eb76b302d08f5fe1e1ac01cf3ca7826cf8dde012862e21b5a5a2a03847b6c07e

Analysis

max time kernel
109s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb76b302d08f5fe1e1ac01cf3ca7826cf8dde012862e21b5a5a2a03847b6c07eN.exe
Size

468KB
MD5

7c99cb89c96b3ec8340e13625a860c90
SHA1

3ba3d9eb45fdeafede480ba868727677321cb7c3
SHA256

eb76b302d08f5fe1e1ac01cf3ca7826cf8dde012862e21b5a5a2a03847b6c07e
SHA512

1ed0534ebdcf7e6e14ed0fe26dc1ef82aa3a1a3b914e9d8048bff98c1322ca9fa86dee5c893c2c69cd5bc7916cc02ea0fe116460394e2eed5aea156a348c0c1a
SSDEEP

3072:abXfog5+Pb8UjJYHPzijmf6/7ChAi4pfhdHeZVyaD3goNyrUV6uy4:abPohYUjWPejmfHEqm43g40UV6

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1020	Unicorn-14329.exe
4992	Unicorn-37224.exe
4800	Unicorn-57090.exe
3848	Unicorn-39130.exe
412	Unicorn-41168.exe
2692	Unicorn-59550.exe
1536	Unicorn-39684.exe
1980	Unicorn-38502.exe
2924	Unicorn-26804.exe
4776	Unicorn-17890.exe
4476	Unicorn-13540.exe
3196	Unicorn-21590.exe
4572	Unicorn-21590.exe
3144	Unicorn-26228.exe
2364	Unicorn-39964.exe
2620	Unicorn-29094.exe
4528	Unicorn-33732.exe
808	Unicorn-33370.exe
4020	Unicorn-49706.exe
4764	Unicorn-59912.exe
3576	Unicorn-46177.exe
5064	Unicorn-61382.exe
4280	Unicorn-53769.exe
3768	Unicorn-3635.exe
1908	Unicorn-49685.exe
1124	Unicorn-20734.exe
2208	Unicorn-35023.exe
2452	Unicorn-44973.exe
3996	Unicorn-41154.exe
4600	Unicorn-43842.exe
4760	Unicorn-40312.exe
64	Unicorn-43821.exe
3228	Unicorn-43821.exe
4468	Unicorn-23038.exe
1492	Unicorn-53664.exe
708	Unicorn-64454.exe
3164	Unicorn-35793.exe
456	Unicorn-40696.exe
2700	Unicorn-60562.exe
4712	Unicorn-8984.exe
2704	Unicorn-16214.exe
4144	Unicorn-32550.exe
4876	Unicorn-48886.exe
4272	Unicorn-48886.exe
3796	Unicorn-45357.exe
1876	Unicorn-11937.exe
952	Unicorn-24574.exe
1772	Unicorn-20490.exe
1300	Unicorn-20490.exe
4400	Unicorn-18443.exe
4728	Unicorn-32477.exe
3740	Unicorn-7276.exe
844	Unicorn-63368.exe
1976	Unicorn-49633.exe
4264	Unicorn-12876.exe
1236	Unicorn-36063.exe
4284	Unicorn-44994.exe
3504	Unicorn-42948.exe
1484	Unicorn-15127.exe
4288	Unicorn-453.exe
4980	Unicorn-12705.exe
680	Unicorn-1392.exe
3208	Unicorn-50806.exe
908	Unicorn-16279.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4368	14388	WerFault.exe	732

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-453.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15766.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4452.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24323.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43696.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16792.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60230.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59346.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26814.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39953.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54058.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12705.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56917.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11312.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32758.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42116.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8920.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46177.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14833.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47764.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41533.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36445.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18366.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65025.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54895.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14871.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34190.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36792.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19198.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49981.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9827.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30601.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31746.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52492.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	624	dwm.exe
Token: SeChangeNotifyPrivilege	624	dwm.exe
Token: 33	624	dwm.exe
Token: SeIncBasePriorityPrivilege	624	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3116	eb76b302d08f5fe1e1ac01cf3ca7826cf8dde012862e21b5a5a2a03847b6c07eN.exe
1020	Unicorn-14329.exe
4992	Unicorn-37224.exe
4800	Unicorn-57090.exe
3848	Unicorn-39130.exe
412	Unicorn-41168.exe
1536	Unicorn-39684.exe
2692	Unicorn-59550.exe
1980	Unicorn-38502.exe
2924	Unicorn-26804.exe
4572	Unicorn-21590.exe
4776	Unicorn-17890.exe
4476	Unicorn-13540.exe
3196	Unicorn-21590.exe
3144	Unicorn-26228.exe
2364	Unicorn-39964.exe
2620	Unicorn-29094.exe
4528	Unicorn-33732.exe
808	Unicorn-33370.exe
4764	Unicorn-59912.exe
4020	Unicorn-49706.exe
3576	Unicorn-46177.exe
5064	Unicorn-61382.exe
4280	Unicorn-53769.exe
3768	Unicorn-3635.exe
1908	Unicorn-49685.exe
3996	Unicorn-41154.exe
1124	Unicorn-20734.exe
2208	Unicorn-35023.exe
2452	Unicorn-44973.exe
4600	Unicorn-43842.exe
4760	Unicorn-40312.exe
3228	Unicorn-43821.exe
64	Unicorn-43821.exe
4468	Unicorn-23038.exe
1492	Unicorn-53664.exe
708	Unicorn-64454.exe
3164	Unicorn-35793.exe
456	Unicorn-40696.exe
4712	Unicorn-8984.exe
2700	Unicorn-60562.exe
2704	Unicorn-16214.exe
4144	Unicorn-32550.exe
4272	Unicorn-48886.exe
3796	Unicorn-45357.exe
4876	Unicorn-48886.exe
1876	Unicorn-11937.exe
1772	Unicorn-20490.exe
3504	Unicorn-42948.exe
4284	Unicorn-44994.exe
4400	Unicorn-18443.exe
1976	Unicorn-49633.exe
4728	Unicorn-32477.exe
1236	Unicorn-36063.exe
3740	Unicorn-7276.exe
1300	Unicorn-20490.exe
952	Unicorn-24574.exe
4264	Unicorn-12876.exe
844	Unicorn-63368.exe
1484	Unicorn-15127.exe
324	Unicorn-18326.exe
4288	Unicorn-453.exe
680	Unicorn-1392.exe
4980	Unicorn-12705.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 1020	3116	eb76b302d08f5fe1e1ac01cf3ca7826cf8dde012862e21b5a5a2a03847b6c07eN.exe	86
PID 3116 wrote to memory of 1020	3116	eb76b302d08f5fe1e1ac01cf3ca7826cf8dde012862e21b5a5a2a03847b6c07eN.exe	86
PID 3116 wrote to memory of 1020	3116	eb76b302d08f5fe1e1ac01cf3ca7826cf8dde012862e21b5a5a2a03847b6c07eN.exe	86
PID 3116 wrote to memory of 4992	3116	eb76b302d08f5fe1e1ac01cf3ca7826cf8dde012862e21b5a5a2a03847b6c07eN.exe	88
PID 3116 wrote to memory of 4992	3116	eb76b302d08f5fe1e1ac01cf3ca7826cf8dde012862e21b5a5a2a03847b6c07eN.exe	88
PID 3116 wrote to memory of 4992	3116	eb76b302d08f5fe1e1ac01cf3ca7826cf8dde012862e21b5a5a2a03847b6c07eN.exe	88
PID 1020 wrote to memory of 4800	1020	Unicorn-14329.exe	89
PID 1020 wrote to memory of 4800	1020	Unicorn-14329.exe	89
PID 1020 wrote to memory of 4800	1020	Unicorn-14329.exe	89
PID 4992 wrote to memory of 3848	4992	Unicorn-37224.exe	92
PID 4992 wrote to memory of 3848	4992	Unicorn-37224.exe	92
PID 4992 wrote to memory of 3848	4992	Unicorn-37224.exe	92
PID 3116 wrote to memory of 412	3116	eb76b302d08f5fe1e1ac01cf3ca7826cf8dde012862e21b5a5a2a03847b6c07eN.exe	93
PID 3116 wrote to memory of 412	3116	eb76b302d08f5fe1e1ac01cf3ca7826cf8dde012862e21b5a5a2a03847b6c07eN.exe	93
PID 3116 wrote to memory of 412	3116	eb76b302d08f5fe1e1ac01cf3ca7826cf8dde012862e21b5a5a2a03847b6c07eN.exe	93
PID 4800 wrote to memory of 2692	4800	Unicorn-57090.exe	94
PID 4800 wrote to memory of 2692	4800	Unicorn-57090.exe	94
PID 4800 wrote to memory of 2692	4800	Unicorn-57090.exe	94
PID 1020 wrote to memory of 1536	1020	Unicorn-14329.exe	95
PID 1020 wrote to memory of 1536	1020	Unicorn-14329.exe	95
PID 1020 wrote to memory of 1536	1020	Unicorn-14329.exe	95
PID 3848 wrote to memory of 1980	3848	Unicorn-39130.exe	96
PID 3848 wrote to memory of 1980	3848	Unicorn-39130.exe	96
PID 3848 wrote to memory of 1980	3848	Unicorn-39130.exe	96
PID 4992 wrote to memory of 2924	4992	Unicorn-37224.exe	97
PID 4992 wrote to memory of 2924	4992	Unicorn-37224.exe	97
PID 4992 wrote to memory of 2924	4992	Unicorn-37224.exe	97
PID 412 wrote to memory of 4776	412	Unicorn-41168.exe	98
PID 412 wrote to memory of 4776	412	Unicorn-41168.exe	98
PID 412 wrote to memory of 4776	412	Unicorn-41168.exe	98
PID 3116 wrote to memory of 4476	3116	eb76b302d08f5fe1e1ac01cf3ca7826cf8dde012862e21b5a5a2a03847b6c07eN.exe	99
PID 3116 wrote to memory of 4476	3116	eb76b302d08f5fe1e1ac01cf3ca7826cf8dde012862e21b5a5a2a03847b6c07eN.exe	99
PID 3116 wrote to memory of 4476	3116	eb76b302d08f5fe1e1ac01cf3ca7826cf8dde012862e21b5a5a2a03847b6c07eN.exe	99
PID 2692 wrote to memory of 3196	2692	Unicorn-59550.exe	101
PID 2692 wrote to memory of 3196	2692	Unicorn-59550.exe	101
PID 2692 wrote to memory of 3196	2692	Unicorn-59550.exe	101
PID 1536 wrote to memory of 4572	1536	Unicorn-39684.exe	100
PID 1536 wrote to memory of 4572	1536	Unicorn-39684.exe	100
PID 1536 wrote to memory of 4572	1536	Unicorn-39684.exe	100
PID 4800 wrote to memory of 3144	4800	Unicorn-57090.exe	102
PID 4800 wrote to memory of 3144	4800	Unicorn-57090.exe	102
PID 4800 wrote to memory of 3144	4800	Unicorn-57090.exe	102
PID 1020 wrote to memory of 2364	1020	Unicorn-14329.exe	103
PID 1020 wrote to memory of 2364	1020	Unicorn-14329.exe	103
PID 1020 wrote to memory of 2364	1020	Unicorn-14329.exe	103
PID 1980 wrote to memory of 2620	1980	Unicorn-38502.exe	104
PID 1980 wrote to memory of 2620	1980	Unicorn-38502.exe	104
PID 1980 wrote to memory of 2620	1980	Unicorn-38502.exe	104
PID 3848 wrote to memory of 4528	3848	Unicorn-39130.exe	105
PID 3848 wrote to memory of 4528	3848	Unicorn-39130.exe	105
PID 3848 wrote to memory of 4528	3848	Unicorn-39130.exe	105
PID 2924 wrote to memory of 808	2924	Unicorn-26804.exe	106
PID 2924 wrote to memory of 808	2924	Unicorn-26804.exe	106
PID 2924 wrote to memory of 808	2924	Unicorn-26804.exe	106
PID 4572 wrote to memory of 4020	4572	Unicorn-21590.exe	107
PID 4572 wrote to memory of 4020	4572	Unicorn-21590.exe	107
PID 4572 wrote to memory of 4020	4572	Unicorn-21590.exe	107
PID 4992 wrote to memory of 4764	4992	Unicorn-37224.exe	108
PID 4992 wrote to memory of 4764	4992	Unicorn-37224.exe	108
PID 4992 wrote to memory of 4764	4992	Unicorn-37224.exe	108
PID 1536 wrote to memory of 3576	1536	Unicorn-39684.exe	109
PID 1536 wrote to memory of 3576	1536	Unicorn-39684.exe	109
PID 1536 wrote to memory of 3576	1536	Unicorn-39684.exe	109
PID 3196 wrote to memory of 5064	3196	Unicorn-21590.exe	110

C:\Users\Admin\AppData\Local\Temp\eb76b302d08f5fe1e1ac01cf3ca7826cf8dde012862e21b5a5a2a03847b6c07eN.exe
"C:\Users\Admin\AppData\Local\Temp\eb76b302d08f5fe1e1ac01cf3ca7826cf8dde012862e21b5a5a2a03847b6c07eN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14329.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14329.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57090.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57090.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59550.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21590.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61382.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16214.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30926.exe
        8⤵
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32410.exe
        9⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8217.exe
        10⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65520.exe
        10⤵
        
        PID:13872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3889.exe
        10⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10588.exe
        9⤵
        
        PID:8844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43844.exe
        9⤵
        
        PID:11964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39393.exe
        9⤵
        
        PID:1080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10152.exe
        8⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36370.exe
        9⤵
        
        PID:9952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64805.exe
        9⤵
        
        PID:13028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
        9⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14339.exe
        8⤵
        
        PID:8584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
        8⤵
        
        PID:12292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12057.exe
        8⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11828.exe
        7⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3821.exe
        8⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32862.exe
        9⤵
        
        PID:10568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20456.exe
        9⤵
        
        PID:14616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61261.exe
        9⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe
        9⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
        8⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
        8⤵
        
        PID:13604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12249.exe
        8⤵
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32057.exe
        7⤵
        
        PID:2900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6637.exe
        8⤵
        
        PID:11320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5464.exe
        8⤵
        
        PID:15224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5483.exe
        7⤵
        
        PID:9840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7700.exe
        7⤵
        
        PID:13676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
        7⤵
        
        PID:14340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45357.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31694.exe
        7⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52830.exe
        8⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10417.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4452.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17575.exe
        9⤵
        
        PID:14988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50256.exe
        9⤵
        
        PID:16216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3239.exe
        8⤵
        
        PID:9396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55473.exe
        8⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26191.exe
        7⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18366.exe
        8⤵
        
        PID:13756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1100.exe
        8⤵
        
        PID:2844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30601.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14148.exe
        7⤵
        
        PID:9860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24235.exe
        7⤵
        
        PID:13900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8549.exe
        7⤵
        
        PID:2152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59580.exe
        6⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35830.exe
        7⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15544.exe
        7⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35011.exe
        7⤵
        
        PID:13996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30755.exe
        7⤵
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37869.exe
        6⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22586.exe
        7⤵
        
        PID:14812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32867.exe
        6⤵
        
        PID:11084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43636.exe
        6⤵
        
        PID:14736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1349.exe
        6⤵
        
        PID:7224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49685.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20490.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52114.exe
        7⤵
        
        PID:1688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12005.exe
        9⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47137.exe
        10⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48504.exe
        9⤵
        
        PID:12472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22592.exe
        9⤵
        
        PID:15488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7324.exe
        8⤵
        
        PID:9336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54552.exe
        8⤵
        
        PID:13644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50448.exe
        8⤵
        
        PID:15952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30956.exe
        7⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58134.exe
        8⤵
        
        PID:10324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20264.exe
        8⤵
        
        PID:14904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5720.exe
        8⤵
        
        PID:16112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43696.exe
        7⤵
        
        PID:10048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45921.exe
        7⤵
        
        PID:14096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45845.exe
        6⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32758.exe
        7⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10529.exe
        8⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5464.exe
        8⤵
        
        PID:15208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23800.exe
        7⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20683.exe
        7⤵
        
        PID:12996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57173.exe
        7⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61988.exe
        6⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35610.exe
        7⤵
        
        PID:11840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47667.exe
        7⤵
        
        PID:15792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45669.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51900.exe
        6⤵
        
        PID:13716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1229.exe
        6⤵
        
        PID:15448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18443.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29338.exe
        6⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57646.exe
        7⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
        8⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31172.exe
        8⤵
        
        PID:13700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13689.exe
        8⤵
        
        PID:15944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23800.exe
        7⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20683.exe
        7⤵
        
        PID:12988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62566.exe
        7⤵
        
        PID:15432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30956.exe
        6⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15766.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2880.exe
        7⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30755.exe
        7⤵
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43696.exe
        6⤵
        
        PID:9644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39953.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12727.exe
        5⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54382.exe
        6⤵
        
        PID:8520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24872.exe
        6⤵
        
        PID:12236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13884.exe
        6⤵
        
        PID:14796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60001.exe
        5⤵
        
        PID:8652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23949.exe
        6⤵
        
        PID:13848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22881.exe
        5⤵
        
        PID:12344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32889.exe
        5⤵
        
        PID:15408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26228.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20734.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44994.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48030.exe
        7⤵
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38570.exe
        8⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41466.exe
        9⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24105.exe
        9⤵
        
        PID:15232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21495.exe
        8⤵
        
        PID:9876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31121.exe
        8⤵
        
        PID:13824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25733.exe
        8⤵
        
        PID:16088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21008.exe
        7⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19331.exe
        7⤵
        
        PID:11016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56393.exe
        7⤵
        
        PID:14664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52675.exe
        7⤵
        
        PID:15480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45845.exe
        6⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3541.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53474.exe
        8⤵
        
        PID:10656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36792.exe
        8⤵
        
        PID:14868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20228.exe
        8⤵
        
        PID:14540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52483.exe
        8⤵
        
        PID:9356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55573.exe
        7⤵
        
        PID:10160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47764.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54878.exe
        7⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37716.exe
        7⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24856.exe
        7⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21688.exe
        6⤵
        
        PID:11076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60364.exe
        6⤵
        
        PID:15348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37750.exe
        6⤵
        
        PID:15280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49633.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21170.exe
        6⤵
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49286.exe
        7⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8357.exe
        8⤵
        
        PID:10460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3160.exe
        8⤵
        
        PID:14556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60651.exe
        8⤵
        
        PID:15608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64.exe
        7⤵
        
        PID:8672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57789.exe
        7⤵
        
        PID:12788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31724.exe
        6⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57698.exe
        7⤵
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37316.exe
        7⤵
        
        PID:12020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30952.exe
        7⤵
        
        PID:15648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63192.exe
        6⤵
        
        PID:8832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4199.exe
        6⤵
        
        PID:14328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28969.exe
        6⤵
        
        PID:8008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28443.exe
        5⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40890.exe
        6⤵
        
        PID:9344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16449.exe
        6⤵
        
        PID:15672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25721.exe
        5⤵
        
        PID:7712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59352.exe
        5⤵
        
        PID:11772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63777.exe
        5⤵
        
        PID:14968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59258.exe
        5⤵
        
        PID:15472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35023.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20490.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8917.exe
        6⤵
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45586.exe
        7⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52986.exe
        8⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51924.exe
        8⤵
        
        PID:12768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30755.exe
        8⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23800.exe
        7⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20683.exe
        7⤵
        
        PID:13016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29701.exe
        7⤵
        
        PID:15544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30956.exe
        6⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49058.exe
        7⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65520.exe
        7⤵
        
        PID:13828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43696.exe
        6⤵
        
        PID:9588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3736.exe
        6⤵
        
        PID:13952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3105.exe
        6⤵
        
        PID:3560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9224.exe
        6⤵
        
        PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59825.exe
        5⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59758.exe
        6⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10587.exe
        6⤵
        
        PID:10592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40057.exe
        6⤵
        
        PID:14628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26385.exe
        6⤵
        
        PID:6384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39596.exe
        5⤵
        
        PID:7596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41533.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60172.exe
        5⤵
        
        PID:14752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32477.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3608.exe
        5⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35986.exe
        6⤵
        
        PID:10416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47893.exe
        6⤵
        
        PID:14516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51953.exe
        6⤵
        
        PID:15616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40276.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47323.exe
        6⤵
        
        PID:7592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
        5⤵
        
        PID:12044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14775.exe
        5⤵
        
        PID:14788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27787.exe
        5⤵
        
        PID:15504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41404.exe
      4⤵
      PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27662.exe
        5⤵
        
        PID:5796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59346.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56608.exe
        6⤵
        
        PID:9164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60085.exe
        5⤵
        
        PID:9884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27035.exe
        5⤵
        
        PID:13668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2172.exe
        5⤵
        
        PID:16012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19492.exe
      4⤵
      PID:7376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41998.exe
        5⤵
        
        PID:12820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11066.exe
        5⤵
        
        PID:15384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33398.exe
      4⤵
      PID:11096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51039.exe
      4⤵
      PID:14776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31030.exe
      4⤵
      PID:15704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39684.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21590.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49706.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60562.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10313.exe
        7⤵
        
        PID:4364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32410.exe
        8⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62550.exe
        9⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2517.exe
        10⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37316.exe
        9⤵
        
        PID:12068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43644.exe
        8⤵
        
        PID:8928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31925.exe
        9⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14679.exe
        8⤵
        
        PID:11652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58969.exe
        7⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26534.exe
        8⤵
        
        PID:13564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18889.exe
        8⤵
        
        PID:15996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14339.exe
        7⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
        7⤵
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12057.exe
        7⤵
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64153.exe
        6⤵
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20158.exe
        7⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23106.exe
        8⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51578.exe
        9⤵
        
        PID:15056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2088.exe
        8⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63164.exe
        8⤵
        
        PID:12740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5521.exe
        8⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-884.exe
        7⤵
        
        PID:7896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41732.exe
        7⤵
        
        PID:11692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12981.exe
        7⤵
        
        PID:5080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3083.exe
        6⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
        7⤵
        
        PID:9384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60721.exe
        7⤵
        
        PID:12860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62509.exe
        7⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44709.exe
        6⤵
        
        PID:8356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27779.exe
        6⤵
        
        PID:13328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8984.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2529.exe
        6⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44470.exe
        7⤵
        
        PID:1428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62934.exe
        8⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48417.exe
        8⤵
        
        PID:11808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23095.exe
        8⤵
        
        PID:3152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14901.exe
        8⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7324.exe
        7⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54552.exe
        7⤵
        
        PID:13624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25001.exe
        7⤵
        
        PID:15712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30956.exe
        6⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36650.exe
        7⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11416.exe
        7⤵
        
        PID:10776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39917.exe
        7⤵
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22586.exe
        7⤵
        
        PID:2228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43696.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39953.exe
        6⤵
        
        PID:13452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61258.exe
        6⤵
        
        PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8267.exe
        5⤵
        
        PID:1916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52638.exe
        6⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27190.exe
        7⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60109.exe
        8⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14385.exe
        8⤵
        
        PID:15632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2088.exe
        7⤵
        
        PID:10956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63164.exe
        7⤵
        
        PID:14160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-655.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43583.exe
        7⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17220.exe
        6⤵
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49900.exe
        6⤵
        
        PID:11716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60793.exe
        6⤵
        
        PID:16844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50557.exe
        5⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23734.exe
        6⤵
        
        PID:10344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47893.exe
        6⤵
        
        PID:14484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22586.exe
        6⤵
        
        PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40896.exe
        5⤵
        
        PID:9604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14752.exe
        5⤵
        
        PID:13444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41806.exe
        5⤵
        
        PID:6904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46177.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11937.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31694.exe
        6⤵
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53370.exe
        7⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39110.exe
        8⤵
        
        PID:10068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64805.exe
        8⤵
        
        PID:14340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25108.exe
        7⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56856.exe
        7⤵
        
        PID:15192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45918.exe
        7⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23556.exe
        6⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6637.exe
        7⤵
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54281.exe
        7⤵
        
        PID:15216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21668.exe
        7⤵
        
        PID:15968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8283.exe
        6⤵
        
        PID:9852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32901.exe
        6⤵
        
        PID:13660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16792.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17921.exe
        6⤵
        
        PID:17380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17343.exe
        5⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36318.exe
        6⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6777.exe
        7⤵
        
        PID:13096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39501.exe
        7⤵
        
        PID:15536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7960.exe
        6⤵
        
        PID:11480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41504.exe
        6⤵
        
        PID:15216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30220.exe
        6⤵
        
        PID:16136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13660.exe
        5⤵
        
        PID:8200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44168.exe
        5⤵
        
        PID:11984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62802.exe
        5⤵
        
        PID:15776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42948.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54610.exe
        5⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14257.exe
        6⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7397.exe
        7⤵
        
        PID:10264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40108.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14080.exe
        7⤵
        
        PID:15736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25108.exe
        6⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21088.exe
        6⤵
        
        PID:4388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10249.exe
        6⤵
        
        PID:15592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49981.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50218.exe
        6⤵
        
        PID:14960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52483.exe
        6⤵
        
        PID:17260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48932.exe
        5⤵
        
        PID:9976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57597.exe
        5⤵
        
        PID:13796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9089.exe
        5⤵
        
        PID:15464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48481.exe
      4⤵
      PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51362.exe
        5⤵
        
        PID:9832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64805.exe
        5⤵
        
        PID:13004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26671.exe
        5⤵
        
        PID:1424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21523.exe
      4⤵
      PID:8812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24508.exe
      4⤵
      PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3185.exe
      4⤵
      PID:15456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39964.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39964.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41154.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48886.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31694.exe
        6⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32410.exe
        7⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63702.exe
        8⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24872.exe
        8⤵
        
        PID:12232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50248.exe
        8⤵
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65326.exe
        8⤵
        
        PID:1220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17003.exe
        8⤵
        
        PID:16772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18756.exe
        7⤵
        
        PID:8896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43844.exe
        7⤵
        
        PID:12172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24885.exe
        7⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63053.exe
        6⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13785.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57981.exe
        7⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51751.exe
        7⤵
        
        PID:968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38844.exe
        6⤵
        
        PID:7952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
        6⤵
        
        PID:13384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22757.exe
        6⤵
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38196.exe
        6⤵
        
        PID:15760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1304.exe
        5⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43998.exe
        6⤵
        
        PID:7176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44517.exe
        6⤵
        
        PID:10220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31887.exe
        6⤵
        
        PID:14080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31679.exe
        6⤵
        
        PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40172.exe
        5⤵
        
        PID:7768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30176.exe
        6⤵
        
        PID:15260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58105.exe
        6⤵
        
        PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21688.exe
        5⤵
        
        PID:11072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60364.exe
        5⤵
        
        PID:12168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62869.exe
        5⤵
        
        PID:2032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26671.exe
        5⤵
        
        PID:6696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12876.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52617.exe
        5⤵
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16386.exe
        6⤵
        
        PID:7468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57352.exe
        6⤵
        
        PID:13792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43931.exe
        6⤵
        
        PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52720.exe
        5⤵
        
        PID:8260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27457.exe
        6⤵
        
        PID:15840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
        5⤵
        
        PID:12052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16021.exe
        5⤵
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25824.exe
        5⤵
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58406.exe
        5⤵
        
        PID:15528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9175.exe
      4⤵
      PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31746.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7973.exe
        6⤵
        
        PID:10752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36792.exe
        6⤵
        
        PID:14672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56037.exe
        6⤵
        
        PID:15552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39088.exe
        5⤵
        
        PID:9944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55624.exe
        5⤵
        
        PID:13636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4428.exe
      4⤵
      PID:7444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18558.exe
        5⤵
        
        PID:12736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31333.exe
        5⤵
        
        PID:15624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57564.exe
      4⤵
      PID:10920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27300.exe
      4⤵
      PID:14700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54058.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44973.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44973.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32550.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26842.exe
        5⤵
        
        PID:2344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36842.exe
        6⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7921.exe
        7⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32464.exe
        7⤵
        
        PID:11508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65025.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18956.exe
        6⤵
        
        PID:12916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14716.exe
        6⤵
        
        PID:1804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44921.exe
        6⤵
        
        PID:16120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48253.exe
        5⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60682.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39724.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16259.exe
        5⤵
        
        PID:9752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60565.exe
        5⤵
        
        PID:13544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32861.exe
        5⤵
        
        PID:15784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11060.exe
      4⤵
      PID:4964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32758.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40890.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65520.exe
        6⤵
        
        PID:13884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14424.exe
        6⤵
        
        PID:15512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41096.exe
        5⤵
        
        PID:9012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25151.exe
        5⤵
        
        PID:12664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30220.exe
        5⤵
        
        PID:16144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61988.exe
      4⤵
      PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37966.exe
        5⤵
        
        PID:14724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63970.exe
        5⤵
        
        PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42545.exe
      4⤵
      PID:9800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45800.exe
      4⤵
      PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25114.exe
      4⤵
      PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
      4⤵
      PID:5548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36063.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3608.exe
      4⤵
      PID:5924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15794.exe
        5⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5817.exe
        6⤵
        
        PID:13216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
        6⤵
        
        PID:14500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1629.exe
        6⤵
        
        PID:15696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11879.exe
        5⤵
        
        PID:12156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52492.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13217.exe
        5⤵
        
        PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47764.exe
      4⤵
      PID:7620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39347.exe
        5⤵
        
        PID:15680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21688.exe
      4⤵
      PID:11080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60364.exe
      4⤵
      PID:14388
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14388 -s 496
        5⤵
        Program crash
        
        PID:4368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9224.exe
      4⤵
      PID:6520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9108.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9108.exe
    3⤵
    PID:5768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4885.exe
      4⤵
      PID:7508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41422.exe
        5⤵
        
        PID:12404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45136.exe
        5⤵
        
        PID:3780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13837.exe
        5⤵
        
        PID:16868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21932.exe
      4⤵
      PID:11056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62972.exe
      4⤵
      PID:14744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19880.exe
      4⤵
      PID:5012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63522.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63522.exe
    3⤵
    PID:8144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18366.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21956.exe
      4⤵
      PID:7808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54722.exe
      4⤵
      PID:5660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4275.exe
    3⤵
    PID:10872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55984.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55984.exe
    3⤵
    PID:14980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23605.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23605.exe
    3⤵
    PID:1212
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37224.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37224.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39130.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39130.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38502.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29094.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43842.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12705.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46634.exe
        8⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35638.exe
        9⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31142.exe
        10⤵
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1764.exe
        10⤵
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50196.exe
        10⤵
        
        PID:3488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30601.exe
        10⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29960.exe
        9⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34087.exe
        9⤵
        
        PID:13472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9224.exe
        9⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-831.exe
        8⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18698.exe
        9⤵
        
        PID:11388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39149.exe
        9⤵
        
        PID:3300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47405.exe
        8⤵
        
        PID:11180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50090.exe
        8⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65458.exe
        8⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8652.exe
        7⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6385.exe
        8⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23528.exe
        8⤵
        
        PID:10316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6179.exe
        8⤵
        
        PID:13968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27063.exe
        7⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2480.exe
        7⤵
        
        PID:11752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5455.exe
        7⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27738.exe
        7⤵
        
        PID:9172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1392.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55570.exe
        7⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13733.exe
        8⤵
        
        PID:8348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
        8⤵
        
        PID:12112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17575.exe
        8⤵
        
        PID:3564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9224.exe
        8⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-884.exe
        7⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41732.exe
        7⤵
        
        PID:11700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6783.exe
        6⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26814.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43199.exe
        7⤵
        
        PID:15656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35041.exe
        6⤵
        
        PID:7824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25091.exe
        6⤵
        
        PID:12896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49974.exe
        6⤵
        
        PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40312.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-453.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46442.exe
        7⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26318.exe
        8⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10721.exe
        9⤵
        
        PID:11276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30736.exe
        9⤵
        
        PID:14972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43583.exe
        9⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1948.exe
        8⤵
        
        PID:9468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30579.exe
        8⤵
        
        PID:12680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1816.exe
        8⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33806.exe
        8⤵
        
        PID:14528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20236.exe
        8⤵
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21008.exe
        7⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19331.exe
        7⤵
        
        PID:11008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56393.exe
        7⤵
        
        PID:14656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16717.exe
        7⤵
        
        PID:6084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12544.exe
        6⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32862.exe
        7⤵
        
        PID:10556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20456.exe
        7⤵
        
        PID:14592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30755.exe
        7⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32457.exe
        6⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17596.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54895.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32593.exe
        6⤵
        
        PID:15032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15127.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-173.exe
        6⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14833.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23734.exe
        8⤵
        
        PID:10352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47893.exe
        8⤵
        
        PID:14500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10692.exe
        7⤵
        
        PID:9784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54700.exe
        7⤵
        
        PID:13568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62809.exe
        6⤵
        
        PID:7540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38304.exe
        6⤵
        
        PID:8876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31017.exe
        6⤵
        
        PID:12312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32669.exe
        6⤵
        
        PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31377.exe
        5⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45446.exe
        6⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27891.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21533.exe
        6⤵
        
        PID:14520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28347.exe
        5⤵
        
        PID:2236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28940.exe
        6⤵
        
        PID:720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42816.exe
        5⤵
        
        PID:11764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28613.exe
        5⤵
        
        PID:6716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33732.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23038.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18326.exe
        6⤵
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43998.exe
        8⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43053.exe
        9⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11879.exe
        8⤵
        
        PID:12272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45890.exe
        8⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50365.exe
        7⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4281.exe
        8⤵
        
        PID:12376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28815.exe
        8⤵
        
        PID:1932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55259.exe
        8⤵
        
        PID:15808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35668.exe
        7⤵
        
        PID:11120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3300.exe
        7⤵
        
        PID:14728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62374.exe
        7⤵
        
        PID:15440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12544.exe
        6⤵
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52986.exe
        7⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51924.exe
        7⤵
        
        PID:12776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23702.exe
        7⤵
        
        PID:16004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24323.exe
        6⤵
        
        PID:8860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49709.exe
        6⤵
        
        PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22964.exe
        5⤵
        
        PID:776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50526.exe
        6⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6857.exe
        7⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19650.exe
        8⤵
        
        PID:10308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51977.exe
        8⤵
        
        PID:14472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59005.exe
        8⤵
        
        PID:15936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29960.exe
        7⤵
        
        PID:9624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34087.exe
        7⤵
        
        PID:13460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62509.exe
        7⤵
        
        PID:4552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54833.exe
        6⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41998.exe
        7⤵
        
        PID:12804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe
        7⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29855.exe
        6⤵
        
        PID:10440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22761.exe
        6⤵
        
        PID:14548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55835.exe
        6⤵
        
        PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26279.exe
        5⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62742.exe
        6⤵
        
        PID:8388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-176.exe
        6⤵
        
        PID:12148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6836.exe
        5⤵
        
        PID:9132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12071.exe
        5⤵
        
        PID:11272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21386.exe
        5⤵
        
        PID:6528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53664.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50998.exe
        5⤵
        
        PID:1320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30106.exe
        6⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34486.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58910.exe
        8⤵
        
        PID:12656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45309.exe
        8⤵
        
        PID:14380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22368.exe
        7⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42797.exe
        7⤵
        
        PID:13992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31720.exe
        7⤵
        
        PID:6692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16924.exe
        6⤵
        
        PID:7356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42469.exe
        7⤵
        
        PID:15960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54360.exe
        6⤵
        
        PID:9572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45180.exe
        6⤵
        
        PID:14468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42088.exe
        6⤵
        
        PID:16128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12544.exe
        5⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28586.exe
        6⤵
        
        PID:10856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20456.exe
        6⤵
        
        PID:14608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64205.exe
        6⤵
        
        PID:15520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49212.exe
        5⤵
        
        PID:8560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7524.exe
        5⤵
        
        PID:10652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37985.exe
        5⤵
        
        PID:15568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58901.exe
      4⤵
      PID:2244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34190.exe
        5⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14833.exe
        6⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56414.exe
        7⤵
        
        PID:11556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6250.exe
        7⤵
        
        PID:16020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2524.exe
        6⤵
        
        PID:9744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54700.exe
        6⤵
        
        PID:13840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44626.exe
        6⤵
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25560.exe
        6⤵
        
        PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62809.exe
        5⤵
        
        PID:7532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63192.exe
        5⤵
        
        PID:8824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60181.exe
        5⤵
        
        PID:11816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20801.exe
        5⤵
        
        PID:15768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23479.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62742.exe
        5⤵
        
        PID:8376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-176.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13156.exe
      4⤵
      PID:8884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41574.exe
      4⤵
      PID:11604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9727.exe
      4⤵
      PID:3640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6333.exe
      4⤵
      PID:5624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26804.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26804.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33370.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64454.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50614.exe
        6⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55570.exe
        7⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35830.exe
        8⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42958.exe
        9⤵
        
        PID:13248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5521.exe
        9⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6416.exe
        8⤵
        
        PID:10016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10316.exe
        8⤵
        
        PID:14380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33785.exe
        8⤵
        
        PID:15584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33260.exe
        7⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19082.exe
        8⤵
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58557.exe
        8⤵
        
        PID:15280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2364.exe
        8⤵
        
        PID:16096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19584.exe
        7⤵
        
        PID:11576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8281.exe
        7⤵
        
        PID:13868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58585.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54382.exe
        7⤵
        
        PID:8508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4452.exe
        7⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13884.exe
        7⤵
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29175.exe
        6⤵
        
        PID:8080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33757.exe
        6⤵
        
        PID:12844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52285.exe
        5⤵
        
        PID:4328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19198.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45446.exe
        7⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30670.exe
        8⤵
        
        PID:884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12237.exe
        8⤵
        
        PID:15496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20980.exe
        7⤵
        
        PID:11932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13884.exe
        7⤵
        
        PID:5112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48113.exe
        6⤵
        
        PID:8576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59028.exe
        6⤵
        
        PID:12280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3889.exe
        6⤵
        
        PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7167.exe
        5⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35986.exe
        6⤵
        
        PID:10380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47893.exe
        6⤵
        
        PID:14508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52160.exe
        6⤵
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43770.exe
        6⤵
        
        PID:17336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53261.exe
        5⤵
        
        PID:9268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38016.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61374.exe
        5⤵
        
        PID:6464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40696.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6805.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35534.exe
        6⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2353.exe
        7⤵
        
        PID:10116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64805.exe
        7⤵
        
        PID:13420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33275.exe
        7⤵
        
        PID:904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
        7⤵
        
        PID:16820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1844.exe
        6⤵
        
        PID:8420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9827.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3889.exe
        6⤵
        
        PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37048.exe
        5⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24258.exe
        6⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47058.exe
        7⤵
        
        PID:1244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48504.exe
        6⤵
        
        PID:12480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24323.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47137.exe
        6⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26435.exe
        5⤵
        
        PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8089.exe
        5⤵
        
        PID:6496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17011.exe
      4⤵
      PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6369.exe
        5⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32426.exe
        6⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33114.exe
        7⤵
        
        PID:15168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47058.exe
        7⤵
        
        PID:1644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40632.exe
        6⤵
        
        PID:11540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41504.exe
        6⤵
        
        PID:15228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22052.exe
        6⤵
        
        PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13328.exe
        5⤵
        
        PID:7196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33757.exe
        5⤵
        
        PID:12852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8089.exe
        5⤵
        
        PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45321.exe
      4⤵
      PID:6308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
        5⤵
        
        PID:10768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36792.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1437.exe
        5⤵
        
        PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30651.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30651.exe
      4⤵
      PID:8660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22728.exe
      4⤵
      PID:12220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5433.exe
      4⤵
      PID:5336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59912.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59912.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46893.exe
      4⤵
      PID:208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60230.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1097.exe
        6⤵
        
        PID:8304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8920.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17759.exe
        6⤵
        
        PID:14840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11312.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13837.exe
        6⤵
        
        PID:16796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26540.exe
        5⤵
        
        PID:7608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51052.exe
        5⤵
        
        PID:12032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16873.exe
        5⤵
        
        PID:15376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23887.exe
      4⤵
      PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
        5⤵
        
        PID:9320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55485.exe
        5⤵
        
        PID:13708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16223.exe
        5⤵
        
        PID:4216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44626.exe
        5⤵
        
        PID:7340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5332.exe
        5⤵
        
        PID:16228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3136.exe
      4⤵
      PID:7796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22351.exe
      4⤵
      PID:12336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34376.exe
      4⤵
      PID:2432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36869.exe
      4⤵
      PID:15228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35793.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35793.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27034.exe
      4⤵
      PID:3584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50334.exe
        5⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53422.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18558.exe
        7⤵
        
        PID:12136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30224.exe
        7⤵
        
        PID:15752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27891.exe
        6⤵
        
        PID:12876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19932.exe
        6⤵
        
        PID:14496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47396.exe
        6⤵
        
        PID:4412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22586.exe
        6⤵
        
        PID:12748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28896.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42116.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45534.exe
        5⤵
        
        PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61928.exe
        5⤵
        
        PID:16832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12544.exe
      4⤵
      PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
        5⤵
        
        PID:11468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38393.exe
        5⤵
        
        PID:15728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57764.exe
      4⤵
      PID:8596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64893.exe
      4⤵
      PID:12276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61374.exe
      4⤵
      PID:3708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63412.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63412.exe
    3⤵
    PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23282.exe
      4⤵
      PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30698.exe
        5⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32465.exe
        6⤵
        
        PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2088.exe
        5⤵
        
        PID:10984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6179.exe
        5⤵
        
        PID:12752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49472.exe
        5⤵
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48399.exe
        5⤵
        
        PID:15600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17220.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49900.exe
      4⤵
      PID:11724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37558.exe
      4⤵
      PID:2188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53369.exe
    3⤵
    PID:6796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43616.exe
      4⤵
      PID:13592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14805.exe
      4⤵
      PID:15400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12069.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12069.exe
    3⤵
    PID:6544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6779.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6779.exe
    3⤵
    PID:12468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32352.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32352.exe
    3⤵
    PID:15300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51258.exe
    3⤵
    PID:1296
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41168.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41168.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17890.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17890.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43821.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18326.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1133.exe
        6⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43998.exe
        7⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50566.exe
        8⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6416.exe
        7⤵
        
        PID:10024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6231.exe
        7⤵
        
        PID:13816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38004.exe
        7⤵
        
        PID:16344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29944.exe
        6⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53026.exe
        7⤵
        
        PID:2644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30301.exe
        7⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35668.exe
        6⤵
        
        PID:10452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47841.exe
        6⤵
        
        PID:14796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59535.exe
        6⤵
        
        PID:14288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12544.exe
        5⤵
        
        PID:5380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36806.exe
        6⤵
        
        PID:9252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57352.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62509.exe
        6⤵
        
        PID:1768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12263.exe
        5⤵
        
        PID:8944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12184.exe
        5⤵
        
        PID:11868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26074.exe
        5⤵
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8165.exe
        5⤵
        
        PID:15664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40784.exe
      4⤵
      PID:652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32772.exe
        5⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1481.exe
        6⤵
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33232.exe
        6⤵
        
        PID:11976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17575.exe
        6⤵
        
        PID:15280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63085.exe
        6⤵
        
        PID:1220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-971.exe
        5⤵
        
        PID:9124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43239.exe
        6⤵
        
        PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20736.exe
        5⤵
        
        PID:12004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29817.exe
        5⤵
        
        PID:15640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32145.exe
      4⤵
      PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54382.exe
        5⤵
        
        PID:8500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4452.exe
        5⤵
        
        PID:12212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17575.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
        5⤵
        
        PID:4488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49440.exe
      4⤵
      PID:9376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28310.exe
      4⤵
      PID:12360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9153.exe
      4⤵
      PID:15816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53769.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53769.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24574.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52617.exe
        5⤵
        
        PID:6000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8549.exe
        6⤵
        
        PID:10672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36792.exe
        6⤵
        
        PID:14688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59535.exe
        6⤵
        
        PID:15044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40468.exe
        5⤵
        
        PID:8252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1037.exe
        5⤵
        
        PID:15416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11776.exe
      4⤵
      PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60682.exe
        5⤵
        
        PID:10360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40108.exe
        5⤵
        
        PID:14140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe
        5⤵
        
        PID:5260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65164.exe
      4⤵
      PID:8224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14753.exe
        5⤵
        
        PID:12800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60712.exe
        5⤵
        
        PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13108.exe
        5⤵
        
        PID:16876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
      4⤵
      PID:12060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65458.exe
      4⤵
      PID:3312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63368.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63368.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4641.exe
      4⤵
      PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47506.exe
        5⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54382.exe
        6⤵
        
        PID:8468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53269.exe
        6⤵
        
        PID:12180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17575.exe
        6⤵
        
        PID:13584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13884.exe
        6⤵
        
        PID:4092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36820.exe
        5⤵
        
        PID:7484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-198.exe
        6⤵
        
        PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38556.exe
        5⤵
        
        PID:13244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10148.exe
        5⤵
        
        PID:15364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29944.exe
      4⤵
      PID:7580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54021.exe
        5⤵
        
        PID:5588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6948.exe
      4⤵
      PID:11584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12749.exe
      4⤵
      PID:14816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63089.exe
    3⤵
    PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9841.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29340.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17584.exe
      4⤵
      PID:15800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37475.exe
    3⤵
    PID:7480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27632.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27632.exe
    3⤵
    PID:11968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32697.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32697.exe
    3⤵
    PID:7020
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13540.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13540.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43821.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43821.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:64
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50806.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14153.exe
        5⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63702.exe
        6⤵
        
        PID:8540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33703.exe
        6⤵
        
        PID:13260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42088.exe
        6⤵
        
        PID:16152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17412.exe
        5⤵
        
        PID:7244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7229.exe
        6⤵
        
        PID:15688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62152.exe
        5⤵
        
        PID:11780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17760.exe
        5⤵
        
        PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19101.exe
        5⤵
        
        PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42056.exe
      4⤵
      PID:6336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37382.exe
        5⤵
        
        PID:8432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16844.exe
        5⤵
        
        PID:13360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37536.exe
      4⤵
      PID:8980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47929.exe
      4⤵
      PID:11760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
      4⤵
      PID:5552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16279.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16279.exe
    3⤵
    - Executes dropped EXE
    PID:908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1133.exe
      4⤵
      PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6857.exe
        5⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53282.exe
        6⤵
        
        PID:10624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36792.exe
        6⤵
        
        PID:14860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63619.exe
        6⤵
        
        PID:15720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26068.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5464.exe
        5⤵
        
        PID:1056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8643.exe
        5⤵
        
        PID:16808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33260.exe
      4⤵
      PID:7388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62528.exe
      4⤵
      PID:10196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18868.exe
      4⤵
      PID:13436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57843.exe
      4⤵
      PID:17364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32145.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32145.exe
    3⤵
    PID:1872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52986.exe
      4⤵
      PID:8344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51924.exe
      4⤵
      PID:12840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe
      4⤵
      PID:5508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63708.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63708.exe
    3⤵
    PID:9188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61073.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61073.exe
    3⤵
    PID:12028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11800.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11800.exe
    3⤵
    PID:2360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39942.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39942.exe
    3⤵
    PID:15744
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3635.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3635.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48886.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48886.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31694.exe
      4⤵
      PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48082.exe
        5⤵
        
        PID:6872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56362.exe
        6⤵
        
        PID:12716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36156.exe
        5⤵
        
        PID:10072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63408.exe
        5⤵
        
        PID:13944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14628.exe
        5⤵
        
        PID:3352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15726.exe
        5⤵
        
        PID:15424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18268.exe
      4⤵
      PID:7740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24280.exe
        5⤵
        
        PID:1732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15823.exe
      4⤵
      PID:11184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12044.exe
      4⤵
      PID:14136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33806.exe
      4⤵
      PID:1728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21916.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21916.exe
    3⤵
    PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61922.exe
      4⤵
      PID:6348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35986.exe
        5⤵
        
        PID:10388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56445.exe
        5⤵
        
        PID:14528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7228.exe
        5⤵
        
        PID:524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37204.exe
      4⤵
      PID:8284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57789.exe
      4⤵
      PID:12812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43972.exe
      4⤵
      PID:5212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44692.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44692.exe
    3⤵
    PID:5932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32862.exe
      4⤵
      PID:10640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20456.exe
      4⤵
      PID:14600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51221.exe
      4⤵
      PID:15988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49561.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49561.exe
    3⤵
    PID:9596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31287.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31287.exe
    3⤵
    PID:13428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16257.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16257.exe
    3⤵
    PID:3704
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7276.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7276.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21362.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21362.exe
    3⤵
    PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57646.exe
      4⤵
      PID:6240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43194.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7436.exe
        5⤵
        
        PID:13136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10721.exe
        5⤵
        
        PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52773.exe
      4⤵
      PID:9196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14871.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14871.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39393.exe
      4⤵
      PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21468.exe
      4⤵
      PID:16756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30956.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30956.exe
    3⤵
    PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41030.exe
      4⤵
      PID:10612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36792.exe
      4⤵
      PID:14648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45136.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45136.exe
      4⤵
      PID:3636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3282.exe
      4⤵
      PID:16104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32019.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32019.exe
    3⤵
    PID:9520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36445.exe
    3⤵
    PID:13376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10889.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10889.exe
    3⤵
    PID:4088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4621.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4621.exe
    3⤵
    PID:15392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23241.exe
  2⤵
  PID:5964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52166.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52166.exe
    3⤵
    PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18366.exe
      4⤵
      PID:13232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17972.exe
      4⤵
      PID:6476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19052.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19052.exe
    3⤵
    PID:9928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35204.exe
    3⤵
    PID:13648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5140.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5140.exe
    3⤵
    PID:6780
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8203.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8203.exe
  2⤵
  PID:7748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26534.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26534.exe
    3⤵
    PID:11800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35417.exe
    3⤵
    PID:15576
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52224.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52224.exe
  2⤵
  PID:10904
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38228.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38228.exe
  2⤵
  PID:15356
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50061.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50061.exe
  2⤵
  PID:4124
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28301.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28301.exe
  2⤵
  PID:15560

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
1⤵
PID:2188

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11937.exe

Filesize
468KB

MD5
95eb94546c4fd02efd5f0f2389f346b8

SHA1
5f1c5ab769fc795a72da7f069bb44ed5b872a435

SHA256
36306dbf5bbb9c7ba5af1c060045e3fe736a88ebbd4f310f70474eae22357225

SHA512
0282cba22897e90a99c373df14e79f14dd4e723ab497898709fef342eb52f644eb72ec99bf3bf01c37fa78b03da62c2c478973510d4dd1a8e6564ad7b41f6b39

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13540.exe

Filesize
468KB

MD5
e8d5c33fd585c83a28ef2ba3b2e219c4

SHA1
c1566cd9c5d1d2c8724e20f41a754f7fd2992660

SHA256
1297ad4a879712490e742d7abef4cb88cdf0a3e20a923fb08517504b87265068

SHA512
2d6b215381b43f8756bd74da700c52c6a37cd9f9233ace2065ee7814c24894272c038a8f15f3650c2fba175f042631cf42d3da6171afc60ea517dae682a1668a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14329.exe

Filesize
468KB

MD5
3cc07745602ec2d185a96f9454ef86fb

SHA1
f6a5c2aeb59289cb812466160dbdf49e4395d428

SHA256
eb905f429c7f1a1afc7f55016072f512f3b9cca2a0b40b9206407c1daec6daa5

SHA512
ba0864185a31416a89428ced1a86b0062d4e4b84401cd72afdfdb3d3170a7e9adb601e839f1e4e3153a018d05ee0b3a8ac439c3aa108aa51591bc2d53d6a37c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17890.exe

Filesize
468KB

MD5
2e72241eccde4a3d13eee934ffcfc713

SHA1
470df04ac9fad9756a1a0c419095ee8098a48034

SHA256
c1c14ccfc2f8b4298681212ea76a8712c41ae34594c30574da3d6a4e6078d430

SHA512
cf0b915c6f3e571f9f29a39905c7f25800ce45714ee8c13ac959701be3cbd9c2188054c695129fbebb3709f16cecabc5e1b5eae5f4e18e6d4539de59c8f87db5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20734.exe

Filesize
468KB

MD5
afbb5754ba38a79f8444d36ba18cb13b

SHA1
202b8dd256f3c109a5f8123940b87b8e1b351ddf

SHA256
ccf96b36c030313071e056d21b89439b242320a08e59e255e8b57ce1e85b7bc0

SHA512
617b1b87e4b811de30ab6ffae445564617125ef6e358487781bf6098bfbdb4ac4fc946f42808cf32bf4dac26595b0788b74a6311a58e40219eb0ad1f7229c219

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21590.exe

Filesize
468KB

MD5
201a8cfff98cc836b184f981ccf1e51b

SHA1
b6da31be517de62de27c2511bf43aa1145ec2e65

SHA256
4fd9bf81d48fc088d0565f7a8db27304b69220541cb7acc9500e23f3edfb70ac

SHA512
087b11d39995a2ce0d62e0e9f739a74b28c2fa998cfb8fac75fde8d597fa3507e20a11e6b7da8693f61d34da122830ccafca27aca2c938c6de1f8ad0327970c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26228.exe

Filesize
468KB

MD5
2e33fe3b2596aacaa4dce86ea4e5951a

SHA1
9ad743df33606043e7f8d9cd5cf24454f6ca915f

SHA256
cc149d8604482292c6f576130cac5759296ef97534c59e60320a5e8b0b63550c

SHA512
15b24c366c1eff13675ed123f84f639376fce9479512228453843f6965952ef26c26d49fdd5b6b2793cd7af09ef9233943370d34480e9330d3af8cb02278df75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26804.exe

Filesize
468KB

MD5
faba2b78e0c41831416477ae055400ac

SHA1
c44d9a5835e9e3f83394a91ef4cecac8765096f6

SHA256
3db0d298e10ed1a91ba46a1a10e8b1f3f3c97baf6505cf0c1e98c02aa2bd99a1

SHA512
fd7b4e39ae6079e438ac1834e93111a38abb66738f5ad2b797e8bbd608639f6bb326e8d8ce3fcd45541400e30524ad126f77db7c6fb776c348d6f6e8bd2e46f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29094.exe

Filesize
468KB

MD5
cf4e7e0da08c06108052368fd02f83a3

SHA1
050fa374d6d9f954e1b90c4050f67c10d709767f

SHA256
eb19f7d07ab722be11c846843bd1d10fee1f33db8423170bebd34b4fdb086d16

SHA512
87557800bfa5a40049ae6ebebb8175d9100eab0032cbeec79a5bb8ed84934226683440126dcbe0219e2792cf7c272f9c540b37bf0de90c0f0c615278343be4f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33370.exe

Filesize
468KB

MD5
051f615e04a98cae8511df2ac816986a

SHA1
f55e2c0d4144971dcba8d1f6cceb28d46a06fdfe

SHA256
243de6f04574aed738b57a63dd35d430c9078011ec641b7736aae8766dd336c9

SHA512
702dbf8fd62b8b7b5dfc0c00ae72718ecdf9b35c06767d5c96064c3d3b34bd59173ac237880d9a96de45c9c53d7126a070aab79b04c769f88d7a389809506d50

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33732.exe

Filesize
468KB

MD5
b5a78043faf9d2e01daf508a318c7a05

SHA1
8e41457aa68fe96c74629575a5f33c1c657e0545

SHA256
f0813f674cbc99cedb4e981440db8f6b7a1e211a249e28e9839f25dd06b1b560

SHA512
5d56b9c990979f19ee06758f9c5183f5bb3956d73903f8aedcbff36b5bec3a45b43b60bd59dd7b764196e853da1a572fec87cc3f7d020602a7157b3b36016a85

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35023.exe

Filesize
468KB

MD5
ea1df458fd1b2fff42c81b375b4e4a44

SHA1
331a335dc60160fd6dc8e221aa0069f1fd014689

SHA256
7123c36fc7d0616fe9fedfe03037ca917ad6f423b86b717d1992678fa7d827a7

SHA512
41c68c00282c87da51091a679a189a1ff4fcf94664aa0a36201dd018d7b960675301c756cdb28facfcd9abfaa589321893227a9b5db0041b6176df7ee605ed81

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3635.exe

Filesize
468KB

MD5
0059b1fa77e762c0543192073d097030

SHA1
5a22a4b5496cc3c1fca739067688d4c0185cc658

SHA256
fbac0eb36b9ea77af5675d62f44db1db0de18e7e7356c83dccdbd5ad960ebaee

SHA512
69b9aa70b4a2ab95f696d14ceaae4340cdf727d7151f27d94c70b949f9f7a7178697d417955a7e592d933772c7dec7e55cdb833bbf811d8c85a0ee231978a974

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37224.exe

Filesize
468KB

MD5
532d643ad7832c0bd8c304e9d7be2600

SHA1
8e498437346de8eab7260d1d8d3870de01c04b70

SHA256
760081e11cf8ae839644c12ebb613225e5720535fe79b88561441584addf9331

SHA512
8db3c2e3586ebad1c778d480fdeb2d04d29bb1741c1438552a8b1ac568406e22491969d429cc04d49ed90ad1f15914e4ff5b1ecfccf687355f92058241ac21f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38502.exe

Filesize
468KB

MD5
44a3567a666a785f80ebf9a40f471e9f

SHA1
7714458b5ce354c20566c3a902fe1ff8bc7a8099

SHA256
175c1db4d19aff78210c5d236bd317e0b2d90155b865bdfe45344f04bc4e8c4f

SHA512
b2fe3b4b9a7a9f58a2a5e1c0b65a73a7c67a44f2615712bd6ce7ff71d7f37fe97734bf7a6077e1ab3a824a5113ce159b1f21df14565b4cc5d10e01055694eb2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39130.exe

Filesize
468KB

MD5
147ff50215d42027db8435bccc908fba

SHA1
173812f44e36b42f6f8f8642577fb75fe3feebbb

SHA256
973e50044ad41d464b6282f2716b5226b758bae74dd3188bdb5b45b3220417bc

SHA512
ab169ad9ab2bac9d73bc1bec2a1201a4605e59cdf10343cf798c6c7cdee7df3f906719f1b908d9406a6352beec670e8c1d9c6e29e3a9e09cb40d2565093bb3c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39684.exe

Filesize
468KB

MD5
0a8e5b3d94a8dfb2f6649a9782ab6152

SHA1
92b7a9d1d7b418160da976a3e938cea0e875404d

SHA256
c0deda1ffffde72123cacd293965e4d0e0d2de8615e765742c3039e35a99adde

SHA512
cc7a5e693b65c72518dfdfb72e968aa242f003c88766ad8541d82f6c453229338262e486984f554dfe5942b1df4a6df8905874b0f5f358f6e94cb2722e343dfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39964.exe

Filesize
468KB

MD5
d53b77e2b9d56c846f3dd4b3d4d7a93b

SHA1
200aab98f7cbf3833ea596390c81e7fae6869d3f

SHA256
9c98ebfb0d98d0c82b7cb814fa0773b4f4044f990f78dc0d6cc0b4a48830eb01

SHA512
030380959e8e759a64d2750adbebeeb4018cecdf1ca06a8bebdded287d04e7168a985580ea0c4f30f32166b0f97955a31820ff02a6bcc6ac5824ca8f9b3da73a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40312.exe

Filesize
468KB

MD5
8cfb8b2e2c65d36d0d063fdb957e66df

SHA1
be57896d1d3cc2381bb50f125bb5d8ce5e9a1bfc

SHA256
16ec231f9b12af3869d9eac3604725dbc59cf40f8baafc0b218c23df241dd57b

SHA512
3415db9899a4d79da767cc08e53ab914385aeead28c5266079863db5c9bb7027abfc1e1ba10ab88c91fa77ce475afd296965f33287c817f9d4c298168837a2f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41154.exe

Filesize
468KB

MD5
b86441667d361293cf49ef4f0885e8d2

SHA1
7d7bdf6abf4e2c0e059c057cb9ea7a1636ce2942

SHA256
10a3a395071b71aac7482aed655d3b235a384d9bb57b7caad5f28a95786407e9

SHA512
254036c296b5085aaeb5dedc8372e93d0ebafb0b3be3266c8c12d13870dd46fbccf61a451e5ad310d08bb3f35c385b4ca27bf4cd6cfc4aeb0cce0d5fe44d5b7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41168.exe

Filesize
468KB

MD5
7d1160683423e9d322f65072d05b066d

SHA1
2aa592f750f4b370bda9832eae759eaffb26059a

SHA256
e8232c0bb71a90d9a2af81dc8703edeabab82b135c8efca2c2cbcc62700b2453

SHA512
fd1f45aae8f94fcac985427d4bdf7d7aa0421d0edb6854b2fc3fb61e9c9b15893b444feb8a3110a293b43b33990e163dae759c8703fe7e7bf0ffe437eda3f88e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43842.exe

Filesize
468KB

MD5
039b1697ec3ebeef799acc9b733fa935

SHA1
03a759818aea7abc5b88eddf3eaa7815d1b79e23

SHA256
f57a64b2252ff6f6432409596352486766a668b3c29c91509055c3add761d501

SHA512
9d26d50aef360486a2cb881249bec183ef5eecd2b6cd1ff89b619d1cb7c0c8abc41cf3ece9792676de91018ea26daab9e457b9c48991353c4052af001c10612e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44973.exe

Filesize
468KB

MD5
9e8ffd0eaed7d53acdfa882230adc442

SHA1
88906f9c9f6cbd9c4a94d1e52889ddb612ac7994

SHA256
6a441cecfa85f5fb862e6ca8f0166873a241659d943f959ca30979691507c47c

SHA512
ecf5d2110e14b5cedf1d571d308889ed1cc0ec97a6dfe6ead194d31134066d0d8b94ea1fc094d3c920195f8ca72707e53250639226b7927176cb8fc05e6d086e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46177.exe

Filesize
468KB

MD5
f11e98a960eac6d00ab23fae217281dd

SHA1
17c94266d5bfb3dbdbde4c6180233a558d5de719

SHA256
01d9d9bd63955e82d0833c136d1a385f7d8a90f33efa32467abb3efed8318d27

SHA512
8174c71e7f772acc663deb4104671ff316bfe6e38530eaf6de66c3e5ab630bd837f53306917fd44a6a43acf7cb3937b04a73f5d203f4e4cc5e51b611455f7b8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49685.exe

Filesize
468KB

MD5
50bdad0a07629726a0da0f4bc297e116

SHA1
777c44689e56fe329bbb3c6ec00e1fdf32f4b825

SHA256
4e95f035e1e621210fe0d5b3a14e1d1a65d9a2965eab721afff2a8571aa89989

SHA512
bc79e109a84bfb9862785ddd293ede293775a8c3f52c928b9b0c1342734013eaf40af2f9a3a6e534b2baa1802faf404384ae57633eede4431ee92e3113bdbba2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49706.exe

Filesize
468KB

MD5
c8914a2af102d8070cd5bd5f40bc3dc1

SHA1
555a98aceed661aed88b47fd0f7e2972273272b6

SHA256
1800f058b29f4b3e363c6695c83a2fb9107a7863f6d722ea04da74bc8b1322e6

SHA512
706b8fdac2b4aad4748715990024e7df1212edb8d17b905b76440602005abf2e8a64719ad1984ab86e54b9cfbd238521cca50e3fa7b3f67b7aca19adaaa41d33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53041.exe

Filesize
468KB

MD5
2f3251d43bcd152a612a380b6a229bac

SHA1
980cb9b7dc633663f7ef1b55797531e0ec4ca651

SHA256
5be9be26507538d04d856135c9f62ae5a0fbdc3828aaa6c7e201a94375edcf29

SHA512
be2235d3bb08c71cfa46a4d9e6caf948a28b4ffe503303dcfcbbeedf5fe417a374e3e6e2c54d79133cd94eefb1b334b06df26b288dc5e8d3f8808dcebaecb43c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53769.exe

Filesize
468KB

MD5
f8e94affb76e60c8a16e662e2083464a

SHA1
b9f6bea87742bbbeb1688945f72b8ac70b1c3eaa

SHA256
05b25f9692bfb9bec7b07ba05da38a49e979f1d63e00480d72c021070ea3a14d

SHA512
8b506c7a0a3338a6ed439cfd2a9c8a7f63ef5b8255b7fdd698db36bb124aa90d09ddf491b9838c55b5c58b8e4d2b4334ee8b44b5736309e7b94a72f82b394ebf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57090.exe

Filesize
468KB

MD5
1a3e126640b21e5a81e8c1c23426b521

SHA1
8edac265dd17b7ae518f0ada538cfd6f7daf5587

SHA256
7c3136a8dd0cb45fb6fcab8504a732835179f219c44ae811b43b827319cdcb8d

SHA512
a355f65a70c2d9d7f727aa42c47859021e81506f64453b8d281da45965b9b252a731cfa0f9792b0f6b5870a4248a3b7d039b2579455d4de8df81089e5c4c97eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59550.exe

Filesize
468KB

MD5
34ae77e5a75c5a346e7368360f469f16

SHA1
cc3bf03049e59385d07a629cda731994809ab145

SHA256
e800b4ddf618f343c71bcc2ec3797e49c4a5335edc942a8ac33cd343b14acde2

SHA512
27c37668950fdd35bb5f21328e9f973aa83d032db7c684621714a90f71ae2fab5a8fb4ffba412d19dc0acb26ffb35777c86038bb558ec19c61f778cfa768706f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59912.exe

Filesize
468KB

MD5
0ea6a2745d1e2a29b6defdc0ab2768b6

SHA1
45983895df7f991dfefb7476ca922139f68189f8

SHA256
2518bf176570adce66eda9630786b9de68dd3e2a67fb2f4b94760ecd817966ff

SHA512
fd2137e56c85c410af200ecc3463fb67f3d8161e5abf7e16d85dfccc63f7ef565a93abc8cdf3ec5479ca5ce2f0b516533c616447445254af0428b40f77547c96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61382.exe

Filesize
468KB

MD5
f5bca824f9690fa380c3913364404bed

SHA1
c5203580553ee50fc1f9c5741d7c734516a7a03f

SHA256
9b5d574e6191581abd2867d4c9699ba6329239851307d886a22d3125b336291a

SHA512
2d526fa521fdc616d689611d775c214913e114f85b296813c310d260920c0bff000d8715a850e01e392278dce2647bf628a5f712722dc40ef9299ae5a3e015b4

Download Submit
memory/64-223-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/208-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/324-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/412-32-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/456-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/524-3836-0x00007FFAC86C0000-0x00007FFAC8743000-memory.dmp

Filesize
524KB

Download
memory/652-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/680-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/708-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/776-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/808-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/832-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/844-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/908-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/952-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1124-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1236-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1276-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1320-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1340-480-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1400-493-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1484-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1492-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1536-47-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1552-424-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1688-494-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1772-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1804-3141-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1876-310-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1908-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1916-443-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1976-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1980-54-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1984-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2208-193-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2244-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2344-490-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2364-99-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2380-444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2452-194-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2620-109-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2692-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2700-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2704-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2924-60-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3044-492-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3116-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3144-96-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3164-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3196-83-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3208-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3328-446-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3344-1045-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3504-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3576-140-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3584-442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3740-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3768-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3796-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3848-26-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3996-196-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4020-137-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4120-1041-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4144-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4264-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4280-164-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4284-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4288-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4328-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4364-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4376-481-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4400-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4432-1042-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4468-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4476-78-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4528-117-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4572-3461-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4600-211-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4600-3847-0x00007FFAC86C0000-0x00007FFAC8743000-memory.dmp

Filesize
524KB

Download
memory/4708-491-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4712-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4728-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4760-221-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4764-138-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4776-71-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4800-17-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4820-3271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4876-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4964-463-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4980-379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4992-15-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5064-163-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5132-1047-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5140-1044-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5152-1048-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5172-1049-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5216-1051-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5228-1050-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5236-1052-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5244-1053-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5424-1054-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/7068-3322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14508-3460-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14592-3178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14656-3236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14700-3200-0x00007FFAC81D0000-0x00007FFAC8229000-memory.dmp

Filesize
356KB

Download
memory/15024-3845-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15260-3553-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads