
        PID:14492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46871.exe
        9⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22292.exe
        8⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45788.exe
        8⤵
        
        PID:12992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5533.exe
        8⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33595.exe
        7⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57991.exe
        8⤵
        
        PID:10900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9188.exe
        8⤵
        
        PID:15136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49559.exe
        8⤵
        
        PID:15816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26398.exe
        7⤵
        
        PID:10692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13268.exe
        7⤵
        
        PID:12996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60609.exe
        7⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51509.exe
        6⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30103.exe
        7⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19351.exe
        8⤵
        
        PID:16684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54517.exe
        7⤵
        
        PID:12756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56839.exe
        7⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40590.exe
        6⤵
        
        PID:7308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14907.exe
        6⤵
        
        PID:11640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6676.exe
        6⤵
        
        PID:15652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49342.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8045.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59239.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63207.exe
        7⤵
        
        PID:1296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47479.exe
        8⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1556.exe
        8⤵
        
        PID:11980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54636.exe
        8⤵
        
        PID:15412
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15412 -s 72
        9⤵
        Program crash
        
        PID:15900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55573.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16189.exe
        7⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19972.exe
        7⤵
        
        PID:3852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35390.exe
        7⤵
        
        PID:15408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26830.exe
        7⤵
        
        PID:15400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40269.exe
        6⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41639.exe
        7⤵
        
        PID:10092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47413.exe
        7⤵
        
        PID:13728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14987.exe
        7⤵
        
        PID:15544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26477.exe
        7⤵
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28004.exe
        6⤵
        
        PID:9140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18571.exe
        6⤵
        
        PID:14132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41424.exe
        6⤵
        
        PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59653.exe
        5⤵
        
        PID:1704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24183.exe
        6⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38055.exe
        7⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8214.exe
        8⤵
        
        PID:11060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38404.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16694.exe
        8⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10253.exe
        7⤵
        
        PID:10592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32196.exe
        7⤵
        
        PID:14520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40894.exe
        7⤵
        
        PID:15464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31453.exe
        6⤵
        
        PID:7660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18612.exe
        6⤵
        
        PID:11020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11876.exe
        6⤵
        
        PID:14708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57223.exe
        6⤵
        
        PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57758.exe
        5⤵
        
        PID:2728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30103.exe
        6⤵
        
        PID:8948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5035.exe
        6⤵
        
        PID:14096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
        6⤵
        
        PID:1500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42828.exe
        5⤵
        
        PID:8700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48916.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1654.exe
        5⤵
        
        PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7261.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-557.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61870.exe
        6⤵
        
        PID:3956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51095.exe
        7⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-445.exe
        8⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32669.exe
        8⤵
        
        PID:12472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7446.exe
        8⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57253.exe
        7⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15734.exe
        8⤵
        
        PID:676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27211.exe
        7⤵
        
        PID:12216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6043.exe
        7⤵
        
        PID:15980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43344.exe
        7⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35604.exe
        6⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
        7⤵
        
        PID:9536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4827.exe
        7⤵
        
        PID:13656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29358.exe
        7⤵
        
        PID:15644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20324.exe
        7⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21670.exe
        7⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57989.exe
        6⤵
        
        PID:9024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2235.exe
        6⤵
        
        PID:14076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7983.exe
        6⤵
        
        PID:2084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29005.exe
        5⤵
        
        PID:544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26430.exe
        6⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44007.exe
        7⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49838.exe
        8⤵
        
        PID:8956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61397.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13136.exe
        8⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40029.exe
        7⤵
        
        PID:9116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30971.exe
        7⤵
        
        PID:13772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
        7⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6461.exe
        6⤵
        
        PID:7272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19131.exe
        6⤵
        
        PID:9992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31093.exe
        6⤵
        
        PID:14376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7446.exe
        6⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6859.exe
        5⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        6⤵
        
        PID:8940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34589.exe
        6⤵
        
        PID:12884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5334.exe
        6⤵
        
        PID:14664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46174.exe
        5⤵
        
        PID:8404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62437.exe
        5⤵
        
        PID:12564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60579.exe
        5⤵
        
        PID:1196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54111.exe
        5⤵
        
        PID:15244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10571.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58855.exe
        5⤵
        
        PID:636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64551.exe
        6⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15190.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46405.exe
        7⤵
        
        PID:12420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38736.exe
        7⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35021.exe
        6⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54565.exe
        6⤵
        
        PID:11972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45669.exe
        6⤵
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24100.exe
        6⤵
        
        PID:15488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6063.exe
        6⤵
        
        PID:4348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59429.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32599.exe
        6⤵
        
        PID:8748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32123.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10095.exe
        6⤵
        
        PID:556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63692.exe
        5⤵
        
        PID:9188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9924.exe
        5⤵
        
        PID:13120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59062.exe
        5⤵
        
        PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2228.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7846.exe
        5⤵
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
        6⤵
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21095.exe
        7⤵
        
        PID:12200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57415.exe
        7⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3917.exe
        6⤵
        
        PID:10456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36764.exe
        6⤵
        
        PID:14952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38206.exe
        6⤵
        
        PID:1488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10644.exe
        5⤵
        
        PID:7876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62053.exe
        5⤵
        
        PID:11876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44357.exe
        5⤵
        
        PID:15488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51605.exe
        5⤵
        
        PID:14652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49093.exe
      4⤵
      PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46631.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21844.exe
        5⤵
        
        PID:12740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60412.exe
        5⤵
        
        PID:15676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-976.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26292.exe
      4⤵
      PID:8692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-445.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41183.exe
      4⤵
      PID:7472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5517.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5517.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10598.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16318.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48871.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56471.exe
        7⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44007.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16263.exe
        9⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
        9⤵
        
        PID:13004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17023.exe
        9⤵
        
        PID:16580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43044.exe
        8⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51518.exe
        8⤵
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18101.exe
        8⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20301.exe
        7⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24878.exe
        8⤵
        
        PID:10472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60117.exe
        8⤵
        
        PID:14940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38184.exe
        8⤵
        
        PID:15812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58773.exe
        7⤵
        
        PID:10784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47621.exe
        7⤵
        
        PID:14464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21670.exe
        7⤵
        
        PID:15628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21437.exe
        6⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
        7⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3099.exe
        7⤵
        
        PID:13256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27008.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35493.exe
        6⤵
        
        PID:8084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63886.exe
        6⤵
        
        PID:11568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23211.exe
        6⤵
        
        PID:15640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9286.exe
        6⤵
        
        PID:1228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31636.exe
        5⤵
        
        PID:316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64551.exe
        6⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10774.exe
        7⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16221.exe
        7⤵
        
        PID:11668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22539.exe
        7⤵
        
        PID:14500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29483.exe
        7⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10671.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35021.exe
        6⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8379.exe
        6⤵
        
        PID:12084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31877.exe
        6⤵
        
        PID:15588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44982.exe
        6⤵
        
        PID:9728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55868.exe
        5⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26516.exe
        6⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38062.exe
        6⤵
        
        PID:14716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54343.exe
        6⤵
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17149.exe
        5⤵
        
        PID:264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1259.exe
        5⤵
        
        PID:13068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24164.exe
        5⤵
        
        PID:16148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-142.exe
        5⤵
        
        PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64293.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1014.exe
        5⤵
        
        PID:1740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
        6⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
        7⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43381.exe
        7⤵
        
        PID:14268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40886.exe
        7⤵
        
        PID:15388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4845.exe
        6⤵
        
        PID:7248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        6⤵
        
        PID:12184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31877.exe
        6⤵
        
        PID:15700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14288.exe
        6⤵
        
        PID:16388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21732.exe
        5⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19175.exe
        6⤵
        
        PID:11784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41092.exe
        6⤵
        
        PID:15368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21670.exe
        6⤵
        
        PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41893.exe
        5⤵
        
        PID:836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29396.exe
        5⤵
        
        PID:13712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57184.exe
        5⤵
        
        PID:14368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46908.exe
      4⤵
      PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11821.exe
        5⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
        6⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59406.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43694.exe
        7⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18525.exe
        6⤵
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24843.exe
        6⤵
        
        PID:14616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38206.exe
        6⤵
        
        PID:13660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26077.exe
        5⤵
        
        PID:8000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62053.exe
        5⤵
        
        PID:12008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44165.exe
        5⤵
        
        PID:15396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44885.exe
        5⤵
        
        PID:16716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58718.exe
      4⤵
      PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46055.exe
        5⤵
        
        PID:8844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54517.exe
        5⤵
        
        PID:12296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        5⤵
        
        PID:7496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4644.exe
      4⤵
      PID:8412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27069.exe
      4⤵
      PID:12408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42190.exe
      4⤵
      PID:14604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53542.exe
      4⤵
      PID:15980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53285.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53285.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62119.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50983.exe
        5⤵
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64551.exe
        6⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30295.exe
        7⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32669.exe
        7⤵
        
        PID:12464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44460.exe
        7⤵
        
        PID:15688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46176.exe
        7⤵
        
        PID:9376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35021.exe
        6⤵
        
        PID:7648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54565.exe
        6⤵
        
        PID:12068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45669.exe
        6⤵
        
        PID:15200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61029.exe
        6⤵
        
        PID:16604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
        5⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46055.exe
        6⤵
        
        PID:8768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34973.exe
        6⤵
        
        PID:12812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25510.exe
        6⤵
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7444.exe
        5⤵
        
        PID:8436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41445.exe
        5⤵
        
        PID:12548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5285.exe
        5⤵
        
        PID:15676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30925.exe
      4⤵
      PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25853.exe
        5⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
        6⤵
        
        PID:7580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29780.exe
        6⤵
        
        PID:14292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2399.exe
        6⤵
        
        PID:1540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-454.exe
        6⤵
        
        PID:16732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42805.exe
        5⤵
        
        PID:8588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8580.exe
        5⤵
        
        PID:12724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7750.exe
        5⤵
        
        PID:14676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52085.exe
      4⤵
      PID:3388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59454.exe
        5⤵
        
        PID:9716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29924.exe
        5⤵
        
        PID:13668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5725.exe
        5⤵
        
        PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32142.exe
      4⤵
      PID:8640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65452.exe
      4⤵
      PID:12748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47038.exe
      4⤵
      PID:5368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31486.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31486.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33879.exe
      4⤵
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57623.exe
        5⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46055.exe
        6⤵
        
        PID:8908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34589.exe
        6⤵
        
        PID:12904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        6⤵
        
        PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
        5⤵
        
        PID:8128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3222.exe
        6⤵
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12159.exe
        7⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24756.exe
        6⤵
        
        PID:15560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24916.exe
        6⤵
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26721.exe
        6⤵
        
        PID:9316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15291.exe
        5⤵
        
        PID:11988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54677.exe
        5⤵
        
        PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32100.exe
      4⤵
      PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30103.exe
        5⤵
        
        PID:8884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5316.exe
        5⤵
        
        PID:12608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58951.exe
        5⤵
        
        PID:17040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59630.exe
      4⤵
      PID:8392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26317.exe
      4⤵
      PID:12452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52862.exe
      4⤵
      PID:15192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20678.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60636.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60636.exe
    3⤵
    PID:1644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48791.exe
      4⤵
      PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46695.exe
        5⤵
        
        PID:6760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6294.exe
        6⤵
        
        PID:11212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-135.exe
        7⤵
        
        PID:2832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11492.exe
        6⤵
        
        PID:14384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14006.exe
        6⤵
        
        PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19572.exe
        5⤵
        
        PID:10676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28405.exe
        5⤵
        
        PID:15172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54485.exe
        5⤵
        
        PID:16396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6461.exe
      4⤵
      PID:7264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19131.exe
      4⤵
      PID:11244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31093.exe
      4⤵
      PID:12900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21670.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32557.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32557.exe
    3⤵
    PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55598.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58261.exe
      4⤵
      PID:11424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29524.exe
      4⤵
      PID:15376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46871.exe
      4⤵
      PID:15548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39959.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39959.exe
    3⤵
    PID:8804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44451.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44451.exe
    3⤵
    PID:12628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27367.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15672
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53365.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53365.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41335.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61719.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65383.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36183.exe
        6⤵
        
        PID:3864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64551.exe
        7⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30567.exe
        8⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31863.exe
        9⤵
        
        PID:11396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25332.exe
        9⤵
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56000.exe
        9⤵
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49662.exe
        8⤵
        
        PID:12232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6779.exe
        8⤵
        
        PID:16000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-687.exe
        8⤵
        
        PID:16620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35021.exe
        7⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54565.exe
        7⤵
        
        PID:11804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45669.exe
        7⤵
        
        PID:14416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11389.exe
        7⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54677.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38349.exe
        6⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30103.exe
        7⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
        7⤵
        
        PID:13024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22763.exe
        7⤵
        
        PID:15844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17599.exe
        7⤵
        
        PID:16544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26276.exe
        6⤵
        
        PID:8652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12987.exe
        6⤵
        
        PID:13836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35653.exe
        6⤵
        
        PID:14444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32461.exe
        5⤵
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49367.exe
        6⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        7⤵
        
        PID:8964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56261.exe
        7⤵
        
        PID:13744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40444.exe
        7⤵
        
        PID:15492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54343.exe
        7⤵
        
        PID:15476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35981.exe
        6⤵
        
        PID:7760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57637.exe
        6⤵
        
        PID:11956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31877.exe
        6⤵
        
        PID:15720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30433.exe
        6⤵
        
        PID:15144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37093.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4342.exe
        6⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8141.exe
        7⤵
        
        PID:15696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3092.exe
        6⤵
        
        PID:12260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23307.exe
        6⤵
        
        PID:15912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41173.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64238.exe
        5⤵
        
        PID:8896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61989.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48382.exe
        5⤵
        
        PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48149.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35607.exe
        5⤵
        
        PID:864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35335.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25997.exe
        7⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13675.exe
        7⤵
        
        PID:13808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58183.exe
        7⤵
        
        PID:15404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41108.exe
        6⤵
        
        PID:8176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24196.exe
        6⤵
        
        PID:11124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41205.exe
        6⤵
        
        PID:14368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54343.exe
        6⤵
        
        PID:14500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23357.exe
        5⤵
        
        PID:6436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46631.exe
        6⤵
        
        PID:8508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32669.exe
        6⤵
        
        PID:12496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59688.exe
        6⤵
        
        PID:1984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44341.exe
        5⤵
        
        PID:9164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2235.exe
        5⤵
        
        PID:14068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49284.exe
        5⤵
        
        PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31585.exe
        5⤵
        
        PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45813.exe
      4⤵
      PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34951.exe
        5⤵
        
        PID:6044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46055.exe
        6⤵
        
        PID:8916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34589.exe
        6⤵
        
        PID:12892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23974.exe
        6⤵
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41108.exe
        5⤵
        
        PID:8144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58021.exe
        5⤵
        
        PID:11556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31877.exe
        5⤵
        
        PID:15488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26432.exe
        5⤵
        
        PID:5988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34126.exe
      4⤵
      PID:6884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48935.exe
        5⤵
        
        PID:8832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54517.exe
        5⤵
        
        PID:12780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61992.exe
        5⤵
        
        PID:15372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18484.exe
      4⤵
      PID:10168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41812.exe
      4⤵
      PID:13704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1763.exe
      4⤵
      PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27222.exe
      4⤵
      PID:16628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57998.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57998.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23303.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55703.exe
        5⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50151.exe
        6⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60279.exe
        7⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42036.exe
        7⤵
        
        PID:13576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36140.exe
        7⤵
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46871.exe
        7⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38021.exe
        6⤵
        
        PID:2188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51836.exe
        6⤵
        
        PID:15388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49150.exe
        6⤵
        
        PID:1632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45662.exe
        5⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30295.exe
        6⤵
        
        PID:8524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21844.exe
        6⤵
        
        PID:12668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59143.exe
        6⤵
        
        PID:14440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56780.exe
        5⤵
        
        PID:8548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61637.exe
        5⤵
        
        PID:13480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23915.exe
        5⤵
        
        PID:16168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54343.exe
        5⤵
        
        PID:9404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
      4⤵
      PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46055.exe
        5⤵
        
        PID:8820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54517.exe
        5⤵
        
        PID:12820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40118.exe
        5⤵
        
        PID:5572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
      4⤵
      PID:8384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10683.exe
      4⤵
      PID:13816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51989.exe
      4⤵
      PID:15468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55356.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55356.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4198.exe
      4⤵
      PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4982.exe
        5⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14166.exe
        6⤵
        
        PID:10480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28020.exe
        6⤵
        
        PID:14440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38184.exe
        6⤵
        
        PID:15516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40029.exe
        5⤵
        
        PID:9032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63836.exe
        5⤵
        
        PID:13748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27008.exe
        5⤵
        
        PID:5084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35293.exe
      4⤵
      PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49543.exe
        5⤵
        
        PID:11008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8804.exe
        5⤵
        
        PID:15524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-534.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38789.exe
      4⤵
      PID:9968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24933.exe
      4⤵
      PID:14308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21984.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7005.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7005.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32046.exe
      4⤵
      PID:8060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48318.exe
      4⤵
      PID:11840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38492.exe
      4⤵
      PID:15112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10671.exe
      4⤵
      PID:2248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37012.exe
    3⤵
    PID:7984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61877.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61877.exe
    3⤵
    PID:11948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52366.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52366.exe
    3⤵
    PID:15420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22735.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22735.exe
    3⤵
    PID:14688
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8205.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8205.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28279.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28279.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59182.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7078.exe
        5⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44007.exe
        6⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44151.exe
        7⤵
        
        PID:10308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13780.exe
        7⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36596.exe
        7⤵
        
        PID:16148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25429.exe
        7⤵
        
        PID:9200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19572.exe
        6⤵
        
        PID:10728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42245.exe
        6⤵
        
        PID:15280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21670.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6461.exe
        5⤵
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33783.exe
        6⤵
        
        PID:11524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8804.exe
        6⤵
        
        PID:14160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65448.exe
        6⤵
        
        PID:1248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19131.exe
        5⤵
        
        PID:11256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31093.exe
        5⤵
        
        PID:14348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6224.exe
        5⤵
        
        PID:1300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58661.exe
      4⤵
      PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
        5⤵
        
        PID:7408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58046.exe
        5⤵
        
        PID:13828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54343.exe
        5⤵
        
        PID:1448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40309.exe
      4⤵
      PID:8396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41445.exe
      4⤵
      PID:12540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15862.exe
      4⤵
      PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4901.exe
      4⤵
      PID:5340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58149.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58149.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11821.exe
      4⤵
      PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
        5⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36247.exe
        6⤵
        
        PID:7440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53260.exe
        6⤵
        
        PID:13028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14672.exe
        6⤵
        
        PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13309.exe
        5⤵
        
        PID:9220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58046.exe
        5⤵
        
        PID:13648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8331.exe
        5⤵
        
        PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27361.exe
        5⤵
        
        PID:15556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9252.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36647.exe
        5⤵
        
        PID:10136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18845.exe
        5⤵
        
        PID:14536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49559.exe
        5⤵
        
        PID:15632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-253.exe
      4⤵
      PID:10964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29396.exe
      4⤵
      PID:12952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22399.exe
      4⤵
      PID:8684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28750.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28750.exe
    3⤵
    PID:6348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46055.exe
      4⤵
      PID:8852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54517.exe
      4⤵
      PID:12764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8982.exe
      4⤵
      PID:5360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34436.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34436.exe
    3⤵
    PID:8608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44500.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44500.exe
    3⤵
    PID:13736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8919.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8919.exe
    3⤵
    PID:5816
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58949.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58949.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54823.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54823.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7869.exe
      4⤵
      PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55719.exe
        5⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41079.exe
        6⤵
        
        PID:10364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18806.exe
        7⤵
        
        PID:1928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39364.exe
        6⤵
        
        PID:14920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35496.exe
        6⤵
        
        PID:15324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13901.exe
        5⤵
        
        PID:8292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32580.exe
        5⤵
        
        PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49158.exe
        5⤵
        
        PID:16612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36829.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36829.exe
      4⤵
      PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32247.exe
        5⤵
        
        PID:11356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24756.exe
        5⤵
        
        PID:15468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        5⤵
        
        PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42245.exe
      4⤵
      PID:10844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47621.exe
      4⤵
      PID:14428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56455.exe
      4⤵
      PID:2404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37012.exe
    3⤵
    PID:1408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34951.exe
      4⤵
      PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16263.exe
        5⤵
        
        PID:8988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53749.exe
        5⤵
        
        PID:12956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39877.exe
        5⤵
        
        PID:15608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17636.exe
        5⤵
        
        PID:16108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65495.exe
        5⤵
        
        PID:16596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41108.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24196.exe
      4⤵
      PID:12268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8916.exe
      4⤵
      PID:3048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27598.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27598.exe
    3⤵
    PID:6776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33783.exe
      4⤵
      PID:11536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8804.exe
      4⤵
      PID:14604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65448.exe
      4⤵
      PID:15140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
    3⤵
    PID:7732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65269.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65269.exe
    3⤵
    PID:4036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35653.exe
    3⤵
    PID:3012
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28973.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28973.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52903.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52903.exe
    3⤵
    PID:3280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45719.exe
      4⤵
      PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27799.exe
        5⤵
        
        PID:10148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41844.exe
        5⤵
        
        PID:12804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46871.exe
        5⤵
        
        PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13117.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49861.exe
      4⤵
      PID:13160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6063.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24141.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24141.exe
    3⤵
    PID:6688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25262.exe
      4⤵
      PID:10376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11108.exe
      4⤵
      PID:14744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35496.exe
      4⤵
      PID:16244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36028.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36028.exe
    3⤵
    PID:6612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16100.exe
    3⤵
    PID:15152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40118.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40118.exe
    3⤵
    PID:916
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34519.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34519.exe
  2⤵
  PID:4780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33815.exe
    3⤵
    PID:6988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
      4⤵
      PID:7236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31428.exe
        5⤵
        
        PID:15364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41006.exe
        5⤵
        
        PID:6960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3675.exe
      4⤵
      PID:13184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10671.exe
      4⤵
      PID:15540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28301.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28301.exe
    3⤵
    PID:8872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54517.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54517.exe
    3⤵
    PID:13556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54677.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54677.exe
    3⤵
    PID:5880
- C:\Users\Admin\AppData\Local\Temp\Unicorn-812.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-812.exe
  2⤵
  PID:7020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62599.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62599.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28020.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28020.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:14512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46871.exe
    3⤵
    PID:4120
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6892.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6892.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:9172
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7261.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7261.exe
  2⤵
  PID:12280
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34704.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34704.exe
  2⤵
  PID:16652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 13704 -ip 13704
1⤵
PID:15812

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 484 -p 13544 -ip 13544
1⤵
PID:15840

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 512 -p 15412 -ip 15412
1⤵
PID:15868

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6244

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:13376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10486.exe

Filesize
468KB

MD5
8f890e4ffbeac99498466c7c58abe804

SHA1
04ee6e4e5f1cf43455632518ab69b599a561ae0f

SHA256
f0baab9aa1881c6fd69d1d7f92f35a98b8d0a632d7004a2606959ea011f1750b

SHA512
23bb67508f8dbdf67896dd78610a8a03daf668b7ac70443df800355157eae663ac5c938e0b6fecc167d11dd496b8e11da0a52a1b8362cee8d9e4d9c448e16072

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10598.exe

Filesize
468KB

MD5
910d5999543acc7866b2463735f0cadd

SHA1
bdb9d69ba7cd3febaaeeccf88959061273f57c76

SHA256
1f52f84d31e9dd50c529f136bfecdbb98d0003e100bee56f1f1acea66f5eeafe

SHA512
581b5f35ccdff1eadcf1ba3e182bc57067a8484d9bb9d334f059a58882fbc3005ad2ed65558da6886bc62c8ec36fa9d80d0e827e66a620fa0671ff35f95d25c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11766.exe

Filesize
468KB

MD5
5ca965e488410b08d831bdb22b17977d

SHA1
ea2c8684540ff4b8696f92adbc8d7f2da734367b

SHA256
9524cff6456152bc64b8eb51a0eae515afb4643ad33706460c31ac4b68fa8e3d

SHA512
fef9dcfac2f92adec92e04bc0e01be0b7ca7fe569a5406d37786391ceb2f775544ee6f559404a0727e382e57ee09868e5cb939ca72a8b7d5ac8d4ab5f882e2b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12326.exe

Filesize
468KB

MD5
0835089b8fbce1634462329226db1caa

SHA1
e5b3d7a77309977f0c91e26536116158ff3fd4a5

SHA256
0595afb9346b6adcb3e4a2d96fbff2eb07ca3a6f0c97a12390be18308928f1ca

SHA512
7d908556f0c5ba8046156dfbc81365f094ffacaf6453a90e9365ea62300a10bd367917f75e4ce4ae0d85ad2a5a5b56fede45bfaf4adcbef5c79330b5d7ba3025

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2077.exe

Filesize
468KB

MD5
da2732a83c3ade6057a12b2d88cbfceb

SHA1
65f4e121abb4b19e3a0a0fda2d58ae81fa412c4a

SHA256
6cbafd7ac962c998425f9bff33bd4df8ea8b76a40e3d3b50e104fe0a1237dcc5

SHA512
0b1c4541f8109b80b338f1d0c31dddaf3e78a60320c98fd5385bd497608c68852488ba09135eeb0358450c70e894d1171f70165f8c3257502cc95f725b1a1d68

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21691.exe

Filesize
468KB

MD5
72e1373dc2832781638cf76210ba77db

SHA1
d2added7d04e1e3abeef14041a68342d1cb2ffa7

SHA256
728912ac320ff1654dd6e217023a92d7ce88575f9fac0de2884742f7fb44b2b1

SHA512
c62124b52470f5a662018f604c72f6778f98bd76679103707e677a7f09a632858ca0be67003902bc5e88fb9aa910fd20061e13f7812f123841925c524347541d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22503.exe

Filesize
468KB

MD5
50589ccdea7813cf8982748b6f3562ca

SHA1
13498b0bbb2d8ab89f1c92748bb59a2cda78245a

SHA256
71e965061699a820ce995ee6d574617218fe3d3a96e2fa8ecd80d593ebf0d1d6

SHA512
f01d7a019c5f017f1a62eb82583ad5e55945f864323ab66dd597827246ae2ffe7ecb02ff093934e0697a71df21dd516b088038e54da6785e3a0d1b308418f9bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23927.exe

Filesize
468KB

MD5
a84a131cd3f22b865cf8888ad0e3fbfc

SHA1
08fd4294e1c677e9864314389aae301ddc9873db

SHA256
6901887b2fe473dcce10abf5f8be78f5df21a29df59047e521b97a02b54e42ac

SHA512
b780d7d8a2e64e0cc322016b24f68ff5a2f15efd93e3b44a58248e4c39e9644878e93d06a01076cd0f031961c9a03ca0a444ab694e4092ab19881b45383020eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28206.exe

Filesize
468KB

MD5
61ba83a6e5f88119b99bb6a4ed292ee7

SHA1
7e8c5412860d2bfd7cbd5effaff7b2a4cbedb184

SHA256
c41f08e056afc827f734023c10559cb711749ae60d1543f220234aca06d2eecb

SHA512
80f1c27753457bc55779e9f0609ad250b47993d11db8a22091042db5f97498a889d117c318c6adcc41c49861e599e6bcb4a79b62a9bf07aa39e7b67b25afed62

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28279.exe

Filesize
468KB

MD5
fba81093d1cc5a62bbb52eaf85f233ab

SHA1
fa3960e14cbc93e7b9257b880d7e6eb395b95be1

SHA256
82af431d9736205e413529842387a33f25e54d85ba40797e055f592b366914b2

SHA512
997e07de7fc029d2629d0085aa43ec8b427dfcdc337f9a114295f38d77ce9dc5c0d5cda990dc0e9cf848090606d4c929d8337959a7a0614d77fd434be02a258d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30526.exe

Filesize
468KB

MD5
bb21cfcb9050b5b0635ab16e2975a3d3

SHA1
27eb1080b5cbba0e3adf5aa0e15c78909627742f

SHA256
abbbac83a47c07e1456688f4ffd11fa8a92976ae302d04c8c5e2e599ff6278b8

SHA512
0c9a880f477542ec329d6d9f86d962c74a47c427a63e03b450212b04e05bcfb173c65cf85013a7ef2de4a612a9ee4e3a2ac220f3700b48576157b72969757ca9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39437.exe

Filesize
468KB

MD5
9bff95505bef34b433e4eccb32b50687

SHA1
09f19cbad000d8590c871ca2faf030a15f6efdbc

SHA256
c4fc5b08e22d2469e073dfe3cd683414da232a1530288f7cff389d99ab171797

SHA512
dfe4e77560acf00fb6cb1733852c8adc283e6d2f29bd0fb975888c662edb7a9749028bfea55e338ad75896cf30da340c50ea14388401a036deb5171062730f8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4061.exe

Filesize
468KB

MD5
3b4c40467c52e1ae922f921481328f22

SHA1
fecb296f1cc178d6244f7fb5ccd98ca890fce63f

SHA256
44534ba0054a839897588cb9699596a8c23d23b14036fce347add685ccdec9bc

SHA512
9755659208f2cd9c9f5cfc1e4dfd4e7999d5b6f0045342c4e5a89feab68b07dd65d5e273ee9214893336523ca50a0569909b3a5a90dc22c19fef99022450cf57

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41335.exe

Filesize
468KB

MD5
5d8ba5277b2fe0afea19db026c9b0dcf

SHA1
0cae94e88ffdb8e2d8818c0e4ac5b7f2a0d5e1bb

SHA256
ada0417cddb45137e616c7012651eec5535d0709227bdf88c31c155ef699a2f6

SHA512
0f7b4d88ed0077408402645335a2260eb44c435e341f7b9eb10bf6f92700c70a5eebad85ff69ab8919902dc869be2e4f2513d1d01c65134a74ce970e8f772653

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48014.exe

Filesize
468KB

MD5
eee87da557b86d4621e251c9ef3981c1

SHA1
1b475256fcffdb183dfde3c556065a3647d7f59b

SHA256
72250987115c6b9d31298eeb48c3c4e04671363c66fc7cf6dbb12706425fea9a

SHA512
207d9610a1138c35fad627ea1d486584ba6f27be3cc736692c0a5888f9066e470a5c7e8593fbe680758e1c390fd811eac5c1554e24242332e95254f344b177df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5133.exe

Filesize
468KB

MD5
000582c7a83bc31a628707f93a0c2fe1

SHA1
9eeb63f644ed39b84f424f90f146fc600dddc499

SHA256
bb39d0ca7ecc301cd3a3ec417371005ee4c90a25dfaf028583450864e3734478

SHA512
e8871beb8027bee8a7d3a05e27ce65c976e197eec578d2af93c6ef5e8761d76f71b66673a714cbbacf153bf33c2eedcdcc176e5a2a8be430fe3c61aaf8db1bc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53285.exe

Filesize
468KB

MD5
2de64351cc49be431bc8e6882640300d

SHA1
ee959126960050c86ae167900b0887954efe7aea

SHA256
636c60044868eb17e1473498cd92663df539c0a3c0b9d5b36d2675dbfd552c6c

SHA512
6f6f0c4c28964cf7e1fe84b0d1d95562136015fcfb3ab3a85edee5d6783609546ebb9a1014e4c42bbde30d9e959ce178d32ff4568f305665111a0782731535ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53365.exe

Filesize
468KB

MD5
3539d5ac77d869803c145b2694862a6f

SHA1
46a186f0f5553f82c999459ac28901aa92d9de03

SHA256
8e1b63a8e622d8cd611d25bb1b888016a90c0be9317be137c84b0801e6320106

SHA512
0e851e44846f3c39dd9bd910dffd1d5e3cf08a65bf1661934e438d8cb1b9bab860e061f59be594a79b082e6e13eedd1ae12aa54c71231573594d19085647adc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5517.exe

Filesize
468KB

MD5
3b5ad701e99c642667732f450f407c03

SHA1
4b8936ac4116d27e527b08132c8aa9f2dcf003be

SHA256
b901e541286239415a66d218c4460e8e2a319e12948e6b0540ab4292704ac65f

SHA512
8107f02834943485153a26650ff0962c579d818dc9281a60d286c4119ad19050951dc5ea15f77eb2789a6344acee525610369b591e46b677a08e53a28d0c757b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57806.exe

Filesize
468KB

MD5
09034765584559db72d4579e07e7b981

SHA1
cfaefc19ed34d908e7570c60598eeda3114b13d5

SHA256
9195c6e095eef4762ebf4847936c1162b34973cef90e93412ceac79814e8105a

SHA512
5ee6f5828372216b14d997904fffb33609af647b86976d1cc90dbe9fa05bfa65ec8b9b2ee4446eebca4ccee405d4f93efe6786d681fe24ec776c61a9f2615683

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57998.exe

Filesize
468KB

MD5
ea31a473434e11b8166a6d322dbdc591

SHA1
3861fa503d184f5b32dfed1c16b872bcb24452ce

SHA256
22f711844736171d685ddf78b1eca6e0d3013817c109ada1a556410be0d65abf

SHA512
c6cd322dd2129158123d46c1275151f1fa410ceca006c8a26773eefe8764a4721a26c24c3b7b4400d57aeb6fd3443f82430a4170a7a53c4443f03d6da4d9a105

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58949.exe

Filesize
468KB

MD5
d7bb1b367486ad312b7adaec9c324774

SHA1
e88f8d11b6d19ac16b5dfc7c0b5211b9e2c69aed

SHA256
e4858e1fba3fcadcb6f3645a9cdf64e6d982da0c2ed773154cd0d169ce3275d2

SHA512
920cb7707312eb9f9d5ec33a1b50a7a4fe81c648a0d7c3f4de6731b81fc5e00b2f2af60e36083c9902b15db34712ce0a6ab29c8955cf186cf167a9dbb1f39274

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60951.exe

Filesize
468KB

MD5
f0b81cbdb5564ebd015e97704d443a2a

SHA1
3fb2d16abf06d5bd90f1e89e7e0b17b17388d8d3

SHA256
f4fe598ac78cfde7ef19a063d42c5bc79d4bc91f84e8a2353d0ed50a796b7f3d

SHA512
d95723c2c9e5ccd1607896ca81a674efda60ddafb29d583724db4feebf26c1efb08561cf013d05758075eaa9865a5b469f451abfba34952c72a26219af9de44b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61143.exe

Filesize
468KB

MD5
a3c8440086492b011914b840bed11194

SHA1
1e8804b38ed7e3c88a0ab506ef20204ae07e37a8

SHA256
c2d96378441e616ff0ccb208f0849fac805e90393abaae9196ba4d0f90bda1d4

SHA512
c2afa290b78df3b419a2716bd481713bb3d5bbc9359d7551ca521cd959cab17245bc3b1d3e2514545a0de01863d228d9158368df6906484a3cdaeb6716ea8dc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61719.exe

Filesize
468KB

MD5
451b33b4b217b4155329895b9e7ba1b9

SHA1
ed0b4927d1e2f883bd8d8ee987e63a8f2b51d42f

SHA256
fa52eeacdddbcd0ed7d8b49d2c9c228f56d8b7f17f4db843105c53f2697e31cc

SHA512
b619e1cd0bfb60297433f4359ae8b418a76a3535ae227e7d4b8d29676db82ebec2bafb5004de3f435d5f03c948db2be3ec9af236e9330f6a071427d169742e0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61749.exe

Filesize
468KB

MD5
e7ba72783441b9726482acdde7d75475

SHA1
4268f5f4d6e976e3899f8134329fb3b977670b99

SHA256
8bc65683bda898dfcaae44ad035359ac44c7759a668b3823fce07b6bd53c8e71

SHA512
c48068ccadbd9c1676e5585bc94458d156ac1d3dcaf74b68c7656d73055c52af753ab143e547d787606a868016b5a5addeb5b21a7605b13725e9c3da44aee49b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62510.exe

Filesize
468KB

MD5
df9312961eae40b4a37ff3ecf05229b2

SHA1
a1f80456b5ee6816226232883a074a2b3a3d8049

SHA256
1f8c995b35747a13aa1415a0ed6917ed042b45714070384b32c22fb735e654c4

SHA512
87bb434a7175309021a6d76736409c7debf8d982e76c33481bbbcdb32a8e0afdce76401133bb5fc6d3f658ff534269223120274edafb8c87fcbce78cd119b41b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6998.exe

Filesize
468KB

MD5
f4d3b62734ada4850935135cff96496a

SHA1
2775698d748b5b16e65bda5f295ee7a25c40102c

SHA256
a4b66af3f004d1875debaefd6d6e52bfe5ff03a747f8deab2aba75637c404502

SHA512
f71d89117cbbab978235db01e6e20b42b7cafd3a552c7e7cd5284c634ab08d1078f97c05aa1d2ea0942d3dc014c967785cd45b843092556022f9bdd260c61011

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7261.exe

Filesize
468KB

MD5
88a8d7455ac154f2b8cc43c391659fad

SHA1
78ec6b2b3dffffeb48186558ce75cb2731c58740

SHA256
9c5dd57fb4d56fe5a9f9a6abcf9342d6faf9207e71222f12fc23ea4413993f2e

SHA512
43f2bc38ec8291af5d3333d864b936a94a49706a23dd29cd82317633c7fff6fae603524f73c08d8d03830504c356b4b29dd917671dc2478018a3eae90972f8af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8045.exe

Filesize
468KB

MD5
511e982aea276fe9a43e5582e72fcd36

SHA1
3d6ce5cbeb3e67cb041dba70511ebfc2cf04d899

SHA256
6a827988d8efc70df6452adbb5510cfa815c4cee9dfad64f35900336ed19bd15

SHA512
c56a91e754e1d7a834e8a7aae04cc7842fc6bf083aef277f7039743fc2607284b799ef371f3dea083688db13d754c806dfc86cdb4629d56a25758475af1a24c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8205.exe

Filesize
468KB

MD5
10cb4fb98cbf908c9901e05304c2b77d

SHA1
b02926c6f642592affb6179c1726926c35ea800e

SHA256
b03531d88d85eb2ab1ec4c06544672141822f2e020e24655e5c6e27393796a4a

SHA512
73843fa4fda4ccbc09c73594468a5d14567aae2986c8600dc6c62beb85a8d1ba2eca28914b1f505a6c8ab598d34bdb0158ff5edd2386cb0189042042ff77dff4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8470.exe

Filesize
468KB

MD5
e7ff2dd0d4b7d1d9820a52713d08eab3

SHA1
2564c5095ec9b22913fdccf5e7273638ee0f59bd

SHA256
361932faa1fd9ea3387ada812988d5d721dc61f423a00f9125f6acc57cb08325

SHA512
9a81be922fb2c3397dccecba6be94ba515b7f43b27218f0d1176b6a2f2965dcf09a1a4905f2e6483ed5320211cab836730df95b9c007c01cb1970c8b214e4a50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8756.exe

Filesize
468KB

MD5
267847c0d2938870d3c95d53509ce37b

SHA1
51b31078edf214d2252d7c878763bc2312eabc36

SHA256
8b30d1eeb220b112efd0a0415e3bdc849e149d44393e74da18fd598395e63b7b

SHA512
1c15ccd08b68386370c0204e502dd1a81e760d65eb19382c4818f89509a384db0d172c21503faea8cabab8806797d4cbbc3f19036217f05b2779b23b2184efb0

Download Submit
memory/32-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/212-36-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/316-482-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/384-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/440-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/544-481-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/636-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/664-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/748-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/784-196-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/864-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1128-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1208-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1244-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1324-131-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1336-435-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1408-493-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1460-500-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1492-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1556-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1580-138-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1588-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1644-446-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1652-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1704-425-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1740-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1752-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1860-92-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1900-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1932-117-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2012-221-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2136-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2168-492-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2208-461-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2280-488-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2332-483-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2348-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2476-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2616-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2628-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2636-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2848-191-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2912-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2972-426-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3048-2776-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3056-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3128-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3144-432-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3204-504-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3224-38-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3264-494-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3280-499-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3432-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3508-150-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3580-151-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3640-487-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3660-69-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3668-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3712-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3864-490-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3880-163-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3920-169-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3940-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3956-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3984-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4100-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4132-46-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4220-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4264-157-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4300-197-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4404-344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4412-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4416-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4428-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4440-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4556-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4624-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4628-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4660-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4728-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4780-501-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4796-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4840-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4868-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4872-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4940-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5092-466-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5112-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5128-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5332-538-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5344-539-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5456-541-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5472-543-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5488-546-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5508-547-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5640-570-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5656-577-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13544-2605-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads