609eb73b7ff7b5745f79099f01c11d66959c7e3413e46e3a7b038479f86eda6c

Analysis

max time kernel
119s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-09-2024 19:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

609eb73b7ff7b5745f79099f01c11d66959c7e3413e46e3a7b038479f86eda6cN.exe
Size

468KB
MD5

5845332c440e68e71412d142ebbe2ed0
SHA1

141a04be89ac67d47861d0b624a224c5e142c1ec
SHA256

609eb73b7ff7b5745f79099f01c11d66959c7e3413e46e3a7b038479f86eda6c
SHA512

7fbb4eb5791bebbeca3cbe91505dc2f4567b4565e746a5d6b494070dc4442355e6f18eaeb712019b98d8b55b16ecc7dba080d3678825d576abb91cbac21b31b8
SSDEEP

3072:2eQfogCxjU8UdbY9Pz3Cqf8vXehjHDplMmHBvVdr/iT3VNjNhul3:2e8o1ZUd+PDCqfjdfz/iLjjNh

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4160	Unicorn-39031.exe
928	Unicorn-56519.exe
704	Unicorn-774.exe
2748	Unicorn-15569.exe
2356	Unicorn-4941.exe
5028	Unicorn-37059.exe
112	Unicorn-30928.exe
4796	Unicorn-10162.exe
4524	Unicorn-55834.exe
1908	Unicorn-31652.exe
2816	Unicorn-25521.exe
2260	Unicorn-11786.exe
2512	Unicorn-31652.exe
1136	Unicorn-31652.exe
2872	Unicorn-43639.exe
4944	Unicorn-65476.exe
1956	Unicorn-30151.exe
3096	Unicorn-39410.exe
2616	Unicorn-42517.exe
3624	Unicorn-64983.exe
3916	Unicorn-11698.exe
2912	Unicorn-34811.exe
3796	Unicorn-54677.exe
3348	Unicorn-54677.exe
4664	Unicorn-54677.exe
3460	Unicorn-50593.exe
4992	Unicorn-15517.exe
4396	Unicorn-19104.exe
1680	Unicorn-21904.exe
636	Unicorn-25574.exe
4984	Unicorn-51148.exe
1196	Unicorn-22.exe
4148	Unicorn-9814.exe
3464	Unicorn-23458.exe
2224	Unicorn-26564.exe
2284	Unicorn-2544.exe
4784	Unicorn-62928.exe
960	Unicorn-62928.exe
4424	Unicorn-23276.exe
3408	Unicorn-23541.exe
2456	Unicorn-30317.exe
3740	Unicorn-42569.exe
4544	Unicorn-62435.exe
2712	Unicorn-717.exe
4816	Unicorn-46654.exe
3500	Unicorn-982.exe
3376	Unicorn-28593.exe
1472	Unicorn-33655.exe
3364	Unicorn-41823.exe
1256	Unicorn-41823.exe
4416	Unicorn-23349.exe
4960	Unicorn-30125.exe
2924	Unicorn-42377.exe
1712	Unicorn-53313.exe
3084	Unicorn-14111.exe
2168	Unicorn-50960.exe
1208	Unicorn-49029.exe
4752	Unicorn-54630.exe
3936	Unicorn-2828.exe
532	Unicorn-57090.exe
5004	Unicorn-57090.exe
512	Unicorn-790.exe
2808	Unicorn-41714.exe
3888	Unicorn-40645.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2976	12056	WerFault.exe	607
19140	12056	WerFault.exe	607

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65294.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6815.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31455.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21934.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5794.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9814.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16292.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34506.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42935.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-935.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10058.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1474.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20801.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62513.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36827.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53006.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58792.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59694.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8813.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-909.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35497.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41875.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28741.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60828.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61981.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25246.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56976.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41107.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4952.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49851.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40645.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59643.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16712	dwm.exe
Token: SeChangeNotifyPrivilege	16712	dwm.exe
Token: 33	16712	dwm.exe
Token: SeIncBasePriorityPrivilege	16712	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3056	609eb73b7ff7b5745f79099f01c11d66959c7e3413e46e3a7b038479f86eda6cN.exe
4160	Unicorn-39031.exe
928	Unicorn-56519.exe
704	Unicorn-774.exe
2748	Unicorn-15569.exe
2356	Unicorn-4941.exe
5028	Unicorn-37059.exe
112	Unicorn-30928.exe
4796	Unicorn-10162.exe
2816	Unicorn-25521.exe
2872	Unicorn-43639.exe
2260	Unicorn-11786.exe
1136	Unicorn-31652.exe
1908	Unicorn-31652.exe
2512	Unicorn-31652.exe
4524	Unicorn-55834.exe
4944	Unicorn-65476.exe
1956	Unicorn-30151.exe
3096	Unicorn-39410.exe
2616	Unicorn-42517.exe
3916	Unicorn-11698.exe
3624	Unicorn-64983.exe
4984	Unicorn-51148.exe
636	Unicorn-25574.exe
1680	Unicorn-21904.exe
4396	Unicorn-19104.exe
3460	Unicorn-50593.exe
2912	Unicorn-34811.exe
3348	Unicorn-54677.exe
4664	Unicorn-54677.exe
3796	Unicorn-54677.exe
4992	Unicorn-15517.exe
1196	Unicorn-22.exe
4148	Unicorn-9814.exe
3464	Unicorn-23458.exe
2224	Unicorn-26564.exe
2284	Unicorn-2544.exe
960	Unicorn-62928.exe
4784	Unicorn-62928.exe
4424	Unicorn-23276.exe
3408	Unicorn-23541.exe
2456	Unicorn-30317.exe
3740	Unicorn-42569.exe
2712	Unicorn-717.exe
3500	Unicorn-982.exe
4544	Unicorn-62435.exe
4816	Unicorn-46654.exe
3376	Unicorn-28593.exe
1712	Unicorn-53313.exe
3364	Unicorn-41823.exe
2924	Unicorn-42377.exe
4960	Unicorn-30125.exe
3084	Unicorn-14111.exe
4416	Unicorn-23349.exe
512	Unicorn-790.exe
1256	Unicorn-41823.exe
532	Unicorn-57090.exe
2168	Unicorn-50960.exe
4752	Unicorn-54630.exe
1472	Unicorn-33655.exe
1208	Unicorn-49029.exe
3936	Unicorn-2828.exe
5004	Unicorn-57090.exe
2808	Unicorn-41714.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 4160	3056	609eb73b7ff7b5745f79099f01c11d66959c7e3413e46e3a7b038479f86eda6cN.exe	84
PID 3056 wrote to memory of 4160	3056	609eb73b7ff7b5745f79099f01c11d66959c7e3413e46e3a7b038479f86eda6cN.exe	84
PID 3056 wrote to memory of 4160	3056	609eb73b7ff7b5745f79099f01c11d66959c7e3413e46e3a7b038479f86eda6cN.exe	84
PID 4160 wrote to memory of 928	4160	Unicorn-39031.exe	87
PID 4160 wrote to memory of 928	4160	Unicorn-39031.exe	87
PID 4160 wrote to memory of 928	4160	Unicorn-39031.exe	87
PID 3056 wrote to memory of 704	3056	609eb73b7ff7b5745f79099f01c11d66959c7e3413e46e3a7b038479f86eda6cN.exe	88
PID 3056 wrote to memory of 704	3056	609eb73b7ff7b5745f79099f01c11d66959c7e3413e46e3a7b038479f86eda6cN.exe	88
PID 3056 wrote to memory of 704	3056	609eb73b7ff7b5745f79099f01c11d66959c7e3413e46e3a7b038479f86eda6cN.exe	88
PID 928 wrote to memory of 2748	928	Unicorn-56519.exe	90
PID 928 wrote to memory of 2748	928	Unicorn-56519.exe	90
PID 928 wrote to memory of 2748	928	Unicorn-56519.exe	90
PID 4160 wrote to memory of 2356	4160	Unicorn-39031.exe	91
PID 4160 wrote to memory of 2356	4160	Unicorn-39031.exe	91
PID 4160 wrote to memory of 2356	4160	Unicorn-39031.exe	91
PID 704 wrote to memory of 5028	704	Unicorn-774.exe	92
PID 704 wrote to memory of 5028	704	Unicorn-774.exe	92
PID 704 wrote to memory of 5028	704	Unicorn-774.exe	92
PID 3056 wrote to memory of 112	3056	609eb73b7ff7b5745f79099f01c11d66959c7e3413e46e3a7b038479f86eda6cN.exe	93
PID 3056 wrote to memory of 112	3056	609eb73b7ff7b5745f79099f01c11d66959c7e3413e46e3a7b038479f86eda6cN.exe	93
PID 3056 wrote to memory of 112	3056	609eb73b7ff7b5745f79099f01c11d66959c7e3413e46e3a7b038479f86eda6cN.exe	93
PID 2748 wrote to memory of 4796	2748	Unicorn-15569.exe	96
PID 2748 wrote to memory of 4796	2748	Unicorn-15569.exe	96
PID 2748 wrote to memory of 4796	2748	Unicorn-15569.exe	96
PID 928 wrote to memory of 4524	928	Unicorn-56519.exe	97
PID 928 wrote to memory of 4524	928	Unicorn-56519.exe	97
PID 928 wrote to memory of 4524	928	Unicorn-56519.exe	97
PID 112 wrote to memory of 1908	112	Unicorn-30928.exe	98
PID 112 wrote to memory of 1908	112	Unicorn-30928.exe	98
PID 112 wrote to memory of 1908	112	Unicorn-30928.exe	98
PID 4160 wrote to memory of 2816	4160	Unicorn-39031.exe	99
PID 4160 wrote to memory of 2816	4160	Unicorn-39031.exe	99
PID 4160 wrote to memory of 2816	4160	Unicorn-39031.exe	99
PID 2356 wrote to memory of 1136	2356	Unicorn-4941.exe	101
PID 2356 wrote to memory of 1136	2356	Unicorn-4941.exe	101
PID 2356 wrote to memory of 1136	2356	Unicorn-4941.exe	101
PID 704 wrote to memory of 2260	704	Unicorn-774.exe	100
PID 704 wrote to memory of 2260	704	Unicorn-774.exe	100
PID 704 wrote to memory of 2260	704	Unicorn-774.exe	100
PID 5028 wrote to memory of 2512	5028	Unicorn-37059.exe	102
PID 5028 wrote to memory of 2512	5028	Unicorn-37059.exe	102
PID 5028 wrote to memory of 2512	5028	Unicorn-37059.exe	102
PID 3056 wrote to memory of 2872	3056	609eb73b7ff7b5745f79099f01c11d66959c7e3413e46e3a7b038479f86eda6cN.exe	103
PID 3056 wrote to memory of 2872	3056	609eb73b7ff7b5745f79099f01c11d66959c7e3413e46e3a7b038479f86eda6cN.exe	103
PID 3056 wrote to memory of 2872	3056	609eb73b7ff7b5745f79099f01c11d66959c7e3413e46e3a7b038479f86eda6cN.exe	103
PID 4796 wrote to memory of 4944	4796	Unicorn-10162.exe	104
PID 4796 wrote to memory of 4944	4796	Unicorn-10162.exe	104
PID 4796 wrote to memory of 4944	4796	Unicorn-10162.exe	104
PID 2748 wrote to memory of 1956	2748	Unicorn-15569.exe	105
PID 2748 wrote to memory of 1956	2748	Unicorn-15569.exe	105
PID 2748 wrote to memory of 1956	2748	Unicorn-15569.exe	105
PID 4524 wrote to memory of 3096	4524	Unicorn-55834.exe	106
PID 4524 wrote to memory of 3096	4524	Unicorn-55834.exe	106
PID 4524 wrote to memory of 3096	4524	Unicorn-55834.exe	106
PID 928 wrote to memory of 2616	928	Unicorn-56519.exe	107
PID 928 wrote to memory of 2616	928	Unicorn-56519.exe	107
PID 928 wrote to memory of 2616	928	Unicorn-56519.exe	107
PID 2512 wrote to memory of 3624	2512	Unicorn-31652.exe	108
PID 2512 wrote to memory of 3624	2512	Unicorn-31652.exe	108
PID 2512 wrote to memory of 3624	2512	Unicorn-31652.exe	108
PID 2816 wrote to memory of 3916	2816	Unicorn-25521.exe	109
PID 2816 wrote to memory of 3916	2816	Unicorn-25521.exe	109
PID 2816 wrote to memory of 3916	2816	Unicorn-25521.exe	109
PID 5028 wrote to memory of 2912	5028	Unicorn-37059.exe	110

C:\Users\Admin\AppData\Local\Temp\609eb73b7ff7b5745f79099f01c11d66959c7e3413e46e3a7b038479f86eda6cN.exe
"C:\Users\Admin\AppData\Local\Temp\609eb73b7ff7b5745f79099f01c11d66959c7e3413e46e3a7b038479f86eda6cN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39031.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39031.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56519.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56519.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15569.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10162.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65476.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41714.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20116.exe
        9⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21315.exe
        10⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe
        11⤵
        
        PID:10392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50807.exe
        11⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34530.exe
        10⤵
        
        PID:9888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28659.exe
        10⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31957.exe
        9⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19940.exe
        10⤵
        
        PID:11024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54796.exe
        10⤵
        
        PID:15504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5340.exe
        9⤵
        
        PID:10372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30870.exe
        9⤵
        
        PID:16072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11480.exe
        8⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62513.exe
        9⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64755.exe
        10⤵
        
        PID:10972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20945.exe
        10⤵
        
        PID:16172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33789.exe
        9⤵
        
        PID:11624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54510.exe
        9⤵
        
        PID:14752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31727.exe
        9⤵
        
        PID:18440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18640.exe
        8⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45881.exe
        8⤵
        
        PID:13368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43465.exe
        8⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59674.exe
        7⤵
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36452.exe
        8⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55824.exe
        9⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe
        10⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56645.exe
        10⤵
        
        PID:17468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34069.exe
        9⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55283.exe
        9⤵
        
        PID:13608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:14640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28370.exe
        8⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16825.exe
        8⤵
        
        PID:12888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64110.exe
        7⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61252.exe
        8⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35731.exe
        9⤵
        
        PID:13656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17444.exe
        9⤵
        
        PID:17476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35351.exe
        8⤵
        
        PID:12060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48765.exe
        8⤵
        
        PID:15752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63208.exe
        7⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46946.exe
        7⤵
        
        PID:11540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34681.exe
        7⤵
        
        PID:13588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11628.exe
        7⤵
        
        PID:15600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9814.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40645.exe
        7⤵
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31299.exe
        8⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe
        9⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64864.exe
        10⤵
        
        PID:10376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31789.exe
        10⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61034.exe
        9⤵
        
        PID:11212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6324.exe
        9⤵
        
        PID:15472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20473.exe
        8⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        9⤵
        
        PID:11196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34574.exe
        9⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1449.exe
        8⤵
        
        PID:12056
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12056 -s 492
        9⤵
        Program crash
        
        PID:2976
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12056 -s 492
        9⤵
        Program crash
        
        PID:19140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11480.exe
        7⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64137.exe
        8⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3649.exe
        9⤵
        
        PID:15372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5122.exe
        8⤵
        
        PID:12552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16327.exe
        8⤵
        
        PID:14440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51614.exe
        7⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54952.exe
        7⤵
        
        PID:10868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42162.exe
        7⤵
        
        PID:16364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7872.exe
        6⤵
        
        PID:3948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9472.exe
        7⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28305.exe
        8⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        9⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6939.exe
        9⤵
        
        PID:17844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4162.exe
        8⤵
        
        PID:11904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
        8⤵
        
        PID:14712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37878.exe
        7⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        8⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56104.exe
        7⤵
        
        PID:13252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35105.exe
        7⤵
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31081.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12928.exe
        7⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43266.exe
        8⤵
        
        PID:10844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        8⤵
        
        PID:15160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53049.exe
        8⤵
        
        PID:16256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
        7⤵
        
        PID:10692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33430.exe
        6⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-909.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42323.exe
        6⤵
        
        PID:10960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2325.exe
        6⤵
        
        PID:15732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30151.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23458.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40645.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:3888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32031.exe
        8⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe
        9⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25648.exe
        10⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        11⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34574.exe
        11⤵
        
        PID:15764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3063.exe
        10⤵
        
        PID:11652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20080.exe
        10⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
        10⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33000.exe
        9⤵
        
        PID:9576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63743.exe
        10⤵
        
        PID:13416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16292.exe
        10⤵
        
        PID:14648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39824.exe
        9⤵
        
        PID:13916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20957.exe
        9⤵
        
        PID:14580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37027.exe
        9⤵
        
        PID:18448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35361.exe
        8⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        9⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65196.exe
        9⤵
        
        PID:14572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        9⤵
        
        PID:13364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34574.exe
        9⤵
        
        PID:15812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22664.exe
        8⤵
        
        PID:11444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43169.exe
        8⤵
        
        PID:14596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4878.exe
        7⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58512.exe
        8⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49829.exe
        8⤵
        
        PID:13592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16292.exe
        8⤵
        
        PID:13448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8553.exe
        7⤵
        
        PID:9660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43246.exe
        7⤵
        
        PID:13728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6293.exe
        7⤵
        
        PID:15616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9024.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26468.exe
        7⤵
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53084.exe
        8⤵
        
        PID:9856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65397.exe
        8⤵
        
        PID:14020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55414.exe
        8⤵
        
        PID:14836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        8⤵
        
        PID:14596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11511.exe
        7⤵
        
        PID:9616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28640.exe
        7⤵
        
        PID:13696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
        7⤵
        
        PID:15820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51558.exe
        6⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2540.exe
        6⤵
        
        PID:10608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12953.exe
        6⤵
        
        PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26564.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31408.exe
        6⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36452.exe
        7⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe
        8⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-287.exe
        9⤵
        
        PID:10780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe
        9⤵
        
        PID:14812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34574.exe
        9⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48782.exe
        8⤵
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5326.exe
        9⤵
        
        PID:14516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
        9⤵
        
        PID:13404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61747.exe
        8⤵
        
        PID:16268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37878.exe
        7⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
        8⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47717.exe
        7⤵
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35456.exe
        7⤵
        
        PID:14636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-909.exe
        7⤵
        
        PID:17592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48730.exe
        6⤵
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34802.exe
        7⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6379.exe
        7⤵
        
        PID:11640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34567.exe
        7⤵
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29823.exe
        6⤵
        
        PID:8908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50458.exe
        6⤵
        
        PID:10364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        6⤵
        
        PID:15656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56716.exe
        5⤵
        
        PID:5068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32031.exe
        6⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28305.exe
        7⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43266.exe
        8⤵
        
        PID:10884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32628.exe
        8⤵
        
        PID:9868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
        7⤵
        
        PID:10276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        7⤵
        
        PID:14784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51121.exe
        6⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
        7⤵
        
        PID:8584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55611.exe
        6⤵
        
        PID:12040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35105.exe
        6⤵
        
        PID:15788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22415.exe
        5⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29924.exe
        6⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        6⤵
        
        PID:15740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64842.exe
        5⤵
        
        PID:8656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37746.exe
        5⤵
        
        PID:10812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36700.exe
        5⤵
        
        PID:17836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55834.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39410.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62928.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56789.exe
        7⤵
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31839.exe
        8⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64137.exe
        9⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57521.exe
        10⤵
        
        PID:14080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42935.exe
        10⤵
        
        PID:10760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37219.exe
        9⤵
        
        PID:12312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24991.exe
        9⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37878.exe
        8⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20882.exe
        8⤵
        
        PID:12020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        8⤵
        
        PID:15576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14992.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15232.exe
        8⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51731.exe
        8⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15014.exe
        7⤵
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4590.exe
        7⤵
        
        PID:14536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18114.exe
        7⤵
        
        PID:14476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34492.exe
        7⤵
        
        PID:15224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4079.exe
        7⤵
        
        PID:16348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20604.exe
        7⤵
        
        PID:18212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54329.exe
        6⤵
        
        PID:2188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25617.exe
        7⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26935.exe
        8⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7448.exe
        8⤵
        
        PID:11472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16093.exe
        8⤵
        
        PID:15720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8221.exe
        7⤵
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44593.exe
        7⤵
        
        PID:11508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59882.exe
        7⤵
        
        PID:15284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13840.exe
        6⤵
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4158.exe
        7⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18039.exe
        8⤵
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe
        7⤵
        
        PID:12588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32628.exe
        7⤵
        
        PID:15608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31304.exe
        6⤵
        
        PID:9228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45964.exe
        6⤵
        
        PID:16064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30317.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9041.exe
        6⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54350.exe
        7⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62897.exe
        8⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63966.exe
        9⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14469.exe
        9⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe
        8⤵
        
        PID:11604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16292.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe
        7⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20799.exe
        7⤵
        
        PID:15328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42019.exe
        6⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4952.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12496.exe
        7⤵
        
        PID:13428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35105.exe
        7⤵
        
        PID:13320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52601.exe
        6⤵
        
        PID:9584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37023.exe
        6⤵
        
        PID:13900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65535.exe
        6⤵
        
        PID:15248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36516.exe
        6⤵
        
        PID:16496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61733.exe
        5⤵
        
        PID:448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21424.exe
        6⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34802.exe
        7⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2268.exe
        8⤵
        
        PID:14784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8813.exe
        8⤵
        
        PID:16476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55008.exe
        7⤵
        
        PID:12916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-808.exe
        7⤵
        
        PID:6844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16088.exe
        6⤵
        
        PID:8924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49746.exe
        6⤵
        
        PID:12596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31455.exe
        6⤵
        
        PID:1432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26399.exe
        6⤵
        
        PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24366.exe
        5⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63364.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6349.exe
        5⤵
        
        PID:9396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48294.exe
        5⤵
        
        PID:15564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42517.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2544.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58927.exe
        6⤵
        
        PID:3492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7334.exe
        7⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17314.exe
        8⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52612.exe
        9⤵
        
        PID:10252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17974.exe
        9⤵
        
        PID:17736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50235.exe
        8⤵
        
        PID:10572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50738.exe
        8⤵
        
        PID:15220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31535.exe
        8⤵
        
        PID:19268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37878.exe
        7⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51103.exe
        8⤵
        
        PID:2012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51527.exe
        7⤵
        
        PID:12396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51633.exe
        7⤵
        
        PID:13920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-105.exe
        6⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55139.exe
        7⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3219.exe
        8⤵
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61210.exe
        8⤵
        
        PID:15248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38968.exe
        7⤵
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59801.exe
        7⤵
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50161.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        7⤵
        
        PID:11144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1736.exe
        7⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-909.exe
        7⤵
        
        PID:17568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25980.exe
        6⤵
        
        PID:11616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5214.exe
        6⤵
        
        PID:16136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16503.exe
        5⤵
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31839.exe
        6⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6021.exe
        7⤵
        
        PID:9824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36827.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10058.exe
        6⤵
        
        PID:8776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24767.exe
        6⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20857.exe
        5⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6021.exe
        6⤵
        
        PID:10100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe
        6⤵
        
        PID:13836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17178.exe
        6⤵
        
        PID:11516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12208.exe
        6⤵
        
        PID:3928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43936.exe
        5⤵
        
        PID:9552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34375.exe
        6⤵
        
        PID:940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20488.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2985.exe
        5⤵
        
        PID:15448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23276.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41029.exe
        5⤵
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7142.exe
        6⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42887.exe
        7⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        8⤵
        
        PID:11252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15107.exe
        8⤵
        
        PID:17620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38968.exe
        7⤵
        
        PID:11004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47163.exe
        7⤵
        
        PID:15320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        7⤵
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57339.exe
        6⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64755.exe
        7⤵
        
        PID:11160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35320.exe
        8⤵
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35072.exe
        8⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-909.exe
        7⤵
        
        PID:17728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52979.exe
        6⤵
        
        PID:11400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24991.exe
        6⤵
        
        PID:15392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5258.exe
        5⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17397.exe
        6⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52804.exe
        7⤵
        
        PID:10916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61210.exe
        7⤵
        
        PID:13604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34090.exe
        6⤵
        
        PID:11520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61210.exe
        6⤵
        
        PID:14896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34976.exe
        5⤵
        
        PID:8780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16302.exe
        5⤵
        
        PID:13516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6324.exe
        5⤵
        
        PID:15524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28014.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7142.exe
        5⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61745.exe
        6⤵
        
        PID:7776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60161.exe
        6⤵
        
        PID:12856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30227.exe
        6⤵
        
        PID:17680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43031.exe
        5⤵
        
        PID:9100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25861.exe
        6⤵
        
        PID:10456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        6⤵
        
        PID:15096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16292.exe
        6⤵
        
        PID:14684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55693.exe
        5⤵
        
        PID:12416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26103.exe
        5⤵
        
        PID:1292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65195.exe
      4⤵
      PID:5704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56976.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15087.exe
        6⤵
        
        PID:9244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17863.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59801.exe
        5⤵
        
        PID:6736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31939.exe
      4⤵
      PID:7240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16048.exe
        5⤵
        
        PID:10784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
        6⤵
        
        PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12136.exe
        5⤵
        
        PID:19336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57958.exe
      4⤵
      PID:11336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19453.exe
      4⤵
      PID:8
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30093.exe
      4⤵
      PID:15688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4941.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4941.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31652.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50593.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57090.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37245.exe
        7⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51413.exe
        8⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33994.exe
        8⤵
        
        PID:16024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56897.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29317.exe
        8⤵
        
        PID:13632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46339.exe
        8⤵
        
        PID:15140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
        8⤵
        
        PID:14036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47718.exe
        7⤵
        
        PID:13876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18039.exe
        7⤵
        
        PID:4292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44838.exe
        6⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32581.exe
        7⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41875.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50330.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15595.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55283.exe
        7⤵
        
        PID:13616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20957.exe
        7⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49149.exe
        7⤵
        
        PID:16468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37909.exe
        6⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64755.exe
        7⤵
        
        PID:10308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-909.exe
        7⤵
        
        PID:17572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-406.exe
        6⤵
        
        PID:11556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        6⤵
        
        PID:14764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54630.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58133.exe
        6⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16005.exe
        7⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
        8⤵
        
        PID:972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21183.exe
        7⤵
        
        PID:11460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35105.exe
        7⤵
        
        PID:15704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51724.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
        7⤵
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5123.exe
        6⤵
        
        PID:15324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47198.exe
        5⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61252.exe
        6⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15856.exe
        7⤵
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46339.exe
        7⤵
        
        PID:14792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
        7⤵
        
        PID:14092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62679.exe
        6⤵
        
        PID:11696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61210.exe
        6⤵
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41719.exe
        5⤵
        
        PID:9064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46946.exe
        5⤵
        
        PID:12572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
        5⤵
        
        PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51148.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-982.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9041.exe
        6⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42337.exe
        7⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40723.exe
        8⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        9⤵
        
        PID:11032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64512.exe
        9⤵
        
        PID:3244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64246.exe
        9⤵
        
        PID:19164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23483.exe
        8⤵
        
        PID:12380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4225.exe
        8⤵
        
        PID:16080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22009.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40016.exe
        7⤵
        
        PID:11612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11628.exe
        7⤵
        
        PID:15836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39767.exe
        6⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4952.exe
        7⤵
        
        PID:9892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
        8⤵
        
        PID:2988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17265.exe
        7⤵
        
        PID:14248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44814.exe
        7⤵
        
        PID:19376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25246.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34506.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39479.exe
        6⤵
        
        PID:6956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-935.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54480.exe
        6⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13587.exe
        7⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32048.exe
        7⤵
        
        PID:16536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38885.exe
        6⤵
        
        PID:8568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24255.exe
        6⤵
        
        PID:13336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5794.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49502.exe
        5⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6021.exe
        6⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
        7⤵
        
        PID:2764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24767.exe
        6⤵
        
        PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14967.exe
        5⤵
        
        PID:8460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19696.exe
        6⤵
        
        PID:13376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8429.exe
        6⤵
        
        PID:16312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37215.exe
        5⤵
        
        PID:13388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63662.exe
        5⤵
        
        PID:15628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28593.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41221.exe
        5⤵
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32799.exe
        6⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8434.exe
        7⤵
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        7⤵
        
        PID:14540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59643.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46046.exe
        6⤵
        
        PID:13756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41095.exe
        6⤵
        
        PID:15240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        6⤵
        
        PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4765.exe
        5⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45492.exe
        6⤵
        
        PID:8732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30857.exe
        6⤵
        
        PID:11308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12208.exe
        6⤵
        
        PID:14836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46736.exe
        5⤵
        
        PID:9568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45689.exe
        5⤵
        
        PID:13908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55931.exe
        5⤵
        
        PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36187.exe
      4⤵
      PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe
        5⤵
        
        PID:6964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        6⤵
        
        PID:11128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-909.exe
        6⤵
        
        PID:17744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61034.exe
        5⤵
        
        PID:11204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20906.exe
        5⤵
        
        PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48814.exe
      4⤵
      PID:7512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60671.exe
        5⤵
        
        PID:11256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65196.exe
        5⤵
        
        PID:14580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13060.exe
        5⤵
        
        PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61547.exe
      4⤵
      PID:11980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45634.exe
      4⤵
      PID:14632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21050.exe
      4⤵
      PID:18272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25521.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11698.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62928.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13810.exe
        6⤵
        
        PID:2200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31839.exe
        7⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17397.exe
        8⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41189.exe
        8⤵
        
        PID:11712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61210.exe
        8⤵
        
        PID:14652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21241.exe
        7⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
        8⤵
        
        PID:3124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49746.exe
        7⤵
        
        PID:12564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18039.exe
        7⤵
        
        PID:15796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5258.exe
        6⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32149.exe
        7⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63359.exe
        8⤵
        
        PID:13980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39227.exe
        8⤵
        
        PID:17692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49087.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33159.exe
        7⤵
        
        PID:15584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7182.exe
        6⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18039.exe
        7⤵
        
        PID:15696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36286.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11628.exe
        6⤵
        
        PID:15640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36923.exe
        5⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31839.exe
        6⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10079.exe
        7⤵
        
        PID:9248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
        7⤵
        
        PID:13248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10058.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55493.exe
        6⤵
        
        PID:1148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18993.exe
        5⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe
        6⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45487.exe
        7⤵
        
        PID:12208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20184.exe
        7⤵
        
        PID:16128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55881.exe
        6⤵
        
        PID:11224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
        6⤵
        
        PID:3440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57479.exe
        5⤵
        
        PID:7380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44917.exe
        5⤵
        
        PID:12196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51409.exe
        5⤵
        
        PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46654.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10219.exe
        5⤵
        
        PID:6396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45959.exe
        6⤵
        
        PID:8916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
        6⤵
        
        PID:2868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62195.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47019.exe
        6⤵
        
        PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29929.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32935.exe
        5⤵
        
        PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30321.exe
      4⤵
      PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1278.exe
        5⤵
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11817.exe
        7⤵
        
        PID:16356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49829.exe
        6⤵
        
        PID:13672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50807.exe
        6⤵
        
        PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5289.exe
        5⤵
        
        PID:9756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
        6⤵
        
        PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-929.exe
        5⤵
        
        PID:13948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7053.exe
        5⤵
        
        PID:15304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51633.exe
        5⤵
        
        PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13047.exe
      4⤵
      PID:7876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51103.exe
        5⤵
        
        PID:4432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27620.exe
      4⤵
      PID:11492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16599.exe
      4⤵
      PID:2556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15517.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15517.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23349.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60079.exe
        5⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7645.exe
        6⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46339.exe
        7⤵
        
        PID:13528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
        7⤵
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48098.exe
        6⤵
        
        PID:13356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51633.exe
        6⤵
        
        PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4661.exe
        5⤵
        
        PID:9336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27874.exe
        5⤵
        
        PID:15140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53006.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42887.exe
        5⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63887.exe
        6⤵
        
        PID:8652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11628.exe
        6⤵
        
        PID:14404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6358.exe
        5⤵
        
        PID:9668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46046.exe
        5⤵
        
        PID:13716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4669.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44926.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46946.exe
      4⤵
      PID:12268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9298.exe
      4⤵
      PID:15412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53313.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53313.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60271.exe
      4⤵
      PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25399.exe
        5⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62295.exe
        6⤵
        
        PID:9284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17885.exe
        6⤵
        
        PID:15116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
        6⤵
        
        PID:3872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47630.exe
        5⤵
        
        PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
        5⤵
        
        PID:15804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35388.exe
      4⤵
      PID:8552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31958.exe
      4⤵
      PID:4708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27862.exe
    3⤵
    PID:6020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32581.exe
      4⤵
      PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63364.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60951.exe
      4⤵
      PID:7624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41095.exe
      4⤵
      PID:14520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
      4⤵
      PID:14372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35639.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35639.exe
    3⤵
    PID:7944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22248.exe
      4⤵
      PID:14316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3649.exe
      4⤵
      PID:16016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36277.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36277.exe
    3⤵
    PID:11548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21925.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21925.exe
    3⤵
    PID:15648
- C:\Users\Admin\AppData\Local\Temp\Unicorn-774.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-774.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37059.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31652.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64983.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23541.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35876.exe
        7⤵
        
        PID:464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31346.exe
        8⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65445.exe
        9⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3219.exe
        10⤵
        
        PID:10660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60344.exe
        10⤵
        
        PID:15244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61210.exe
        10⤵
        
        PID:14488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
        9⤵
        
        PID:10640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41386.exe
        8⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        9⤵
        
        PID:11180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5794.exe
        9⤵
        
        PID:15492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48098.exe
        8⤵
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64269.exe
        8⤵
        
        PID:16104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5258.exe
        7⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28305.exe
        8⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45487.exe
        9⤵
        
        PID:11704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42935.exe
        9⤵
        
        PID:11580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54812.exe
        8⤵
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        8⤵
        
        PID:14208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6990.exe
        7⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        8⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16292.exe
        8⤵
        
        PID:14632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19234.exe
        7⤵
        
        PID:10340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50330.exe
        7⤵
        
        PID:15532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54713.exe
        6⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47490.exe
        7⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17397.exe
        8⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16292.exe
        9⤵
        
        PID:14744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61121.exe
        8⤵
        
        PID:13296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64158.exe
        8⤵
        
        PID:13392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61210.exe
        8⤵
        
        PID:15068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64220.exe
        7⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe
        7⤵
        
        PID:13928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51633.exe
        7⤵
        
        PID:1980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
        6⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45959.exe
        7⤵
        
        PID:9264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26280.exe
        7⤵
        
        PID:13468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        7⤵
        
        PID:14224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58486.exe
        6⤵
        
        PID:8560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32301.exe
        6⤵
        
        PID:14392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12439.exe
        6⤵
        
        PID:16244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42569.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20801.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7526.exe
        7⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13312.exe
        8⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20685.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:14340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26110.exe
        9⤵
        
        PID:17440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55008.exe
        8⤵
        
        PID:12932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22118.exe
        7⤵
        
        PID:9048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49746.exe
        7⤵
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8309.exe
        7⤵
        
        PID:16092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27131.exe
        6⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57168.exe
        7⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61121.exe
        7⤵
        
        PID:11976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64158.exe
        7⤵
        
        PID:15140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52190.exe
        6⤵
        
        PID:9116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55611.exe
        6⤵
        
        PID:12304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16599.exe
        6⤵
        
        PID:1100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30321.exe
        5⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17397.exe
        6⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5990.exe
        7⤵
        
        PID:14256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23176.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61121.exe
        6⤵
        
        PID:13304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64158.exe
        6⤵
        
        PID:2528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16093.exe
        6⤵
        
        PID:15400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40842.exe
        5⤵
        
        PID:8748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
        6⤵
        
        PID:15540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41793.exe
        5⤵
        
        PID:12408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3460.exe
        5⤵
        
        PID:1308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34811.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-790.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10494.exe
        6⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe
        7⤵
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51735.exe
        8⤵
        
        PID:10964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46339.exe
        8⤵
        
        PID:14728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16093.exe
        8⤵
        
        PID:15664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4490.exe
        7⤵
        
        PID:11672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        7⤵
        
        PID:3040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52378.exe
        6⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30931.exe
        7⤵
        
        PID:10580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7925.exe
        7⤵
        
        PID:15384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31105.exe
        6⤵
        
        PID:10636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10406.exe
        6⤵
        
        PID:14828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
        6⤵
        
        PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exe
        5⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62513.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
        7⤵
        
        PID:2072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50126.exe
        6⤵
        
        PID:12444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54510.exe
        6⤵
        
        PID:14652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14339.exe
        6⤵
        
        PID:16612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6388.exe
        5⤵
        
        PID:8920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59502.exe
        5⤵
        
        PID:16380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2828.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36644.exe
        5⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe
        6⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40888.exe
        7⤵
        
        PID:12328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20080.exe
        7⤵
        
        PID:14676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60608.exe
        7⤵
        
        PID:18264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54432.exe
        6⤵
        
        PID:11884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
        6⤵
        
        PID:15320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58792.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        6⤵
        
        PID:3828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65196.exe
        6⤵
        
        PID:14680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32628.exe
        6⤵
        
        PID:2800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23020.exe
        5⤵
        
        PID:12272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55222.exe
        5⤵
        
        PID:14024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28089.exe
        5⤵
        
        PID:17920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53063.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24771.exe
        5⤵
        
        PID:8792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63743.exe
        6⤵
        
        PID:14000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2731.exe
        6⤵
        
        PID:14788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2564.exe
        6⤵
        
        PID:396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41095.exe
        5⤵
        
        PID:14500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
        5⤵
        
        PID:5064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31147.exe
      4⤵
      PID:9392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6526.exe
      4⤵
      PID:14004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44995.exe
      4⤵
      PID:15484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11786.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54677.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33655.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37245.exe
        6⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19839.exe
        7⤵
        
        PID:10176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3649.exe
        8⤵
        
        PID:2464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61625.exe
        7⤵
        
        PID:15272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33994.exe
        7⤵
        
        PID:13672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1474.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
        6⤵
        
        PID:13380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
        6⤵
        
        PID:14544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11480.exe
        5⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45959.exe
        6⤵
        
        PID:9256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        6⤵
        
        PID:1300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18640.exe
        5⤵
        
        PID:8676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
        5⤵
        
        PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30125.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2710.exe
        5⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe
        6⤵
        
        PID:4212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3520.exe
        7⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11589.exe
        7⤵
        
        PID:14264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42935.exe
        7⤵
        
        PID:10768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15533.exe
        6⤵
        
        PID:10876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8542.exe
        6⤵
        
        PID:15236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25719.exe
        6⤵
        
        PID:13360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
        6⤵
        
        PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37878.exe
        5⤵
        
        PID:7456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65294.exe
        6⤵
        
        PID:14304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15345.exe
        5⤵
        
        PID:11988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6292.exe
        5⤵
        
        PID:13540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
        5⤵
        
        PID:1748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62465.exe
      4⤵
      PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61745.exe
        5⤵
        
        PID:7768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        6⤵
        
        PID:10956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65196.exe
        6⤵
        
        PID:14708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55580.exe
        5⤵
        
        PID:11436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62632.exe
      4⤵
      PID:8684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51346.exe
        5⤵
        
        PID:14656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46339.exe
        5⤵
        
        PID:14688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42735.exe
        5⤵
        
        PID:6344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46946.exe
      4⤵
      PID:11876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30913.exe
      4⤵
      PID:16232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21904.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21904.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62435.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9041.exe
        5⤵
        
        PID:744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20848.exe
        6⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7007.exe
        7⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12326.exe
        8⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28850.exe
        9⤵
        
        PID:16052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe
        8⤵
        
        PID:12996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32628.exe
        8⤵
        
        PID:15712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58574.exe
        7⤵
        
        PID:9728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63966.exe
        8⤵
        
        PID:14488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
        8⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12496.exe
        7⤵
        
        PID:13436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35105.exe
        7⤵
        
        PID:15772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53831.exe
        6⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        7⤵
        
        PID:11036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14723.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20114.exe
        6⤵
        
        PID:11628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6324.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27131.exe
        5⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18165.exe
        6⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31455.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62071.exe
        7⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50126.exe
        6⤵
        
        PID:12436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54510.exe
        6⤵
        
        PID:14576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20957.exe
        6⤵
        
        PID:3820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42927.exe
        6⤵
        
        PID:16032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe
        5⤵
        
        PID:9044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
        5⤵
        
        PID:3952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
      4⤵
      PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9062.exe
        5⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26207.exe
        6⤵
        
        PID:16044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49851.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
        5⤵
        
        PID:4188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45693.exe
      4⤵
      PID:7468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40661.exe
        5⤵
        
        PID:10288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18039.exe
        5⤵
        
        PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe
      4⤵
      PID:10356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32743.exe
      4⤵
      PID:15424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-717.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-717.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9041.exe
      4⤵
      PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41460.exe
        5⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19839.exe
        6⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29235.exe
        6⤵
        
        PID:1888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28039.exe
        5⤵
        
        PID:9376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63743.exe
        6⤵
        
        PID:14092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15008.exe
        6⤵
        
        PID:10128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64046.exe
        5⤵
        
        PID:16116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60297.exe
      4⤵
      PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47037.exe
        5⤵
        
        PID:9192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55611.exe
        5⤵
        
        PID:11380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35105.exe
        5⤵
        
        PID:864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-384.exe
      4⤵
      PID:7664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51652.exe
        5⤵
        
        PID:10172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32009.exe
        5⤵
        
        PID:13408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43240.exe
        5⤵
        
        PID:13820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35134.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35134.exe
      4⤵
      PID:10860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35788.exe
      4⤵
      PID:11592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8869.exe
      4⤵
      PID:6256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32290.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32290.exe
    3⤵
    PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38419.exe
      4⤵
      PID:6884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26857.exe
        5⤵
        
        PID:10440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55007.exe
        5⤵
        
        PID:18256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58574.exe
      4⤵
      PID:9736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-71.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-71.exe
      4⤵
      PID:16320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46777.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46777.exe
    3⤵
    PID:7520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25093.exe
      4⤵
      PID:10944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
        5⤵
        
        PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60344.exe
      4⤵
      PID:15212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16093.exe
      4⤵
      PID:15852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20174.exe
    3⤵
    PID:10832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-284.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-284.exe
    3⤵
    PID:14788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48294.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48294.exe
    3⤵
    PID:15592
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30928.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30928.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31652.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31652.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54677.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30915.exe
        6⤵
        
        PID:4916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20687.exe
        8⤵
        
        PID:8712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60636.exe
        8⤵
        
        PID:16372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38885.exe
        7⤵
        
        PID:4940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23186.exe
        7⤵
        
        PID:13444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32628.exe
        7⤵
        
        PID:15844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30613.exe
        6⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7604.exe
        7⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21895.exe
        7⤵
        
        PID:14040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20873.exe
        7⤵
        
        PID:2024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64079.exe
        6⤵
        
        PID:10836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        6⤵
        
        PID:15332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59036.exe
        5⤵
        
        PID:6044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6815.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51413.exe
        7⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11628.exe
        7⤵
        
        PID:1436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64459.exe
        6⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39815.exe
        7⤵
        
        PID:13972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3717.exe
        7⤵
        
        PID:14284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15330.exe
        7⤵
        
        PID:16036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8796.exe
        6⤵
        
        PID:14220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30102.exe
        6⤵
        
        PID:2136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28479.exe
        5⤵
        
        PID:8148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28741.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16093.exe
        6⤵
        
        PID:1064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46946.exe
        5⤵
        
        PID:11972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64721.exe
        5⤵
        
        PID:15364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42377.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25269.exe
        5⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31765.exe
        6⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
        7⤵
        
        PID:912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5916.exe
        6⤵
        
        PID:11384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55525.exe
        6⤵
        
        PID:4840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32454.exe
        5⤵
        
        PID:8364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26399.exe
        6⤵
        
        PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51335.exe
        5⤵
        
        PID:12988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10004.exe
        5⤵
        
        PID:18584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1204.exe
      4⤵
      PID:5896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53058.exe
        5⤵
        
        PID:9308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
        5⤵
        
        PID:2500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61646.exe
      4⤵
      PID:8228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16292.exe
        5⤵
        
        PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19234.exe
      4⤵
      PID:11968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21934.exe
      4⤵
      PID:5040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25574.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25574.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37521.exe
        5⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37494.exe
        6⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63743.exe
        7⤵
        
        PID:13736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8813.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21183.exe
        6⤵
        
        PID:11456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25719.exe
        6⤵
        
        PID:14832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
        6⤵
        
        PID:14912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4661.exe
        5⤵
        
        PID:9328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1231.exe
        5⤵
        
        PID:748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48730.exe
      4⤵
      PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33458.exe
        5⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
        6⤵
        
        PID:10892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65196.exe
        6⤵
        
        PID:14688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35335.exe
        6⤵
        
        PID:17852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62103.exe
        5⤵
        
        PID:11148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        5⤵
        
        PID:4660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35497.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62555.exe
        5⤵
        
        PID:17884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46946.exe
      4⤵
      PID:12424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
      4⤵
      PID:3028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50960.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50960.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25269.exe
      4⤵
      PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1278.exe
        5⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62897.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-370.exe
        7⤵
        
        PID:12356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42935.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe
        6⤵
        
        PID:12364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12208.exe
        6⤵
        
        PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5289.exe
        5⤵
        
        PID:10068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40116.exe
        6⤵
        
        PID:13600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2731.exe
        6⤵
        
        PID:13888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33804.exe
        6⤵
        
        PID:17320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7535.exe
        5⤵
        
        PID:14288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57066.exe
        5⤵
        
        PID:17460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24173.exe
      4⤵
      PID:7928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34567.exe
        5⤵
        
        PID:2396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60078.exe
      4⤵
      PID:11564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16822.exe
      4⤵
      PID:13236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53063.exe
    3⤵
    PID:6052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19535.exe
      4⤵
      PID:7264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56924.exe
      4⤵
      PID:12540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10462.exe
      4⤵
      PID:13684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20957.exe
      4⤵
      PID:14652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26591.exe
      4⤵
      PID:16576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20993.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20993.exe
    3⤵
    PID:8824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20680.exe
    3⤵
    PID:13324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40071.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40071.exe
    3⤵
    PID:14592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6293.exe
    3⤵
    PID:15556
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43639.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43639.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54677.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54677.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57090.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65424.exe
        5⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7910.exe
        6⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39571.exe
        7⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13198.exe
        8⤵
        
        PID:12768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3530.exe
        8⤵
        
        PID:14052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
        7⤵
        
        PID:10532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17974.exe
        7⤵
        
        PID:17528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37878.exe
        6⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12016.exe
        7⤵
        
        PID:14756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23020.exe
        6⤵
        
        PID:12280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22550.exe
        6⤵
        
        PID:14588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4422.exe
        6⤵
        
        PID:132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62837.exe
        6⤵
        
        PID:17904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50650.exe
        5⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15232.exe
        6⤵
        
        PID:8536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50807.exe
        6⤵
        
        PID:5624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9149.exe
        5⤵
        
        PID:9464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28659.exe
        5⤵
        
        PID:2036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26363.exe
      4⤵
      PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45492.exe
        5⤵
        
        PID:9028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49829.exe
        5⤵
        
        PID:13652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13574.exe
        5⤵
        
        PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55781.exe
      4⤵
      PID:8496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42416.exe
      4⤵
      PID:14588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39604.exe
      4⤵
      PID:14396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3980.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3980.exe
    3⤵
    PID:1876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53712.exe
      4⤵
      PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50863.exe
        5⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41957.exe
        6⤵
        
        PID:12292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18039.exe
        6⤵
        
        PID:15780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39544.exe
        5⤵
        
        PID:11168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
        5⤵
        
        PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58984.exe
      4⤵
      PID:7892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52368.exe
        5⤵
        
        PID:11488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34567.exe
        5⤵
        
        PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60873.exe
      4⤵
      PID:12900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14088.exe
      4⤵
      PID:11488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-437.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-437.exe
    3⤵
    PID:6440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2434.exe
      4⤵
      PID:9968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53931.exe
      4⤵
      PID:5136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17293.exe
    3⤵
    PID:9676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26710.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26710.exe
    3⤵
    PID:13744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46670.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46670.exe
    3⤵
    PID:5760
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19104.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19104.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14111.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14111.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65450.exe
      4⤵
      PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27510.exe
        5⤵
        
        PID:9796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65397.exe
        5⤵
        
        PID:14012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61981.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14063.exe
      4⤵
      PID:9432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28967.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28967.exe
      4⤵
      PID:1072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53006.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53006.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64137.exe
      4⤵
      PID:7792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37219.exe
      4⤵
      PID:12320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47933.exe
      4⤵
      PID:16180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51614.exe
    3⤵
    PID:7268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19234.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19234.exe
    3⤵
    PID:4172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34681.exe
    3⤵
    PID:14972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
    3⤵
    PID:1992
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49029.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49029.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42866.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42866.exe
    3⤵
    PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59332.exe
      4⤵
      PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18549.exe
        5⤵
        
        PID:8896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe
        5⤵
        
        PID:12524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34574.exe
        5⤵
        
        PID:15828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62242.exe
      4⤵
      PID:9448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24767.exe
      4⤵
      PID:4988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23213.exe
    3⤵
    PID:6740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21777.exe
      4⤵
      PID:10992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65196.exe
      4⤵
      PID:14652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46373.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46373.exe
    3⤵
    PID:2112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30870.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30870.exe
    3⤵
    PID:17420
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44928.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44928.exe
  2⤵
  PID:6000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60100.exe
    3⤵
    PID:6912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40661.exe
      4⤵
      PID:8448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43787.exe
      4⤵
      PID:16204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55881.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55881.exe
    3⤵
    PID:11232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12738.exe
    3⤵
    PID:4924
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48726.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48726.exe
  2⤵
  PID:8188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3841.exe
    3⤵
    PID:4020
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19951.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19951.exe
  2⤵
  PID:12068
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34073.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34073.exe
  2⤵
  PID:15096
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45494.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45494.exe
  2⤵
  PID:15676

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 12056 -ip 12056
1⤵
PID:19076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10162.exe

Filesize
468KB

MD5
baeec29e53f2bae3e263f1adea09d0d9

SHA1
5f09e80be844a55600b1ca9a560f62b7b4bbd564

SHA256
7db989680e33b9d440368a7a52223c9339fe11fef5b262fa67f50e58b4644a19

SHA512
796aa95b2413dd3451bf05e35ae977afcfc4695e4b330c476dc6482eeb5ded2fc37c4b823383a69a4e8aa3a9f1426d71e1f0cfad323dc6f6c429b216e3cd1779

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11698.exe

Filesize
468KB

MD5
1bbe5ac68b25932c1a7700eba2c76aa7

SHA1
21b5a2460e82d7f90c4f9f4be9990074db4eb50b

SHA256
da147529d5d80d13abfb8b5f60effae51742807a4e4ad162b387c86497461558

SHA512
bb6925df5fea61259833e442cf448534c35790f4ddec4f212b42b70d59493d6d3006554ed9203684370edc04eb4f51bffd8f06c7e7d428cb7a6917942daedb8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11786.exe

Filesize
468KB

MD5
d037c325aa93497c5a879c53ea821465

SHA1
4bf17d1a11de43cc4ec85f5e0a3875b6a097ea75

SHA256
7d811ac084b6a8e7a28f1720836aa6ec39f5e44e0451b278603cc5a675daf14d

SHA512
0b84ca88f7763a344e80b371c092c0465a8d8089422ef0171e4a3fb58d94ae82dda3cf4848ee14cef4041e3afda7f2f1c3a2ac82d3b05b9cbd6b70ca19575618

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15517.exe

Filesize
468KB

MD5
b9501ad405160fa369f8288fcb627712

SHA1
f632fea96d4f70e9ca949084fd30cccd3271eebb

SHA256
c5e211c09bdbee4217af1ce0b0f9c64dce5732488010be509d1f7a5d4587f724

SHA512
92048fe92aa4e49326cea3e44c976a7928afcc2b8a317e79dde857ad4b276158a780e9a32ef3938542c13722f4ec5aa64c9ac121d4f62b758fc4614dfca8f287

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15569.exe

Filesize
468KB

MD5
b701bab096fde07d4b37a44e2f710646

SHA1
6eb1d71900cf4d4dfc43e233097cadd35edfea40

SHA256
c7bd671ed161d49c40ba993f7bef428e5376303dd4614198b4a98b4e4759d862

SHA512
0e862afc2a2c5aa94c210487f4af17e268bb52e3849f0c6ebca808a21435717e6d7a14ab6f9bda3df535e2d884ff84718484984454e9497feafc914675278385

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19104.exe

Filesize
468KB

MD5
1d9ba89a898de52752abf52114c5d5f5

SHA1
029317a1643fabb975b59f5beb0be9bc392f9b18

SHA256
fbbc8a1ea85b01730d2163e6585295c08c196c2b65a2ebe9ead2cfebb2a933ef

SHA512
9d47b46938bc859e7765b9f8b2e761e040e45d3c4e4f800df0da328f1df496d6e76cd1710e51ff192e8b438d02c507b11159c7a87f971006b9cdaebd2158edf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21904.exe

Filesize
468KB

MD5
559caf0e235b10316ec1fa33d755b6f0

SHA1
cd734fcea7d4fc78c911eb6d11b91b309300da92

SHA256
1b44f50763c7754e80b033846cd9b88f44b5be783afc1d4723b3187607573b25

SHA512
dcb735be0cc53e9178802018ce9bbcd8a2a1b438ed98c0880f235231c5d27cad9bad9bfdca538f356ea57cbad313a74fc7bab5126b53970567441a3687d1468c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22.exe

Filesize
468KB

MD5
411e38ecd620e497089213ea66c46b10

SHA1
7ba25a61ae650da3d120808c002e55d46d68a4a0

SHA256
28caf7fbf30cb550794b124ddc9959c607dd807f57fbb20913b04ccedb643e1f

SHA512
8adfe962f2e943e8d16e69a2759e14d93ee24b00b2c2a57e8246560e3c943e422a89edea3e04014c200d4588c5498a9f708f048cc4792dbea56f91cb5259d222

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23458.exe

Filesize
468KB

MD5
34d35cad6c4cf51c9e78214d3490b86c

SHA1
89c6d0f4e1e9a92d026a07e76868d488b98c6b81

SHA256
086a6cdcb0fe9cb66f78ad0e166b31f99a7c701bdb5a749a10eff0a393869f28

SHA512
5a2edfc9afe1cc44ac3f187b36dd9f13266baad4f8d7e538a11dc5dcabc772ff8d810be22b50f38ba8d7f1174c96ddd8c20300631dc0f29c5e33c2be055d4872

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25521.exe

Filesize
468KB

MD5
70efca343399e736001a929797c02f17

SHA1
b0c424ab41f3c9ef1c91a85a09f0945b4b880334

SHA256
e427f2d471d2a6141de7d1cc54639d98e861df065729bfff5c85638a95c0a250

SHA512
29f94ab3ca5bd9eeaafc760cea03c9200032ff70033f72cd7622b43b5299e9c7418c601fb5069df11472a6a40b61996e723c025090cb125096805df961122aac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25574.exe

Filesize
468KB

MD5
4fb568bcd7348104ae7b3998439eb96c

SHA1
7f372db14757566700c9ecd9d20c09c08a5abe27

SHA256
47da16842115f4db392f9114ecb9768b4eb68811b7cb57e337f1cd01061bbe6c

SHA512
5ac10ae81f688757cb7a54f59eae77bdaff5de9d1b050d4227836c4f1968d7c9d3515e17d58b4a0670a348ced2389e983abe081e72a2ff07b39116c488e12491

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30151.exe

Filesize
468KB

MD5
1dbab9eb9f9d4a73fb6cd3a1246fb746

SHA1
0b5a383b24c2e1973c2174c2026fbd50496c176b

SHA256
e1a5b1843978c07b103adc7e7ff94e370be3c3bb844bdc7c7324a7decdbfdd4e

SHA512
170c7764118407a9a7aef5193bea2bad8c8c777ae18941d51de348dbe7e5218c119e6aa8e8d11d2eae23bab7e60a3b46117a8fa4ba7bed7c6a6952346a6e8c13

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30928.exe

Filesize
468KB

MD5
3fec312f480669473ecfc4cdf36b2d9f

SHA1
c353d4bbe04b91177bf2ab83a280239027069f93

SHA256
5f9009b2e0cb7a504ce1a373c9ef64d0930600f4cfc17447e0791e38c8f93c4f

SHA512
9d2bcb0b074c4b96a448fbd05ee69cbe22462a0cfcaa805bfca897ab767a1f8de10cde4649c0b313f7c32889ecc1154616976db7f87dea2ee6251697b510b5db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31652.exe

Filesize
468KB

MD5
a931350a3abfa13b23b2a33cae8ee847

SHA1
00577e4db48e7746ef7b266351d6dc0da2be5fbe

SHA256
b45c0947cc4f62a72d79b9c4cb2622cbaf655199c79871017d63eb82621eccd5

SHA512
caa4bd791e871ba4f122010c5f37c21e0f7c93593e990a8726fb37a49dfa71a5f8e9d014af5b21bdf9cf9dcf8c9553487f142af541a5433dd36e5c5fdaee000a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32437.exe

Filesize
468KB

MD5
ffc4c885524b7c144e0a26d5dbcbfe76

SHA1
01edeaae44c5023d32af4e0e4fe7eb27cd89b4ac

SHA256
6f394966b4b5776e043feb7d4d5de5d045029cce86a275d74f50a26ff8c60944

SHA512
f0b325a7d92f9ce59f2fd0a72d540d25c62da25d4823a6121b95ef82046238b5be5bc3d97898d007e38d94586df6c3c4f756e792acafb809d655b999e81d5190

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34811.exe

Filesize
468KB

MD5
bea3c6f0536448275c6a6f3905cd372e

SHA1
d45223861f80e543adceac0ce9f7658e7dc278ac

SHA256
a04d90a24d7f3d70b141166e96b554182054003543ffd757ff12e38c6c5f689d

SHA512
283b4e1888217a61ae634ff938329bc034816b24da8d0cc9221bd039c2980e7810507669ea69cb1e284e34444bcee3e02405c12a6d0711faf0bbf7e42a6a3a15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37059.exe

Filesize
468KB

MD5
fbccd625757f81cd765d835bac4433d7

SHA1
823c755a93a2a8d63a6fb81d8c0497e97579f5f3

SHA256
d3ae68d3138990b1f2687f4a74d4284d55f546a90689647085b6af06b488291b

SHA512
041d8dbe4d6e6d6830977b89c31c8577cdd9a186f640917311c4cd5f03b166f8c17f199c6491bb7e767b269de344a9fbe793c3e839450ba44fc5969d97b1b95b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39031.exe

Filesize
468KB

MD5
1b763fcc1839f30b9f5a988c9f307409

SHA1
c2c426206d2ea997e6644c8dd5a904462e5ec0d6

SHA256
5daf10b0489ec5c6b5b507833187892b3b04224c2013fed674806d7715429498

SHA512
75eed6b967e55edd9ea59443cd902dd766cae0a5d3aaeb1d84b487f3371bfff00affe9669e13dec6396c63ac44a093c78566b707028335088d0f38e59ccbab01

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39410.exe

Filesize
468KB

MD5
04bb4405bb660a1c2e15080103a13a01

SHA1
3cdffe1f5f7ef0fdc0e1d52e8d14f9496331908e

SHA256
1ae3e5d5178df2e2af1b3d5b747c43248baa8bd0cf649a8a1fe0167a2ea0dd1d

SHA512
f3ca00b304855fb120d3c44f210324f98c7db4bfdcbb1624ad449748caabc45a9aa3978a7abb51d5de40489b93b515b9a0d3456bef9b61bf436298f0c0667a9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42517.exe

Filesize
468KB

MD5
31753550cb56e2aa9f30582763a444e3

SHA1
5d65919c87579b18987eba1919c4ca5194a2c69c

SHA256
50742146ba8fa82631ec2ff1a7fc1ff3d48a93162ce711e86cb78ad95d0da3ba

SHA512
f8e6ce41fae6cf056cfddb629a4518b35dd2f27928a6bbfa58a4685ac06851096175b7434f2fd197eb8b2b84c411c3d9579632425e6823666a9f8dfd67dc79b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43639.exe

Filesize
468KB

MD5
dca86cef5788a3e51a5771e50c3a66de

SHA1
76d8a5998ffe1cb0cd519f5278772731a5caef6e

SHA256
76d0a5ad09464d649bd287efdd05fbb6e5c797a67b3551c023fc71cbd1ec1ec2

SHA512
cc89c238c8881cf650f600c276b2ce7f3e8c8458d19a357bcc1d1170364db6e1f1b69e890aa67b44d2edd370017101be195a3d4ea5ae4fdfc3f8060881c2c456

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4941.exe

Filesize
468KB

MD5
41391467be23d28c1e4f0dd36e032116

SHA1
38d5c1cae137399b1d5bbe952e4135de5ca33f9c

SHA256
31f98f21128c64ba3b0b537b28a4fb97ea22b0505446a1806749c6ff137623b6

SHA512
6a053c1d83a4e2680bf8c653caf991f4176be7d6f9960a759bc6d4f8a8e7edcf94755728e3e23e764c5439cb5ff348d0477b992834b6048e2cccb2b4140d7eca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50593.exe

Filesize
468KB

MD5
0115f92b450d4464fc3148e93f71ca2e

SHA1
0105d7123aaa05b9e3fa81f6ca6f14caa84f4e80

SHA256
2beec46abde571bec46b77353e8a2a227e4abdc483a2b01186930aed8ac7e1c8

SHA512
59476aa67ee89a53912a9ed4a87fea32c4bb734c3f4cfba55d9ffe5531fb553dffd888476a741c55e0e6fb7b82e51dc90713f024a66e9a874d202e58c3c0c6e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51148.exe

Filesize
468KB

MD5
729df46f85941b7be4c0bb1f62343217

SHA1
1e8f2c555dc53abb8d2f58e46841c519fa8f22b5

SHA256
da6f4d116e532a111cee4399b72e18272feb67610fe82c77b6928e86d68a0cfd

SHA512
9d101a6493de3438e2ba7d50b9b8c8cf999de1a89b22fd5c4e31682669f10537dfad5b9684db757128d6463fd1d645153bf220cf003bfd6eab4907772e0a26f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54677.exe

Filesize
468KB

MD5
5e1934c2350a1cd90c8a5bb8f1b85b5c

SHA1
6e5c46b98d7830112bb855335aa2694909c2ec70

SHA256
18779cb1094ce2a4a56e8e882b6433a809304dc275cee9ae458ad34a6671153f

SHA512
fdf0d808602339d1dcab062e30f95795077b8101ee234f7dde4ffbbdc063c68470c7a95f6ecd06bcaa42086f044871507097dfe3c77d4846cf08d00461a679dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55834.exe

Filesize
468KB

MD5
fbd3fd82355d84118da09f5c0ec46175

SHA1
4561f47ef2f58cb84975c2adc9f6a6f083e7e543

SHA256
c26642d26879d27a8107ec11f0c4e0b0bed9c4b653f3356137b61ff05481025b

SHA512
65cfaab1ab2964fe599eb7622a924bd06fa562131b1b5feaa71fe438ef8f29c60b8150c10d39e55bf4759c133929cb6c6a55980621a1d60bb4ae90b3709bdbdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56519.exe

Filesize
468KB

MD5
0907c783bcb624be792762dbe2f0a68b

SHA1
47a1ddabc0d0ee31f3acf4bebb60c828c05a4108

SHA256
bff4429ba54e01fdd44968746e7340d7e10c0dd4e29e3518cceae2ab8b918ce2

SHA512
83634d785407fa2fa05e6aced801cd847992ed22197a480276af7e7291288caa4e240f73c60fac673a1f353b89bd1220e4c06dfffd6434be2fa715a0ba0a8ae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64983.exe

Filesize
468KB

MD5
86122ff1020f2161e7c42d80f9ba7ac6

SHA1
5bdf6254d2d466898a7d89ea13cc87536e94e61c

SHA256
d42266db1cfabcd9e7c378771cd2d42fca9a351bad40b5906d578ae34628e675

SHA512
3d6d5415a5a83c478e7b58ffafcd48e84bd1aff522529a83a9980180d2ce89b56eb4d36d2b2ee9def570e00d0970b0f66d0fc85070ef5a3ba95760e87f55df17

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65476.exe

Filesize
468KB

MD5
175131848355aef4aa567741a61705da

SHA1
3e32057ae8fd1bb1816f2a00a05381d0446bf242

SHA256
15b944f7651f546eaad298f7525ff2c7f0affe6c1315b8ea4a171a5b49d90ede

SHA512
1f32872e51ae53cf9ce59672a04b581fd6d2b80001953cf0354504d6bd80b07a7571bf63c9f3da1e0966dfc2c423fb6ba5f8eb7fd31af038176cd3c15222d0f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-774.exe

Filesize
468KB

MD5
aa580b872f874d31307f310133ddf441

SHA1
f4ddcdbe4cc1d83e6f9cbc8fdf82ee91b36bc0fd

SHA256
0df2198f49abf3da17bbd873f9c3ad6a8bdb00055bc55f4c1dd69454a00ad94c

SHA512
da75437a5cc805b3b3a44b360dff6df329d393f71a7ba455e0eb20c29a542bef80cab4eb2dfab5a105a421ac6c8e4128ac99f37777fb509e23cc3743aa677427

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9814.exe

Filesize
468KB

MD5
5c36b6af687b9e9e301cf0d4085310ef

SHA1
7b8d71d3eccb6dd5d70870b14248af6657db8aad

SHA256
ceec5a8f875e9ca37c31b0c639efd7e31390b84de0c04cd09d0bfa2a3e5a0946

SHA512
aa56e23d147e19a69c7b9766cb2d1a092658a6ef1ce3df3a54f5adc70448b6f2844847ce7f96de81f2e7896b6426281a10bd64711b6f78d9a1ef8e98bd3d856a

Download Submit
memory/112-47-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/448-481-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/464-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/512-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/636-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/704-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/744-442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/928-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1196-206-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1208-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1256-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1472-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1584-480-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1652-479-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1680-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1712-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1876-439-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1908-75-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1956-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2152-493-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2168-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2188-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2200-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2224-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2260-77-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2284-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2356-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2456-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2512-78-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2536-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2616-123-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2712-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2748-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2796-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2808-366-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2816-76-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2872-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2912-160-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2924-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3056-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3084-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3096-117-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3240-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3364-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3376-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3408-248-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3460-175-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3464-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3492-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3496-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3500-293-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3568-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3624-135-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3640-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3740-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3796-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3888-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3892-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3916-141-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3936-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3948-373-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4064-425-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4148-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4160-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4396-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4416-313-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4424-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4428-465-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4464-426-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4524-59-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4544-261-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4752-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4784-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4796-58-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4816-290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4916-494-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4944-103-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4948-482-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4960-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4984-187-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4992-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4992-2903-0x00007FFA04C70000-0x00007FFA04CF3000-memory.dmp

Filesize
524KB

Download
memory/5004-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5028-46-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5032-464-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5068-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5172-509-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5204-510-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5224-511-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5272-519-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5288-512-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5308-513-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5404-548-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5436-551-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5456-621-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5480-558-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5496-622-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14032-3098-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14316-3029-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14520-3027-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14588-2467-0x00000000776E0000-0x00000000776EA000-memory.dmp

Filesize
40KB

Download
memory/14836-3028-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads