1316dd799b75341cbd86aadd469cc9093c4df4be6474d85d3ec9d919b2ef6175

Analysis

max time kernel
120s
max time network
98s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 07:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1316dd799b75341cbd86aadd469cc9093c4df4be6474d85d3ec9d919b2ef6175N.exe
Size

468KB
MD5

7ea129b004592c23a1068294aee9a430
SHA1

7538ad9e350d2eda7531918a4246ace882d21ef4
SHA256

1316dd799b75341cbd86aadd469cc9093c4df4be6474d85d3ec9d919b2ef6175
SHA512

82956289f5634f8789ec3c5bf956b858bf6a00c0a0e66e5ad901145d15eaf1e12a346b820851e2012f9f134aa8a638c4cc3d9b5cf9dac55870f56172d0537e35
SSDEEP

3072:WudSogdEIc5+HbYbzfjcffowAmCBHpnLnEHCgdSG1cDdhQLD+Nfr:WuUoE0+HwzrcffWBLK1cZOLD+

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4924	Unicorn-64822.exe
1184	Unicorn-59918.exe
4328	Unicorn-64557.exe
1428	Unicorn-60790.exe
4060	Unicorn-11589.exe
4336	Unicorn-22179.exe
4084	Unicorn-8444.exe
556	Unicorn-30910.exe
4360	Unicorn-43716.exe
400	Unicorn-31102.exe
316	Unicorn-47438.exe
2348	Unicorn-47438.exe
512	Unicorn-6140.exe
4008	Unicorn-275.exe
2448	Unicorn-52077.exe
1044	Unicorn-16214.exe
3252	Unicorn-20852.exe
4456	Unicorn-16598.exe
3416	Unicorn-24766.exe
4300	Unicorn-32934.exe
4468	Unicorn-41102.exe
1652	Unicorn-57438.exe
3668	Unicorn-26995.exe
4704	Unicorn-32861.exe
432	Unicorn-33126.exe
816	Unicorn-13260.exe
4488	Unicorn-13260.exe
3104	Unicorn-37764.exe
1928	Unicorn-59668.exe
3144	Unicorn-56868.exe
4484	Unicorn-365.exe
5036	Unicorn-29892.exe
880	Unicorn-49758.exe
3820	Unicorn-11147.exe
4316	Unicorn-13748.exe
1556	Unicorn-34190.exe
4252	Unicorn-11915.exe
4916	Unicorn-34382.exe
4944	Unicorn-58886.exe
1960	Unicorn-42550.exe
4736	Unicorn-19774.exe
784	Unicorn-29979.exe
3940	Unicorn-27179.exe
1680	Unicorn-52446.exe
3960	Unicorn-60614.exe
3432	Unicorn-28134.exe
732	Unicorn-32772.exe
3008	Unicorn-40940.exe
2640	Unicorn-60806.exe
1020	Unicorn-292.exe
2268	Unicorn-44662.exe
660	Unicorn-46700.exe
752	Unicorn-32964.exe
1732	Unicorn-35532.exe
3140	Unicorn-11989.exe
4640	Unicorn-20084.exe
1476	Unicorn-20084.exe
3780	Unicorn-8445.exe
4760	Unicorn-13084.exe
4344	Unicorn-469.exe
844	Unicorn-41310.exe
4392	Unicorn-29612.exe
3972	Unicorn-8829.exe
1412	Unicorn-25166.exe

Program crash 7 IoCs

pid	pid_target	Process	procid_target
7588	5676	WerFault.exe	201
8640	6540	WerFault.exe	251
9356	6540	WerFault.exe	251
11172	6512	WerFault.exe	249
11840	6512	WerFault.exe	249
13272	2984	WerFault.exe	171
14200	2984	WerFault.exe	171

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39892.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33059.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31051.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52077.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12083.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57182.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46477.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48165.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56358.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11011.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56461.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21485.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37598.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55556.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58853.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64157.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56333.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60790.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9436.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11877.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46022.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21915.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24070.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6964.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39252.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32934.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50092.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32004.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46924.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17008	dwm.exe
Token: SeChangeNotifyPrivilege	17008	dwm.exe
Token: 33	17008	dwm.exe
Token: SeIncBasePriorityPrivilege	17008	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4280	1316dd799b75341cbd86aadd469cc9093c4df4be6474d85d3ec9d919b2ef6175N.exe
4924	Unicorn-64822.exe
1184	Unicorn-59918.exe
4328	Unicorn-64557.exe
1428	Unicorn-60790.exe
4060	Unicorn-11589.exe
4336	Unicorn-22179.exe
4084	Unicorn-8444.exe
556	Unicorn-30910.exe
4360	Unicorn-43716.exe
400	Unicorn-31102.exe
316	Unicorn-47438.exe
512	Unicorn-6140.exe
4008	Unicorn-275.exe
2348	Unicorn-47438.exe
2448	Unicorn-52077.exe
1044	Unicorn-16214.exe
3252	Unicorn-20852.exe
1652	Unicorn-57438.exe
3416	Unicorn-24766.exe
4456	Unicorn-16598.exe
4300	Unicorn-32934.exe
4468	Unicorn-41102.exe
816	Unicorn-13260.exe
4488	Unicorn-13260.exe
4704	Unicorn-32861.exe
3104	Unicorn-37764.exe
432	Unicorn-33126.exe
3144	Unicorn-56868.exe
1928	Unicorn-59668.exe
3668	Unicorn-26995.exe
4484	Unicorn-365.exe
5036	Unicorn-29892.exe
880	Unicorn-49758.exe
3820	Unicorn-11147.exe
4316	Unicorn-13748.exe
1556	Unicorn-34190.exe
4916	Unicorn-34382.exe
4252	Unicorn-11915.exe
4944	Unicorn-58886.exe
784	Unicorn-29979.exe
3940	Unicorn-27179.exe
3432	Unicorn-28134.exe
4736	Unicorn-19774.exe
1960	Unicorn-42550.exe
3960	Unicorn-60614.exe
1680	Unicorn-52446.exe
732	Unicorn-32772.exe
2640	Unicorn-60806.exe
1020	Unicorn-292.exe
3008	Unicorn-40940.exe
1732	Unicorn-35532.exe
3140	Unicorn-11989.exe
4640	Unicorn-20084.exe
2268	Unicorn-44662.exe
660	Unicorn-46700.exe
1476	Unicorn-20084.exe
752	Unicorn-32964.exe
3780	Unicorn-8445.exe
4344	Unicorn-469.exe
4392	Unicorn-29612.exe
3972	Unicorn-8829.exe
1412	Unicorn-25166.exe
2140	Unicorn-57573.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 4924	4280	1316dd799b75341cbd86aadd469cc9093c4df4be6474d85d3ec9d919b2ef6175N.exe	86
PID 4280 wrote to memory of 4924	4280	1316dd799b75341cbd86aadd469cc9093c4df4be6474d85d3ec9d919b2ef6175N.exe	86
PID 4280 wrote to memory of 4924	4280	1316dd799b75341cbd86aadd469cc9093c4df4be6474d85d3ec9d919b2ef6175N.exe	86
PID 4924 wrote to memory of 1184	4924	Unicorn-64822.exe	88
PID 4924 wrote to memory of 1184	4924	Unicorn-64822.exe	88
PID 4924 wrote to memory of 1184	4924	Unicorn-64822.exe	88
PID 4280 wrote to memory of 4328	4280	1316dd799b75341cbd86aadd469cc9093c4df4be6474d85d3ec9d919b2ef6175N.exe	89
PID 4280 wrote to memory of 4328	4280	1316dd799b75341cbd86aadd469cc9093c4df4be6474d85d3ec9d919b2ef6175N.exe	89
PID 4280 wrote to memory of 4328	4280	1316dd799b75341cbd86aadd469cc9093c4df4be6474d85d3ec9d919b2ef6175N.exe	89
PID 1184 wrote to memory of 1428	1184	Unicorn-59918.exe	92
PID 1184 wrote to memory of 1428	1184	Unicorn-59918.exe	92
PID 1184 wrote to memory of 1428	1184	Unicorn-59918.exe	92
PID 4328 wrote to memory of 4060	4328	Unicorn-64557.exe	93
PID 4328 wrote to memory of 4060	4328	Unicorn-64557.exe	93
PID 4328 wrote to memory of 4060	4328	Unicorn-64557.exe	93
PID 4280 wrote to memory of 4336	4280	1316dd799b75341cbd86aadd469cc9093c4df4be6474d85d3ec9d919b2ef6175N.exe	94
PID 4280 wrote to memory of 4336	4280	1316dd799b75341cbd86aadd469cc9093c4df4be6474d85d3ec9d919b2ef6175N.exe	94
PID 4280 wrote to memory of 4336	4280	1316dd799b75341cbd86aadd469cc9093c4df4be6474d85d3ec9d919b2ef6175N.exe	94
PID 4924 wrote to memory of 4084	4924	Unicorn-64822.exe	95
PID 4924 wrote to memory of 4084	4924	Unicorn-64822.exe	95
PID 4924 wrote to memory of 4084	4924	Unicorn-64822.exe	95
PID 1428 wrote to memory of 556	1428	Unicorn-60790.exe	96
PID 1428 wrote to memory of 556	1428	Unicorn-60790.exe	96
PID 1428 wrote to memory of 556	1428	Unicorn-60790.exe	96
PID 1184 wrote to memory of 4360	1184	Unicorn-59918.exe	97
PID 1184 wrote to memory of 4360	1184	Unicorn-59918.exe	97
PID 1184 wrote to memory of 4360	1184	Unicorn-59918.exe	97
PID 4336 wrote to memory of 400	4336	Unicorn-22179.exe	98
PID 4336 wrote to memory of 400	4336	Unicorn-22179.exe	98
PID 4336 wrote to memory of 400	4336	Unicorn-22179.exe	98
PID 4084 wrote to memory of 316	4084	Unicorn-8444.exe	100
PID 4084 wrote to memory of 316	4084	Unicorn-8444.exe	100
PID 4084 wrote to memory of 316	4084	Unicorn-8444.exe	100
PID 4060 wrote to memory of 2348	4060	Unicorn-11589.exe	99
PID 4060 wrote to memory of 2348	4060	Unicorn-11589.exe	99
PID 4060 wrote to memory of 2348	4060	Unicorn-11589.exe	99
PID 4280 wrote to memory of 512	4280	1316dd799b75341cbd86aadd469cc9093c4df4be6474d85d3ec9d919b2ef6175N.exe	101
PID 4280 wrote to memory of 512	4280	1316dd799b75341cbd86aadd469cc9093c4df4be6474d85d3ec9d919b2ef6175N.exe	101
PID 4280 wrote to memory of 512	4280	1316dd799b75341cbd86aadd469cc9093c4df4be6474d85d3ec9d919b2ef6175N.exe	101
PID 4924 wrote to memory of 4008	4924	Unicorn-64822.exe	102
PID 4924 wrote to memory of 4008	4924	Unicorn-64822.exe	102
PID 4924 wrote to memory of 4008	4924	Unicorn-64822.exe	102
PID 4328 wrote to memory of 2448	4328	Unicorn-64557.exe	103
PID 4328 wrote to memory of 2448	4328	Unicorn-64557.exe	103
PID 4328 wrote to memory of 2448	4328	Unicorn-64557.exe	103
PID 556 wrote to memory of 1044	556	Unicorn-30910.exe	104
PID 556 wrote to memory of 1044	556	Unicorn-30910.exe	104
PID 556 wrote to memory of 1044	556	Unicorn-30910.exe	104
PID 1428 wrote to memory of 3252	1428	Unicorn-60790.exe	105
PID 1428 wrote to memory of 3252	1428	Unicorn-60790.exe	105
PID 1428 wrote to memory of 3252	1428	Unicorn-60790.exe	105
PID 4360 wrote to memory of 4456	4360	Unicorn-43716.exe	106
PID 4360 wrote to memory of 4456	4360	Unicorn-43716.exe	106
PID 4360 wrote to memory of 4456	4360	Unicorn-43716.exe	106
PID 2348 wrote to memory of 3416	2348	Unicorn-47438.exe	107
PID 2348 wrote to memory of 3416	2348	Unicorn-47438.exe	107
PID 2348 wrote to memory of 3416	2348	Unicorn-47438.exe	107
PID 400 wrote to memory of 4300	400	Unicorn-31102.exe	108
PID 400 wrote to memory of 4300	400	Unicorn-31102.exe	108
PID 400 wrote to memory of 4300	400	Unicorn-31102.exe	108
PID 4008 wrote to memory of 4468	4008	Unicorn-275.exe	109
PID 4008 wrote to memory of 4468	4008	Unicorn-275.exe	109
PID 4008 wrote to memory of 4468	4008	Unicorn-275.exe	109
PID 316 wrote to memory of 1652	316	Unicorn-47438.exe	110

C:\Users\Admin\AppData\Local\Temp\1316dd799b75341cbd86aadd469cc9093c4df4be6474d85d3ec9d919b2ef6175N.exe
"C:\Users\Admin\AppData\Local\Temp\1316dd799b75341cbd86aadd469cc9093c4df4be6474d85d3ec9d919b2ef6175N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64822.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64822.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59918.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59918.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60790.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30910.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16214.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-365.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8445.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29302.exe
        9⤵
        
        PID:5676
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5676 -s 636
        10⤵
        Program crash
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39428.exe
        9⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51836.exe
        9⤵
        
        PID:9576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62725.exe
        9⤵
        
        PID:14320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63724.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-308.exe
        8⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43934.exe
        9⤵
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39268.exe
        9⤵
        
        PID:2736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53605.exe
        9⤵
        
        PID:16556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23091.exe
        8⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27157.exe
        8⤵
        
        PID:12012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27731.exe
        8⤵
        
        PID:15916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13084.exe
        7⤵
        Executes dropped EXE
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13157.exe
        8⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7405.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64918.exe
        10⤵
        
        PID:15352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5044.exe
        9⤵
        
        PID:10052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40140.exe
        9⤵
        
        PID:13580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39525.exe
        9⤵
        
        PID:12408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64701.exe
        8⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        8⤵
        
        PID:9556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
        8⤵
        
        PID:15676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-395.exe
        7⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14733.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61573.exe
        8⤵
        
        PID:14080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43364.exe
        8⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11188.exe
        7⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22419.exe
        7⤵
        
        PID:9608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe
        7⤵
        
        PID:13300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22573.exe
        7⤵
        
        PID:9824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29892.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41310.exe
        7⤵
        Executes dropped EXE
        
        PID:844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4989.exe
        8⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24998.exe
        9⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20598.exe
        10⤵
        
        PID:11904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55053.exe
        10⤵
        
        PID:16360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12357.exe
        10⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32340.exe
        9⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50812.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44543.exe
        9⤵
        
        PID:3968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17524.exe
        8⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29459.exe
        8⤵
        
        PID:12004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28229.exe
        8⤵
        
        PID:15880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51621.exe
        7⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20286.exe
        8⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36580.exe
        9⤵
        
        PID:13396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14636.exe
        9⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        8⤵
        
        PID:11392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28995.exe
        8⤵
        
        PID:15288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18222.exe
        8⤵
        
        PID:8992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62308.exe
        7⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26197.exe
        7⤵
        
        PID:12240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42916.exe
        7⤵
        
        PID:16136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48148.exe
        7⤵
        
        PID:2096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43540.exe
        6⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4989.exe
        7⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7213.exe
        8⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63526.exe
        9⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1587.exe
        8⤵
        
        PID:11204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58205.exe
        8⤵
        
        PID:14780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51166.exe
        8⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32988.exe
        7⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        7⤵
        
        PID:9328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38933.exe
        6⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37598.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        7⤵
        
        PID:13408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33275.exe
        7⤵
        
        PID:9464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2523.exe
        6⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        6⤵
        
        PID:9496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43446.exe
        6⤵
        
        PID:16120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20852.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49758.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-469.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2493.exe
        8⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8741.exe
        9⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39518.exe
        10⤵
        
        PID:9624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        10⤵
        
        PID:13012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52940.exe
        10⤵
        
        PID:2212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26859.exe
        9⤵
        
        PID:10884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31973.exe
        9⤵
        
        PID:14232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13947.exe
        9⤵
        
        PID:17064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53845.exe
        8⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24070.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:14096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37604.exe
        9⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60196.exe
        8⤵
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62725.exe
        8⤵
        
        PID:14312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exe
        8⤵
        
        PID:2120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32788.exe
        7⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47670.exe
        8⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38486.exe
        9⤵
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44621.exe
        9⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34643.exe
        8⤵
        
        PID:10200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64077.exe
        8⤵
        
        PID:14844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61052.exe
        8⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29235.exe
        7⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29534.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55821.exe
        8⤵
        
        PID:17184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8028.exe
        7⤵
        
        PID:9724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24843.exe
        7⤵
        
        PID:14812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29612.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2493.exe
        7⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40270.exe
        8⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50110.exe
        9⤵
        
        PID:14904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46157.exe
        9⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21380.exe
        8⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8619.exe
        8⤵
        
        PID:14208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31357.exe
        8⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16844.exe
        7⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        7⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31213.exe
        7⤵
        
        PID:14948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64684.exe
        7⤵
        
        PID:1668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14043.exe
        6⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9740.exe
        7⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28307.exe
        7⤵
        
        PID:12184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10548.exe
        7⤵
        
        PID:15960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5971.exe
        7⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28957.exe
        6⤵
        
        PID:7636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18491.exe
        6⤵
        
        PID:11968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10812.exe
        6⤵
        
        PID:15604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11147.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8829.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2493.exe
        7⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7213.exe
        8⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35118.exe
        9⤵
        
        PID:11620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
        9⤵
        
        PID:16624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57972.exe
        9⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18115.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58205.exe
        8⤵
        
        PID:14892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53366.exe
        8⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32988.exe
        7⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        7⤵
        
        PID:10140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11011.exe
        7⤵
        
        PID:15548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42300.exe
        6⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15766.exe
        7⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35398.exe
        8⤵
        
        PID:11864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16412.exe
        8⤵
        
        PID:15652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8771.exe
        8⤵
        
        PID:8480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50788.exe
        7⤵
        
        PID:11252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58205.exe
        7⤵
        
        PID:14772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40948.exe
        7⤵
        
        PID:7420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46916.exe
        6⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36580.exe
        7⤵
        
        PID:12336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5892.exe
        7⤵
        
        PID:6420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8028.exe
        6⤵
        
        PID:9372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60013.exe
        6⤵
        
        PID:15556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57573.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4989.exe
        6⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2149.exe
        7⤵
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65037.exe
        7⤵
        
        PID:16716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8771.exe
        7⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17524.exe
        6⤵
        
        PID:7616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29459.exe
        6⤵
        
        PID:11976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28229.exe
        6⤵
        
        PID:15872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59526.exe
        6⤵
        
        PID:8780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63132.exe
        5⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45942.exe
        6⤵
        
        PID:8324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6596.exe
        6⤵
        
        PID:12248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19780.exe
        6⤵
        
        PID:15732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51525.exe
        5⤵
        
        PID:8604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10085.exe
        5⤵
        
        PID:11340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21915.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43716.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16598.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52446.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29198.exe
        7⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8061.exe
        8⤵
        
        PID:6540
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6540 -s 644
        9⤵
        Program crash
        
        PID:8640
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6540 -s 644
        9⤵
        Program crash
        
        PID:9356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57125.exe
        8⤵
        
        PID:8572
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 600
        8⤵
        Program crash
        
        PID:13272
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2984 -s 648
        8⤵
        Program crash
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35388.exe
        7⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45942.exe
        8⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39268.exe
        8⤵
        
        PID:12536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12764.exe
        8⤵
        
        PID:16724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34253.exe
        8⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32131.exe
        7⤵
        
        PID:8580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11308.exe
        7⤵
        
        PID:13088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18899.exe
        7⤵
        
        PID:17376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50661.exe
        6⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12117.exe
        7⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        7⤵
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12083.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22805.exe
        7⤵
        
        PID:17024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31259.exe
        6⤵
        
        PID:7792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27157.exe
        6⤵
        
        PID:11984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19563.exe
        6⤵
        
        PID:15900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30084.exe
        6⤵
        
        PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-292.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29198.exe
        6⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65430.exe
        7⤵
        
        PID:6512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6512 -s 636
        8⤵
        Program crash
        
        PID:11172
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6512 -s 636
        8⤵
        Program crash
        
        PID:11840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31852.exe
        7⤵
        
        PID:8956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13507.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49957.exe
        7⤵
        
        PID:16180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3572.exe
        6⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30878.exe
        7⤵
        
        PID:10552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61573.exe
        7⤵
        
        PID:14144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16363.exe
        7⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57596.exe
        6⤵
        
        PID:9068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2948.exe
        6⤵
        
        PID:12968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18899.exe
        6⤵
        
        PID:17360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37022.exe
        6⤵
        
        PID:14576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61516.exe
        5⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57182.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59710.exe
        7⤵
        
        PID:11800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-76.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-76.exe
        7⤵
        
        PID:15536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56166.exe
        7⤵
        
        PID:7688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39252.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-451.exe
        6⤵
        
        PID:14184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15020.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17524.exe
        5⤵
        
        PID:372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1859.exe
        5⤵
        
        PID:9324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64341.exe
        5⤵
        
        PID:15136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26995.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11989.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3069.exe
        6⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4731.exe
        7⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8701.exe
        8⤵
        
        PID:14852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61917.exe
        8⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11868.exe
        7⤵
        
        PID:11248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-155.exe
        7⤵
        
        PID:14944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42820.exe
        7⤵
        
        PID:16992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36408.exe
        7⤵
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27420.exe
        6⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40317.exe
        6⤵
        
        PID:9400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55412.exe
        6⤵
        
        PID:14876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48165.exe
        5⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22132.exe
        6⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39518.exe
        7⤵
        
        PID:9632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        7⤵
        
        PID:2888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55477.exe
        7⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27523.exe
        6⤵
        
        PID:9544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29861.exe
        6⤵
        
        PID:13516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63724.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51052.exe
        5⤵
        
        PID:7252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61438.exe
        6⤵
        
        PID:11716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32364.exe
        6⤵
        
        PID:16280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21485.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46852.exe
        5⤵
        
        PID:14160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63909.exe
        5⤵
        
        PID:3096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20084.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe
        5⤵
        
        PID:2868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
        6⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31542.exe
        7⤵
        
        PID:9764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        7⤵
        
        PID:1900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14252.exe
        7⤵
        
        PID:6436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11484.exe
        6⤵
        
        PID:9648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        6⤵
        
        PID:2904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48077.exe
        6⤵
        
        PID:4976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19251.exe
        5⤵
        
        PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2356.exe
        5⤵
        
        PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49164.exe
        5⤵
        
        PID:15060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59100.exe
      4⤵
      PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47670.exe
        5⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41750.exe
        6⤵
        
        PID:14720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64159.exe
        6⤵
        
        PID:7516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12252.exe
        5⤵
        
        PID:10224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55708.exe
        5⤵
        
        PID:13996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6852.exe
        5⤵
        
        PID:4816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27388.exe
      4⤵
      PID:7912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39518.exe
        5⤵
        
        PID:9640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        5⤵
        
        PID:11720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63261.exe
        5⤵
        
        PID:5640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6333.exe
      4⤵
      PID:10676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51507.exe
      4⤵
      PID:14112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27222.exe
      4⤵
      PID:7756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8444.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8444.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57438.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60614.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12861.exe
        7⤵
        
        PID:4000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38430.exe
        8⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5.exe
        9⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45102.exe
        10⤵
        
        PID:9700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46885.exe
        10⤵
        
        PID:15700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39540.exe
        10⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46461.exe
        9⤵
        
        PID:2300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56860.exe
        9⤵
        
        PID:13636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39717.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe
        8⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45500.exe
        8⤵
        
        PID:10492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56677.exe
        8⤵
        
        PID:15216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53733.exe
        7⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5501.exe
        8⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        8⤵
        
        PID:12296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1179.exe
        8⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45588.exe
        7⤵
        
        PID:8964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19372.exe
        7⤵
        
        PID:12440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41292.exe
        7⤵
        
        PID:15992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20204.exe
        7⤵
        
        PID:9112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56333.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12117.exe
        7⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31955.exe
        7⤵
        
        PID:12584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59469.exe
        7⤵
        
        PID:16836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4165.exe
        7⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29723.exe
        6⤵
        
        PID:8120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33789.exe
        6⤵
        
        PID:11464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26195.exe
        6⤵
        
        PID:15028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10318.exe
        6⤵
        
        PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32964.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19406.exe
        6⤵
        
        PID:1260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
        7⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
        8⤵
        
        PID:10728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        8⤵
        
        PID:14056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21485.exe
        8⤵
        
        PID:15816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16579.exe
        7⤵
        
        PID:10496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31781.exe
        7⤵
        
        PID:11740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23651.exe
        7⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13196.exe
        6⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17822.exe
        7⤵
        
        PID:14596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42132.exe
        6⤵
        
        PID:10192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45237.exe
        6⤵
        
        PID:13968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exe
        6⤵
        
        PID:1096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14043.exe
        5⤵
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45942.exe
        6⤵
        
        PID:8436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14571.exe
        6⤵
        
        PID:12320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53605.exe
        6⤵
        
        PID:16576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3875.exe
        6⤵
        
        PID:9100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20779.exe
        5⤵
        
        PID:8840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43284.exe
        5⤵
        
        PID:12960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19429.exe
        5⤵
        
        PID:17384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13260.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18534.exe
        6⤵
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53998.exe
        7⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35086.exe
        8⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11877.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46477.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12083.exe
        8⤵
        
        PID:15076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9356.exe
        7⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29459.exe
        7⤵
        
        PID:12024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28229.exe
        7⤵
        
        PID:15892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8275.exe
        7⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52197.exe
        6⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47686.exe
        7⤵
        
        PID:9728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        7⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50572.exe
        7⤵
        
        PID:2564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62692.exe
        6⤵
        
        PID:8536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18220.exe
        6⤵
        
        PID:12400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16787.exe
        6⤵
        
        PID:15816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39508.exe
        5⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53998.exe
        6⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15101.exe
        7⤵
        
        PID:8500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35044.exe
        7⤵
        
        PID:11476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22763.exe
        7⤵
        
        PID:17040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42919.exe
        7⤵
        
        PID:7780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15411.exe
        6⤵
        
        PID:8820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2948.exe
        6⤵
        
        PID:13192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18899.exe
        6⤵
        
        PID:17348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
        5⤵
        
        PID:5612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45942.exe
        6⤵
        
        PID:8428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41380.exe
        6⤵
        
        PID:11532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        6⤵
        
        PID:16156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45405.exe
        6⤵
        
        PID:8696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11188.exe
        5⤵
        
        PID:8580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54805.exe
        5⤵
        
        PID:10912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58622.exe
        5⤵
        
        PID:14456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11915.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45342.exe
        5⤵
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63702.exe
        6⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61718.exe
        7⤵
        
        PID:9428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        7⤵
        
        PID:13200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50572.exe
        7⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7540.exe
        6⤵
        
        PID:8396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18708.exe
        6⤵
        
        PID:11644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4099.exe
        6⤵
        
        PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26156.exe
        5⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24998.exe
        6⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23788.exe
        6⤵
        
        PID:10652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51964.exe
        6⤵
        
        PID:15000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42919.exe
        6⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31643.exe
        5⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34173.exe
        5⤵
        
        PID:12168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1883.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19612.exe
      4⤵
      PID:2064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35196.exe
        5⤵
        
        PID:1812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45942.exe
        6⤵
        
        PID:8280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6596.exe
        6⤵
        
        PID:12224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45716.exe
        6⤵
        
        PID:16184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48461.exe
        6⤵
        
        PID:7672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32131.exe
        5⤵
        
        PID:8228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60974.exe
        6⤵
        
        PID:15860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15918.exe
        6⤵
        
        PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11308.exe
        5⤵
        
        PID:13096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18899.exe
        5⤵
        
        PID:15868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4803.exe
      4⤵
      PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63534.exe
        5⤵
        
        PID:8340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48117.exe
        5⤵
        
        PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40724.exe
        5⤵
        
        PID:15364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25868.exe
      4⤵
      PID:8844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53422.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61324.exe
      4⤵
      PID:15828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-275.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-275.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41102.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24900.exe
        5⤵
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63318.exe
        6⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12117.exe
        7⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30524.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12083.exe
        7⤵
        
        PID:14820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64909.exe
        6⤵
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21110.exe
        7⤵
        
        PID:15464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13484.exe
        7⤵
        
        PID:5660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20331.exe
        6⤵
        
        PID:12232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51965.exe
        6⤵
        
        PID:16308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3875.exe
        6⤵
        
        PID:9004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33067.exe
        5⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51454.exe
        6⤵
        
        PID:13284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49381.exe
        6⤵
        
        PID:15796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11188.exe
        5⤵
        
        PID:8596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5604.exe
        5⤵
        
        PID:10864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23837.exe
        5⤵
        
        PID:13912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50507.exe
        5⤵
        
        PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39020.exe
      4⤵
      PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46022.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45942.exe
        6⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15525.exe
        7⤵
        
        PID:15344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39268.exe
        6⤵
        
        PID:11736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47805.exe
        5⤵
        
        PID:8760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30611.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16900.exe
        5⤵
        
        PID:1988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62669.exe
      4⤵
      PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45942.exe
        5⤵
        
        PID:8376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64157.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5067.exe
        5⤵
        
        PID:16148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42404.exe
      4⤵
      PID:8856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36356.exe
      4⤵
      PID:12128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58350.exe
      4⤵
      PID:15696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2651.exe
      4⤵
      PID:16568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32861.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32861.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42550.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe
        5⤵
        
        PID:840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40454.exe
        6⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45942.exe
        7⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55605.exe
        7⤵
        
        PID:12120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4683.exe
        7⤵
        
        PID:15948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18396.exe
        6⤵
        
        PID:8664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5443.exe
        6⤵
        
        PID:13104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27565.exe
        6⤵
        
        PID:17392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37508.exe
        5⤵
        
        PID:7364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18971.exe
        5⤵
        
        PID:9412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47349.exe
        5⤵
        
        PID:14128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63724.exe
        5⤵
        
        PID:16632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48165.exe
      4⤵
      PID:5488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57366.exe
        5⤵
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35988.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        5⤵
        
        PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38333.exe
        5⤵
        
        PID:16620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50092.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40405.exe
      4⤵
      PID:9952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37339.exe
      4⤵
      PID:13572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55741.exe
      4⤵
      PID:14176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27179.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27179.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22374.exe
      4⤵
      PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23822.exe
        5⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45942.exe
        6⤵
        
        PID:8344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6596.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46100.exe
        6⤵
        
        PID:16328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35519.exe
        6⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7156.exe
        5⤵
        
        PID:8900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30995.exe
        5⤵
        
        PID:12340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25453.exe
        5⤵
        
        PID:15616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37204.exe
      4⤵
      PID:6620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17806.exe
        5⤵
        
        PID:10692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62349.exe
        5⤵
        
        PID:14668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11075.exe
        5⤵
        
        PID:7428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23003.exe
      4⤵
      PID:9020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11396.exe
      4⤵
      PID:12528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15635.exe
      4⤵
      PID:16588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45060.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45060.exe
    3⤵
    PID:5748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25270.exe
      4⤵
      PID:7120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43742.exe
        5⤵
        
        PID:8456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14571.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53605.exe
        5⤵
        
        PID:16128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12340.exe
      4⤵
      PID:8496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6403.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53605.exe
      4⤵
      PID:15984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10053.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10053.exe
    3⤵
    PID:7448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
      4⤵
      PID:10480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12180.exe
      4⤵
      PID:13272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51724.exe
      4⤵
      PID:5824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44755.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44755.exe
    3⤵
    PID:9712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27724.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27724.exe
    3⤵
    PID:13508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50140.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50140.exe
    3⤵
    PID:5380
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64557.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64557.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11589.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58886.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19494.exe
        7⤵
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39198.exe
        8⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31630.exe
        9⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35044.exe
        9⤵
        
        PID:11332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55628.exe
        9⤵
        
        PID:17028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22228.exe
        9⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48957.exe
        8⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12355.exe
        8⤵
        
        PID:11448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52148.exe
        8⤵
        
        PID:15908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
        7⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28454.exe
        8⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12083.exe
        8⤵
        
        PID:14792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35519.exe
        8⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61540.exe
        7⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36477.exe
        7⤵
        
        PID:11780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32739.exe
        7⤵
        
        PID:15064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49213.exe
        6⤵
        
        PID:4396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29878.exe
        7⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45942.exe
        8⤵
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50125.exe
        8⤵
        
        PID:12196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3251.exe
        8⤵
        
        PID:16088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16748.exe
        8⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47805.exe
        7⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30611.exe
        7⤵
        
        PID:11796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41405.exe
        7⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14139.exe
        7⤵
        
        PID:6308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48444.exe
        6⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11437.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45398.exe
        8⤵
        
        PID:11632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34004.exe
        8⤵
        
        PID:15596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45797.exe
        7⤵
        
        PID:10072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27643.exe
        7⤵
        
        PID:14804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44525.exe
        6⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23310.exe
        7⤵
        
        PID:14984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-427.exe
        6⤵
        
        PID:10220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58285.exe
        6⤵
        
        PID:14932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32772.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe
        6⤵
        
        PID:2060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6053.exe
        7⤵
        
        PID:6148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42590.exe
        8⤵
        
        PID:9308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51485.exe
        8⤵
        
        PID:13492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34043.exe
        8⤵
        
        PID:444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44349.exe
        7⤵
        
        PID:9580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        7⤵
        
        PID:12284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7044.exe
        7⤵
        
        PID:17080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3108.exe
        6⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64726.exe
        7⤵
        
        PID:15336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37604.exe
        7⤵
        
        PID:7380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40317.exe
        6⤵
        
        PID:9292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55412.exe
        6⤵
        
        PID:14868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32004.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38164.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48438.exe
        6⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
        7⤵
        
        PID:10572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61573.exe
        7⤵
        
        PID:14304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12357.exe
        7⤵
        
        PID:8104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21380.exe
        6⤵
        
        PID:10076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40140.exe
        6⤵
        
        PID:13588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56053.exe
        6⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52781.exe
        5⤵
        
        PID:8008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39982.exe
        6⤵
        
        PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64900.exe
        5⤵
        
        PID:10132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63381.exe
        5⤵
        
        PID:14916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4405.exe
        5⤵
        
        PID:9044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13260.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34382.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44958.exe
        6⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63318.exe
        7⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15205.exe
        8⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        8⤵
        
        PID:13416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58356.exe
        8⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48573.exe
        7⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20331.exe
        7⤵
        
        PID:12272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51581.exe
        7⤵
        
        PID:16212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26156.exe
        6⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15205.exe
        7⤵
        
        PID:9744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        7⤵
        
        PID:11684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-603.exe
        7⤵
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61540.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36477.exe
        6⤵
        
        PID:11772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8235.exe
        6⤵
        
        PID:13800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45316.exe
        6⤵
        
        PID:16604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57573.exe
        5⤵
        
        PID:3864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29686.exe
        6⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21164.exe
        6⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35526.exe
        7⤵
        
        PID:16900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49724.exe
        6⤵
        
        PID:9680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23125.exe
        6⤵
        
        PID:11672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47388.exe
        6⤵
        
        PID:2076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe
        5⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-109.exe
        6⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53654.exe
        7⤵
        
        PID:12304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5852.exe
        7⤵
        
        PID:15532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11075.exe
        7⤵
        
        PID:7432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56461.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18139.exe
        6⤵
        
        PID:15116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63837.exe
        6⤵
        
        PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4452.exe
        5⤵
        
        PID:7240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26659.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10812.exe
        5⤵
        
        PID:15620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54088.exe
        5⤵
        
        PID:6868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29979.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35742.exe
        5⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63422.exe
        6⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39046.exe
        7⤵
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61573.exe
        7⤵
        
        PID:14116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41060.exe
        7⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35988.exe
        6⤵
        
        PID:9688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        6⤵
        
        PID:12176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39525.exe
        6⤵
        
        PID:17280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3108.exe
        5⤵
        
        PID:7024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3877.exe
        6⤵
        
        PID:11664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56869.exe
        6⤵
        
        PID:16168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56358.exe
        6⤵
        
        PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40317.exe
        5⤵
        
        PID:9944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16291.exe
        5⤵
        
        PID:14744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4724.exe
      4⤵
      PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9893.exe
        5⤵
        
        PID:6980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39046.exe
        6⤵
        
        PID:10512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12180.exe
        6⤵
        
        PID:13432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26451.exe
        6⤵
        
        PID:8172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19076.exe
        5⤵
        
        PID:9876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50316.exe
        5⤵
        
        PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31051.exe
        5⤵
        
        PID:944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48252.exe
      4⤵
      PID:7260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50502.exe
        5⤵
        
        PID:15800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33652.exe
      4⤵
      PID:5888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47382.exe
      4⤵
      PID:14152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42723.exe
      4⤵
      PID:1740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52077.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52077.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13748.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25166.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37470.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12117.exe
        7⤵
        
        PID:8024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15644.exe
        8⤵
        
        PID:16080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        7⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12083.exe
        7⤵
        
        PID:15056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44543.exe
        7⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43372.exe
        6⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62324.exe
        6⤵
        
        PID:11888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36013.exe
        6⤵
        
        PID:15644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13947.exe
        6⤵
        
        PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33364.exe
        5⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33166.exe
        6⤵
        
        PID:7604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31955.exe
        6⤵
        
        PID:12592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59469.exe
        6⤵
        
        PID:16848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10517.exe
        6⤵
        
        PID:16924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15499.exe
        5⤵
        
        PID:8244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26197.exe
        5⤵
        
        PID:12264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60117.exe
        5⤵
        
        PID:15724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43540.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19022.exe
        5⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26230.exe
        6⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39046.exe
        7⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12180.exe
        7⤵
        
        PID:14168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51340.exe
        7⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27244.exe
        6⤵
        
        PID:9916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23419.exe
        6⤵
        
        PID:13700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64221.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53653.exe
        5⤵
        
        PID:7312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6565.exe
        6⤵
        
        PID:10900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47157.exe
        6⤵
        
        PID:14512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29653.exe
        6⤵
        
        PID:7268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52988.exe
        5⤵
        
        PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62725.exe
        5⤵
        
        PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exe
        5⤵
        
        PID:564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52389.exe
      4⤵
      PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18470.exe
        5⤵
        
        PID:8784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16876.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52452.exe
        5⤵
        
        PID:15640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20291.exe
      4⤵
      PID:6760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10124.exe
      4⤵
      PID:11940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27878.exe
      4⤵
      PID:15660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59668.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59668.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60806.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53349.exe
        5⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63918.exe
        6⤵
        
        PID:8564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35044.exe
        6⤵
        
        PID:11572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55628.exe
        6⤵
        
        PID:16988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20891.exe
        5⤵
        
        PID:8892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36861.exe
        5⤵
        
        PID:12348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16787.exe
        5⤵
        
        PID:15716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48165.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16910.exe
        5⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22902.exe
        6⤵
        
        PID:10856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12372.exe
        6⤵
        
        PID:14356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28885.exe
        6⤵
        
        PID:8836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe
        5⤵
        
        PID:9960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40140.exe
        5⤵
        
        PID:13564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31051.exe
        5⤵
        
        PID:15464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20683.exe
      4⤵
      PID:7508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41557.exe
      4⤵
      PID:10060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54252.exe
      4⤵
      PID:13640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22876.exe
      4⤵
      PID:1608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20084.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20084.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54086.exe
      4⤵
      PID:2916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56878.exe
        5⤵
        
        PID:6492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12117.exe
        6⤵
        
        PID:7904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        6⤵
        
        PID:11420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50341.exe
        6⤵
        
        PID:17132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48540.exe
        6⤵
        
        PID:2932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42604.exe
        5⤵
        
        PID:8264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20331.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51965.exe
        5⤵
        
        PID:16352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54596.exe
        5⤵
        
        PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51533.exe
      4⤵
      PID:5980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
        5⤵
        
        PID:12500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38908.exe
        5⤵
        
        PID:15736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33195.exe
      4⤵
      PID:9548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23125.exe
      4⤵
      PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64108.exe
      4⤵
      PID:2340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1539.exe
    3⤵
    PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26230.exe
      4⤵
      PID:7028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27244.exe
      4⤵
      PID:9908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23419.exe
      4⤵
      PID:13544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47004.exe
      4⤵
      PID:6724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31716.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31716.exe
    3⤵
    PID:7272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10421.exe
      4⤵
      PID:13308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
      4⤵
      PID:4472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34619.exe
      4⤵
      PID:3128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-365.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-365.exe
    3⤵
    PID:9404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33059.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:13828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52764.exe
    3⤵
    PID:6288
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22179.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22179.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31102.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31102.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32934.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19774.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19406.exe
        6⤵
        
        PID:2360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5861.exe
        7⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20686.exe
        8⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        8⤵
        
        PID:13296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8579.exe
        8⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27628.exe
        7⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        7⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5395.exe
        7⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27420.exe
        6⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9459.exe
        6⤵
        
        PID:10148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45237.exe
        6⤵
        
        PID:13984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63724.exe
        6⤵
        
        PID:3164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7515.exe
        5⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12117.exe
        6⤵
        
        PID:8036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        6⤵
        
        PID:11308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36588.exe
        6⤵
        
        PID:15132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11188.exe
        5⤵
        
        PID:8564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46924.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63461.exe
        5⤵
        
        PID:12800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48701.exe
        5⤵
        
        PID:6644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40940.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11429.exe
        5⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31910.exe
        6⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30878.exe
        7⤵
        
        PID:10524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12180.exe
        7⤵
        
        PID:14224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1587.exe
        6⤵
        
        PID:11212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25917.exe
        6⤵
        
        PID:14644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38836.exe
        6⤵
        
        PID:6924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
        5⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26596.exe
        6⤵
        
        PID:13836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-987.exe
        6⤵
        
        PID:17208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        5⤵
        
        PID:9776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33509.exe
        5⤵
        
        PID:14832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53540.exe
      4⤵
      PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23934.exe
        5⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36580.exe
        6⤵
        
        PID:12668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56437.exe
        6⤵
        
        PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53093.exe
        5⤵
        
        PID:10112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63492.exe
        5⤵
        
        PID:13856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15020.exe
        5⤵
        
        PID:17292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52589.exe
      4⤵
      PID:7892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64900.exe
      4⤵
      PID:7096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31092.exe
      4⤵
      PID:15296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37764.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33068.exe
      4⤵
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63318.exe
        5⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20286.exe
        6⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30878.exe
        7⤵
        
        PID:10536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12180.exe
        7⤵
        
        PID:13872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51340.exe
        7⤵
        
        PID:7480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48677.exe
        6⤵
        
        PID:10532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10163.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64909.exe
        5⤵
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17822.exe
        6⤵
        
        PID:14580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62877.exe
        6⤵
        
        PID:16656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20331.exe
        5⤵
        
        PID:12256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51581.exe
        5⤵
        
        PID:16220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46812.exe
        5⤵
        
        PID:6592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39892.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31438.exe
        5⤵
        
        PID:9028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35044.exe
        5⤵
        
        PID:11516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22763.exe
        5⤵
        
        PID:17072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34751.exe
        5⤵
        
        PID:6872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1868.exe
      4⤵
      PID:8720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27811.exe
      4⤵
      PID:11812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26764.exe
      4⤵
      PID:16336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24757.exe
      4⤵
      PID:7668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46700.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46700.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19406.exe
      4⤵
      PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6053.exe
        5⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12117.exe
        6⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31670.exe
        7⤵
        
        PID:15124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33972.exe
        7⤵
        
        PID:8816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        6⤵
        
        PID:11292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50341.exe
        6⤵
        
        PID:17120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3875.exe
        6⤵
        
        PID:8548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6964.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55692.exe
        5⤵
        
        PID:12692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9884.exe
        5⤵
        
        PID:17172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51742.exe
        5⤵
        
        PID:8984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11276.exe
      4⤵
      PID:7056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52142.exe
        5⤵
        
        PID:17336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1291.exe
      4⤵
      PID:10104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3820.exe
      4⤵
      PID:13876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55556.exe
      4⤵
      PID:4956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61901.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61901.exe
    3⤵
    PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50542.exe
      4⤵
      PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39046.exe
        5⤵
        
        PID:10636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61573.exe
        5⤵
        
        PID:14068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56358.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10908.exe
      4⤵
      PID:9856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50316.exe
      4⤵
      PID:6516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31051.exe
      4⤵
      PID:2856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7603.exe
    3⤵
    PID:7324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65173.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65173.exe
    3⤵
    PID:9440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39214.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39214.exe
    3⤵
    PID:14120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59251.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59251.exe
    3⤵
    PID:1244
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6140.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6140.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33126.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28134.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51886.exe
        5⤵
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29790.exe
        6⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51646.exe
        7⤵
        
        PID:12652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59085.exe
        7⤵
        
        PID:16616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43172.exe
        7⤵
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59237.exe
        6⤵
        
        PID:9084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62620.exe
        6⤵
        
        PID:12952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27565.exe
        6⤵
        
        PID:17400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6364.exe
        5⤵
        
        PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40980.exe
        5⤵
        
        PID:9900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29285.exe
        5⤵
        
        PID:13712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31051.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9436.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59286.exe
        5⤵
        
        PID:7040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15902.exe
        6⤵
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27900.exe
        6⤵
        
        PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41468.exe
        5⤵
        
        PID:10820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31973.exe
        5⤵
        
        PID:13632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48540.exe
        5⤵
        
        PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36828.exe
      4⤵
      PID:7468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23694.exe
        5⤵
        
        PID:15324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49533.exe
      4⤵
      PID:9532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4859.exe
      4⤵
      PID:13604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63717.exe
      4⤵
      PID:4680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39020.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39020.exe
    3⤵
    PID:4728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14117.exe
      4⤵
      PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12117.exe
        5⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51758.exe
        6⤵
        
        PID:17056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64159.exe
        6⤵
        
        PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50341.exe
        5⤵
        
        PID:17144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7540.exe
      4⤵
      PID:8404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22819.exe
      4⤵
      PID:13376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40902.exe
      4⤵
      PID:672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45757.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45757.exe
    3⤵
    PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe
      4⤵
      PID:13016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5275.exe
      4⤵
      PID:16868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7812.exe
      4⤵
      PID:16880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58740.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58740.exe
    3⤵
    PID:8752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11276.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11276.exe
    3⤵
    PID:10796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43830.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43830.exe
    3⤵
    PID:16344
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56868.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56868.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44662.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44662.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11237.exe
      4⤵
      PID:2192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24118.exe
        5⤵
        
        PID:6604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17822.exe
        6⤵
        
        PID:14588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50791.exe
        6⤵
        
        PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51365.exe
        5⤵
        
        PID:9780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17259.exe
        5⤵
        
        PID:11992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14252.exe
        5⤵
        
        PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13004.exe
      4⤵
      PID:7344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27614.exe
        5⤵
        
        PID:12480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4700.exe
        5⤵
        
        PID:16580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43364.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18971.exe
      4⤵
      PID:9436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62725.exe
      4⤵
      PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6355.exe
      4⤵
      PID:1248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-308.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-308.exe
    3⤵
    PID:6028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41142.exe
      4⤵
      PID:7372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56461.exe
      4⤵
      PID:9740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18139.exe
      4⤵
      PID:15104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7812.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31451.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31451.exe
    3⤵
    PID:8108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35325.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35325.exe
    3⤵
    PID:11928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27347.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27347.exe
    3⤵
    PID:15588
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35532.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35532.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19406.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19406.exe
    3⤵
    PID:5124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30366.exe
      4⤵
      PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45942.exe
        5⤵
        
        PID:8384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50494.exe
        6⤵
        
        PID:14036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24942.exe
        6⤵
        
        PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39268.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53605.exe
        5⤵
        
        PID:15708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53558.exe
        5⤵
        
        PID:17020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18396.exe
      4⤵
      PID:9172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5443.exe
      4⤵
      PID:13112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27565.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61726.exe
      4⤵
      PID:6244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51925.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51925.exe
    3⤵
    PID:4264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
      4⤵
      PID:12464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30356.exe
      4⤵
      PID:15856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49804.exe
      4⤵
      PID:6880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9459.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9459.exe
    3⤵
    PID:10156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45237.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45237.exe
    3⤵
    PID:13976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44516.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44516.exe
    3⤵
    PID:8812
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61358.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61358.exe
  2⤵
  PID:5184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26342.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26342.exe
    3⤵
    PID:7816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58006.exe
      4⤵
      PID:16752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
    3⤵
    PID:11276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12083.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12083.exe
    3⤵
    PID:14900
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15819.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15819.exe
  2⤵
  PID:7544
- C:\Users\Admin\AppData\Local\Temp\Unicorn-324.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-324.exe
  2⤵
  PID:11960
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5212.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5212.exe
  2⤵
  PID:15668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5676 -ip 5676
1⤵
PID:6116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6540 -ip 6540
1⤵
PID:1240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 6540 -ip 6540
1⤵
PID:7996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 6512 -ip 6512
1⤵
PID:10808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 6512 -ip 6512
1⤵
PID:11772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 2984 -ip 2984
1⤵
PID:12628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 2984 -ip 2984
1⤵
PID:13632

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11589.exe

Filesize
468KB

MD5
31f08751d57a23349633b27310d94c50

SHA1
3baa99f00ce0fa9050b38a75efce87172b72f8cd

SHA256
2ff41f1cc1189d0968c45fd6df9143215718d8f1562a6247553d0ba3553a8005

SHA512
786ff606f1bf376c48ec9592e8e9d19c1dd168d99f9e8035fcf9a2db2702616671b7ea4fd97a718c5ee1a8eaf6bba7516a3bd987d454e926e811fa9b8b42447c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13260.exe

Filesize
468KB

MD5
511534da9b9c2b6bd70ca3b6ac7883f8

SHA1
15a5d57e8340c9b30103f54467b49be999a7517a

SHA256
1fbfa5ce11fb500e820081b7f0769fc795a745cbb7fa2674b1db4c0cc6c53692

SHA512
076597721bd7250b91755cb74ebbe069e0cba6cfcd8dd9d3df42cbc873b7ffbf10e67f01f2c607db158c76c2370c7bb96e4ca1af58993119985974a4eadf7c70

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16214.exe

Filesize
468KB

MD5
94650524348eaa760005c1907b04370f

SHA1
680350025c96c800eb224ddb032b6aa077ded63b

SHA256
d7d41d3a1c4865ad810c6b68bc8a50fafec7c38a4b9ffa24d036ab53fc7e1d96

SHA512
5e0132477bb620c2ee383cb24b6216c6d5b8f2d82e44e524e14bc485ebf1ff31fb5e0c90a88ec1ef92c41c2e41195af126d90e00d044b11a0383eb13697e90a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16598.exe

Filesize
468KB

MD5
36a4e9b1ce45a8d69877a328f7a9d656

SHA1
78625c2643400efdefb413ba80b2544af9b3255b

SHA256
a16f9f11c1103703cf0e541c6a4f12989cae2c0746b149c0ea8f712d70bd6917

SHA512
b08a67fa659bd525818914594fd556006079b26d3cc09c5c7b44c5b0e85410f1104c0ffabd8dee32435b3f2e081488e3282612a923f571ffb5aac9083095673f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20852.exe

Filesize
468KB

MD5
bbe0d5cc6f08e4ceb78dd06bdd438be0

SHA1
8a4b76dbd4cdcbbb090da5a095610f43b83378d3

SHA256
03201a144d680007e1ce74a05dfaa0a2eb48af0be4a7d60074c415e651c1a154

SHA512
9b61a07833d107e1bdd8b5ea90e51139c70ae031d3c036b1f9154a979580504d2635984a6ba7b924d9fdc860af91c5ba0f41e09da8cb987afc46544d382cf6d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22179.exe

Filesize
468KB

MD5
e8c0ba3e81803d047361ca3af7323b7c

SHA1
46836a02f419ce4a19981dee2a4037b827b46c0b

SHA256
068b371208ec0c514cea7391a2d909574fb058519d06a46bd73c146245bde9e7

SHA512
49ec89d2f05e2204c82c665620cdf3c4ee7e568a5ce314677b11a350f8b32ad07c5fd0aa88e1f73485c8eda75b125cc6ff3834b4ce59136a0dab74d92d38d100

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24766.exe

Filesize
468KB

MD5
1bcaa59968a2bff259e558400064d24f

SHA1
94a9379d149a54e4d6938c5d0ac3f12fb483d460

SHA256
aff634d903af659c0ff53c6d804accfbc4788d5c02c48515fd33cd7c8650b745

SHA512
61096b859b6f6fe7dc1fd3e347f712b0441dbc57542d752cdbcac7a930328aeac22d4aa3d7649407547541dba2a55fab5b9ac2f825a19ac552dac12635f20323

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26995.exe

Filesize
468KB

MD5
defebeced974216bc5afaa111ea96435

SHA1
dbe9d2332eaf065ee03ecf6b7b68e261b545571b

SHA256
73c17e0eb4daacfdb01b19887833b2110886e7d52378143f759be82c29f2889e

SHA512
791606d111b46a60a28f764dfa0df409a0ab3fe2b42d433d6cdfb77cb5d55c68c7736a62ad7ff763cde1b5b3a7ea546463b2152efb7fc7eaba1528b773667644

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-275.exe

Filesize
468KB

MD5
70fcdcbedbaed4cbc8976c72f95643c9

SHA1
1acfb4a837cceb2a7e0b0dc96c53f0d777af2976

SHA256
f82d38128ee8a08b54cfdf9f16c46f5410dc5d87985722c26868a6a0c4e5902f

SHA512
9b5161565b7d0bc17fc18821b3f698a78b318f040f5e6d7ab84e0681bb93726f692575d9666ed61335ace4138da5c5b438eff7ef1be6691c061b49481ff5082c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29892.exe

Filesize
468KB

MD5
f641866f1963ee42d98161ef095dfe8b

SHA1
90bbcf314eee83be8b7540c7343c2ca5515eecec

SHA256
e0c869cb9ed94eb5779ca0d6656458d7757eb04765f4181f6cc84cac76cffdce

SHA512
57e9c57cb87608d2fcce4e75d4085ec9dbb2f6cbc6356ae9e7cc2d2da6bb091a02f5e38a6ad1b812f53a2759aae434400be58d3b2cc1fdb0ecba85918e2d7610

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30910.exe

Filesize
468KB

MD5
a2159b5e971f252f74a69dc897b12e0c

SHA1
c7163553ad61dd42f86098d2e8b53852fe167273

SHA256
39e833512b7ffd3926aee3bdd2f847800180856a8387214ebaf7d078c444f735

SHA512
8eaa523e3fdec63c5ba32193fa7f76acef1d3d1a8288e2443f1c5116c0f7a05056fb2e63946a77e380766e30312471671319a37bf88b6a1f96b7840e160dd0c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31102.exe

Filesize
468KB

MD5
849596d30b2d144b78bca6e84544b748

SHA1
d8bd46568c5ec0cae544bf64ffa8f9105e0a77be

SHA256
a29c34097a006d2be146272b425654c39dc50a3620a16a67bf99bba03a30b371

SHA512
8394b5c0bfd07890baefdb74f860e2b53b93dfdda5b55611cd898bb331ff38d9bf45329ed536c984a3f548025f37d88d2676c557fbb9d1d3c5edf2cfee82c007

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32861.exe

Filesize
468KB

MD5
55972afb66a504a287bed49f30b52383

SHA1
e003f023bf19085e66190455f491f9d56b90094c

SHA256
b23ca64e1d70c061d571656c8d039694dfd49611dab635d7aaa7d90444ed68fc

SHA512
bf6dcd20b3cc86896c32cff084b7187a4fd6ca69b96ea735e56d6cddb6cdb9b882e26ea08f087af7f217b19ecd684db7e5472b43426fe0787159dfe5c6b3a626

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32934.exe

Filesize
468KB

MD5
28ef19ab9e2720a9cc3d655f062a9ddc

SHA1
9f1f154b8bd9445f96ebbca0eac9f74d88f43c89

SHA256
eb6e43dd35a104be9e0b97a9d22f69deb12e0c80ff5265b214b9fbd329a2664c

SHA512
30707728245c9d7226d33792d34395bded5a484d0d2016eaefbac41d00bb78aad15297dac4f41ed5a0ece2f2116f4a502ac891384092cd413c3b66573df3d0fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33126.exe

Filesize
468KB

MD5
875ddfa333cd46028662a432b523c47e

SHA1
f34e52e5a751eebd612208cee6f88c3972d13949

SHA256
a4cf9efb65c26385f3f0e51d7a5844c05b1818103bac4291a789781e5080add0

SHA512
53b4e4d8692cf761712eb2630e872e929084862dcbe6a415bc217cee535642ac57188215e37ae3f21a89997c3da4fdc08ebbd30576e0bbf87dbc91480d9d7b7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-365.exe

Filesize
468KB

MD5
d825d3548858da1ed5e69125c9ef6a82

SHA1
2eced0919400a4173dd361fe51dc5098804ced5c

SHA256
6e5890b7938972a96523d8639001bc7df08e488da57c53bf32933e6be541bcb7

SHA512
b16acbc5b1b895343eae1bf13f43d26e7d050f87ceb8328b8f3a9013e8b131314f862d62424532464864f550ab6e30bb7a94e60352402a6215d002088e35052c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37764.exe

Filesize
468KB

MD5
493c7506adbf7fda3d49d0e14b4a2a0f

SHA1
2e5ff914741ce7452a1d0c32c27ebcf233dc5f14

SHA256
9e90ce9fa7af09ce2bed1d1e194012c401e4b26a69ff389f0d4590e25673e53a

SHA512
2c462973a7e11715fed927ca8f4787ae9ed2bc3081f4ea60c2dc8bc366b9279deb3da84f1e62f1e71acfa36fc5f10b6cc4dee10182013b06d241b939223ad9e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41102.exe

Filesize
468KB

MD5
cdc114541a9229661b82cbf87965cbb1

SHA1
197c528f91b4f65c1c5a95f96d13c374c184fac7

SHA256
89f57cc52c070814b36835daee1dc33f913f4346c850149e0fdca7a503f4993d

SHA512
5e5b212c385ed321ad7f223a96b135d7d5ed059813d0c812abc8bed39dea6836ffa33aef8943e81a272f9ffb4f6369e5a6b10f60eab1e9c4adf583107fa9e416

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43716.exe

Filesize
468KB

MD5
f4da6a2dde43df36f82878dc08af1ec8

SHA1
b7346444e0bcd646bd1f07c67a696b25dc5a66e4

SHA256
d749e7777816e5b4f595d0147f2d842b33d564d15457abec97320470624767f7

SHA512
938ea0bea4eac11faaddfa89b178e40dfb8932f301841f325337194efed696765304da1d669b33d86889575e63a2cd394de0c8511c77a3c9d174881ea9258d19

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe

Filesize
468KB

MD5
31d018897e3d9d8136d8cde806b7b1dd

SHA1
228dce9049927494292ee7ac864b2ae658ba9af5

SHA256
0de86e755f7ca303bcc37cb791860202182f1f89c740f68ce4289e2879726158

SHA512
56c2d133a31758fe6709dd9d4b97cb771075ec68572cb117b32b08d826509f2508ffdc87ed9a314a806f0681a2ec74df036bc4ed889ca190cda8b869abde901e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52077.exe

Filesize
468KB

MD5
7a6bf878b73fc031e123cbaabccf4cf5

SHA1
405626c3f816cc61fc53a74e643fd92a6c327c27

SHA256
6ec6ca449d87d55bae908e37d1a09c0a249233291cf198dfdbe8113607cbf1c4

SHA512
f0dfc474790badbc601b8ff383a5df2251caed2a18d96ff53e016ccbd2ab73466c22f285e7177aa4227a0c180e83a04edb9beade07b00f5ebd88f03052a47ed1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56868.exe

Filesize
468KB

MD5
7e664cfd29e1b12ed8254e24af9dd593

SHA1
c22b1dc1762af8aba76bd4d3c32bd1267126ed79

SHA256
d795a1d70fed68f85818bbe4f6d43de8004f0f163163826b4e102d397b2610f9

SHA512
ad29958d742cd8d1a8838242ed4d3f068d6b28100f5de098b37d32096d824b35d44aea87cf4f0d834c3f27d85b65592b18ee2f7cf60d17f18f076ce9a8ec31e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57438.exe

Filesize
468KB

MD5
9abf18661b91208ddb7686e9acb54cdb

SHA1
5aeef6ee6574731f5e708ae39a9d6785e0d290d6

SHA256
4a5de4c4e5ba6cd5c3aed54ce35b9ef2b4e2fd63007a466f70c33c988d14d790

SHA512
cdfd16507ea8e0dbe03723ee8246ceef8810390289e0696a1a8ef958fbd906fff3bb127a8500ba3bcb6594b0b7309c4a8ae639184cd4fb4a1792a9c4750c91ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59668.exe

Filesize
468KB

MD5
f044ea2e2c4cb342538c281d1ecbd20a

SHA1
e2295ce1f6d5dd95c1496561eb40db34529d75c6

SHA256
90da89196d617b15ab6fe4e7b0c96dad28b9fd5273ab7746c0ade1b32770117b

SHA512
267985af135121175594532b95d214be91d247cf09464f722c9f47f4d7cfbff75b3bc1d7a24cf57ca6420ba57381a9ecdd0de7070dd6f104df8c626c97457227

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59918.exe

Filesize
468KB

MD5
b1880e9fe430919f70b93f2120d2f3ad

SHA1
5ae66b9b0a45bf98bb14d7524c9506106d64daf4

SHA256
abc5c3d2c1cac169e6e1832cad1662bb2b28464ca243c6c0e1241eddcceb7029

SHA512
b89480c46c3a88744ba194583c89a7f2331d4887bd1c904d4e93f4e5afd283741e6f812979c1db491abec015b0c3783a2f6db0065f215b10138679cb98ee0eaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60790.exe

Filesize
468KB

MD5
d46533a2d0e3110efd716218c8c5266e

SHA1
a963e677762a6ad025d3e2671222dcb6bfe5fd39

SHA256
cd7da485fd29d9169376085926a5270c00d209b5c71b8d51cfda12c19819e552

SHA512
6e63593e0dccf3a29681e8fb9a5f7efaa8c164cbea09647eda179de509055b9b1b3cb2236cd132e5c8ad90104135c66498a1e937c66ed16141c9639c798090e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6140.exe

Filesize
468KB

MD5
3348a3ac52e96e2296dbd43f6c549863

SHA1
3d2e4e2628971f5b415f9df3bbe2c52bfb11e602

SHA256
6a198bd2142255660581c5055b9eeadb8688a6ea52e42e315c3864e23c18ee34

SHA512
2d2e62aa79c7250b5e3261969779720f6907f5dbe36a8f19c0fc418dbd57766fe7f3e75907914eb73634e6b88f3cdd60037f2d94c2d894bd005129e63f16dc5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63702.exe

Filesize
468KB

MD5
3ecb7a521f67c729957d6c68fc4303f3

SHA1
6e74206c54dc6082fa1b7af93c874fbc72a3a294

SHA256
73bfd1f6205017fff355bcf1e3770e352cf1e3e0f836fae06042a8b7239e867c

SHA512
41e37fbb878f3b379f705afbb4f31f609e929f0fd5a7d407c1174f721aaa911a0ed2a473415e09f150a6f07078b297f2a1b1b4e68105dfaf24bed154917e6ada

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64557.exe

Filesize
468KB

MD5
475f3bdfe16c85f19ee37ec74e4873ac

SHA1
9f3bb4a888827948701675e0e66fdb3d21e7d242

SHA256
4b563b936ddb5b1d707c50bd0dd6a9e4890eecb697f68afbadaa8f4cdf96698c

SHA512
0738205d5b9563167a03157feb6df94cd1175db69b5fcb15db13f2e504d70001e612b6421ebeba7e0df19692aaed047c8b3b0e1b3bc08e6bcabfa22b2c5d33f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64822.exe

Filesize
468KB

MD5
c19d24f8e0978f979f04ba6d21d5fc5a

SHA1
be87e1f599edd1b0f177ea4d59bb74b8fd8fe2b0

SHA256
4bd2bdc8cff68ceeef7c9eee46f49cc3d078297e051ba0e83cd1850104343b79

SHA512
78f2b1b9bfac9359f7b51137796eed40ac287c2dfffd66c3f7f66e4f617e13a34e59f21a0731c4706cba43c6f2cd904d77425474ff97cc7e4b34f9d28a9d0def

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8444.exe

Filesize
468KB

MD5
a1aa583daa5c58e206451315d7edd076

SHA1
ccf2e618353d25a9f4c34026ae337ff1b1b20ca3

SHA256
16c62e59971c800e3613c8fb0492430319afb08ef661976bc048663c51512423

SHA512
567bc22685bb443e382f2e5f99bc48b7e88830de915eb6adcf7967144251379efff65487c4f85470c8a298b561982f45dcdce0da14d4844f5ac26847152dd08f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads