afd708116f94388ca2b5958afb17515de63bf7342aa4adbdea2feb8f3faa0cf2

Analysis

max time kernel
119s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afd708116f94388ca2b5958afb17515de63bf7342aa4adbdea2feb8f3faa0cf2N.exe
Size

468KB
MD5

5fe3a0ab142bca58cc569996b9bf4ff0
SHA1

6e57085e6578d896a9903ba1b41a49c1fc2b0b41
SHA256

afd708116f94388ca2b5958afb17515de63bf7342aa4adbdea2feb8f3faa0cf2
SHA512

de6c5b5ddb8242a4243bd01cf99006e0aba6a9fb4319607173aa603cf66928613d31cff36b5b3be5379715d87386d6756ef083ab155bedfe3c7c9439cafa8b1d
SSDEEP

3072:9U/iogOHj28U3bYCPz3yqf8/EUhqhIpaymH2LxHfNJz+GM8NbZle:9UqobXU3tPDyqff0hpNJCD8Nb

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2980	Unicorn-37251.exe
4016	Unicorn-38367.exe
1004	Unicorn-57396.exe
1932	Unicorn-49633.exe
3548	Unicorn-33851.exe
4828	Unicorn-6654.exe
3372	Unicorn-22013.exe
1568	Unicorn-45331.exe
800	Unicorn-45886.exe
3952	Unicorn-57583.exe
2540	Unicorn-55537.exe
3916	Unicorn-16551.exe
1952	Unicorn-51361.exe
4088	Unicorn-52985.exe
3880	Unicorn-55180.exe
2620	Unicorn-58735.exe
2128	Unicorn-59290.exe
4760	Unicorn-13618.exe
4844	Unicorn-58635.exe
3116	Unicorn-31901.exe
2228	Unicorn-13981.exe
1948	Unicorn-33582.exe
4900	Unicorn-13981.exe
3680	Unicorn-24610.exe
1548	Unicorn-47168.exe
3192	Unicorn-11294.exe
696	Unicorn-24309.exe
1232	Unicorn-14094.exe
744	Unicorn-61812.exe
3076	Unicorn-10686.exe
4044	Unicorn-15325.exe
3200	Unicorn-58626.exe
232	Unicorn-43914.exe
2232	Unicorn-13187.exe
4296	Unicorn-13187.exe
1636	Unicorn-53473.exe
4324	Unicorn-10494.exe
3196	Unicorn-63679.exe
4816	Unicorn-30915.exe
5088	Unicorn-65460.exe
4108	Unicorn-44490.exe
4424	Unicorn-9472.exe
2968	Unicorn-25900.exe
4812	Unicorn-5388.exe
4672	Unicorn-10027.exe
2140	Unicorn-29893.exe
1580	Unicorn-29893.exe
1528	Unicorn-48367.exe
2992	Unicorn-21725.exe
1424	Unicorn-42145.exe
3940	Unicorn-58573.exe
556	Unicorn-21725.exe
4476	Unicorn-21725.exe
4200	Unicorn-20763.exe
860	Unicorn-64438.exe
4620	Unicorn-11725.exe
2564	Unicorn-790.exe
4956	Unicorn-34945.exe
1560	Unicorn-13748.exe
1512	Unicorn-32223.exe
3228	Unicorn-33846.exe
4400	Unicorn-30176.exe
4732	Unicorn-46421.exe
3332	Unicorn-45030.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
14088	5784	WerFault.exe	211

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49633.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26712.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19141.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64334.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5388.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41159.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33461.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34365.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43137.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30560.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56483.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18029.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8516.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9472.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19810.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4599.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64438.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17645.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18544.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40400.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54454.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3472.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16847.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39915.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57502.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17357.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22576.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44247.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13229.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41547.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58735.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17017.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4536.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31671.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10359.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52468.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64420.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	4056	dwm.exe
Token: SeChangeNotifyPrivilege	4056	dwm.exe
Token: 33	4056	dwm.exe
Token: SeIncBasePriorityPrivilege	4056	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3468	afd708116f94388ca2b5958afb17515de63bf7342aa4adbdea2feb8f3faa0cf2N.exe
2980	Unicorn-37251.exe
4016	Unicorn-38367.exe
1004	Unicorn-57396.exe
1932	Unicorn-49633.exe
3548	Unicorn-33851.exe
4828	Unicorn-6654.exe
3372	Unicorn-22013.exe
1568	Unicorn-45331.exe
800	Unicorn-45886.exe
3916	Unicorn-16551.exe
2540	Unicorn-55537.exe
3952	Unicorn-57583.exe
3880	Unicorn-55180.exe
1952	Unicorn-51361.exe
4088	Unicorn-52985.exe
2620	Unicorn-58735.exe
4760	Unicorn-13618.exe
2128	Unicorn-59290.exe
4844	Unicorn-58635.exe
3116	Unicorn-31901.exe
1548	Unicorn-47168.exe
4900	Unicorn-13981.exe
2228	Unicorn-13981.exe
3192	Unicorn-11294.exe
3680	Unicorn-24610.exe
1948	Unicorn-33582.exe
744	Unicorn-61812.exe
696	Unicorn-24309.exe
1232	Unicorn-14094.exe
3076	Unicorn-10686.exe
4044	Unicorn-15325.exe
3200	Unicorn-58626.exe
1636	Unicorn-53473.exe
4324	Unicorn-10494.exe
232	Unicorn-43914.exe
4296	Unicorn-13187.exe
3196	Unicorn-63679.exe
4816	Unicorn-30915.exe
5088	Unicorn-65460.exe
4108	Unicorn-44490.exe
4424	Unicorn-9472.exe
2968	Unicorn-25900.exe
4812	Unicorn-5388.exe
4672	Unicorn-10027.exe
2140	Unicorn-29893.exe
1580	Unicorn-29893.exe
4200	Unicorn-20763.exe
1424	Unicorn-42145.exe
3940	Unicorn-58573.exe
4620	Unicorn-11725.exe
860	Unicorn-64438.exe
1528	Unicorn-48367.exe
2992	Unicorn-21725.exe
556	Unicorn-21725.exe
4476	Unicorn-21725.exe
4956	Unicorn-34945.exe
2564	Unicorn-790.exe
1560	Unicorn-13748.exe
1512	Unicorn-32223.exe
4400	Unicorn-30176.exe
3228	Unicorn-33846.exe
3332	Unicorn-45030.exe
4732	Unicorn-46421.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 2980	3468	afd708116f94388ca2b5958afb17515de63bf7342aa4adbdea2feb8f3faa0cf2N.exe	82
PID 3468 wrote to memory of 2980	3468	afd708116f94388ca2b5958afb17515de63bf7342aa4adbdea2feb8f3faa0cf2N.exe	82
PID 3468 wrote to memory of 2980	3468	afd708116f94388ca2b5958afb17515de63bf7342aa4adbdea2feb8f3faa0cf2N.exe	82
PID 2980 wrote to memory of 4016	2980	Unicorn-37251.exe	83
PID 2980 wrote to memory of 4016	2980	Unicorn-37251.exe	83
PID 2980 wrote to memory of 4016	2980	Unicorn-37251.exe	83
PID 3468 wrote to memory of 1004	3468	afd708116f94388ca2b5958afb17515de63bf7342aa4adbdea2feb8f3faa0cf2N.exe	84
PID 3468 wrote to memory of 1004	3468	afd708116f94388ca2b5958afb17515de63bf7342aa4adbdea2feb8f3faa0cf2N.exe	84
PID 3468 wrote to memory of 1004	3468	afd708116f94388ca2b5958afb17515de63bf7342aa4adbdea2feb8f3faa0cf2N.exe	84
PID 4016 wrote to memory of 1932	4016	Unicorn-38367.exe	85
PID 4016 wrote to memory of 1932	4016	Unicorn-38367.exe	85
PID 4016 wrote to memory of 1932	4016	Unicorn-38367.exe	85
PID 2980 wrote to memory of 3548	2980	Unicorn-37251.exe	86
PID 2980 wrote to memory of 3548	2980	Unicorn-37251.exe	86
PID 2980 wrote to memory of 3548	2980	Unicorn-37251.exe	86
PID 1004 wrote to memory of 4828	1004	Unicorn-57396.exe	87
PID 1004 wrote to memory of 4828	1004	Unicorn-57396.exe	87
PID 1004 wrote to memory of 4828	1004	Unicorn-57396.exe	87
PID 3468 wrote to memory of 3372	3468	afd708116f94388ca2b5958afb17515de63bf7342aa4adbdea2feb8f3faa0cf2N.exe	88
PID 3468 wrote to memory of 3372	3468	afd708116f94388ca2b5958afb17515de63bf7342aa4adbdea2feb8f3faa0cf2N.exe	88
PID 3468 wrote to memory of 3372	3468	afd708116f94388ca2b5958afb17515de63bf7342aa4adbdea2feb8f3faa0cf2N.exe	88
PID 1932 wrote to memory of 1568	1932	Unicorn-49633.exe	89
PID 1932 wrote to memory of 1568	1932	Unicorn-49633.exe	89
PID 1932 wrote to memory of 1568	1932	Unicorn-49633.exe	89
PID 4016 wrote to memory of 800	4016	Unicorn-38367.exe	90
PID 4016 wrote to memory of 800	4016	Unicorn-38367.exe	90
PID 4016 wrote to memory of 800	4016	Unicorn-38367.exe	90
PID 3548 wrote to memory of 3952	3548	Unicorn-33851.exe	91
PID 3548 wrote to memory of 3952	3548	Unicorn-33851.exe	91
PID 3548 wrote to memory of 3952	3548	Unicorn-33851.exe	91
PID 2980 wrote to memory of 2540	2980	Unicorn-37251.exe	92
PID 2980 wrote to memory of 2540	2980	Unicorn-37251.exe	92
PID 2980 wrote to memory of 2540	2980	Unicorn-37251.exe	92
PID 4828 wrote to memory of 3916	4828	Unicorn-6654.exe	93
PID 4828 wrote to memory of 3916	4828	Unicorn-6654.exe	93
PID 4828 wrote to memory of 3916	4828	Unicorn-6654.exe	93
PID 3372 wrote to memory of 1952	3372	Unicorn-22013.exe	94
PID 3372 wrote to memory of 1952	3372	Unicorn-22013.exe	94
PID 3372 wrote to memory of 1952	3372	Unicorn-22013.exe	94
PID 1004 wrote to memory of 4088	1004	Unicorn-57396.exe	95
PID 1004 wrote to memory of 4088	1004	Unicorn-57396.exe	95
PID 1004 wrote to memory of 4088	1004	Unicorn-57396.exe	95
PID 3468 wrote to memory of 3880	3468	afd708116f94388ca2b5958afb17515de63bf7342aa4adbdea2feb8f3faa0cf2N.exe	96
PID 3468 wrote to memory of 3880	3468	afd708116f94388ca2b5958afb17515de63bf7342aa4adbdea2feb8f3faa0cf2N.exe	96
PID 3468 wrote to memory of 3880	3468	afd708116f94388ca2b5958afb17515de63bf7342aa4adbdea2feb8f3faa0cf2N.exe	96
PID 1568 wrote to memory of 2620	1568	Unicorn-45331.exe	97
PID 1568 wrote to memory of 2620	1568	Unicorn-45331.exe	97
PID 1568 wrote to memory of 2620	1568	Unicorn-45331.exe	97
PID 800 wrote to memory of 4760	800	Unicorn-45886.exe	98
PID 800 wrote to memory of 4760	800	Unicorn-45886.exe	98
PID 800 wrote to memory of 4760	800	Unicorn-45886.exe	98
PID 1932 wrote to memory of 2128	1932	Unicorn-49633.exe	99
PID 1932 wrote to memory of 2128	1932	Unicorn-49633.exe	99
PID 1932 wrote to memory of 2128	1932	Unicorn-49633.exe	99
PID 4016 wrote to memory of 4844	4016	Unicorn-38367.exe	100
PID 4016 wrote to memory of 4844	4016	Unicorn-38367.exe	100
PID 4016 wrote to memory of 4844	4016	Unicorn-38367.exe	100
PID 3952 wrote to memory of 3116	3952	Unicorn-57583.exe	101
PID 3952 wrote to memory of 3116	3952	Unicorn-57583.exe	101
PID 3952 wrote to memory of 3116	3952	Unicorn-57583.exe	101
PID 4828 wrote to memory of 2228	4828	Unicorn-6654.exe	102
PID 4828 wrote to memory of 2228	4828	Unicorn-6654.exe	102
PID 4828 wrote to memory of 2228	4828	Unicorn-6654.exe	102
PID 3548 wrote to memory of 4900	3548	Unicorn-33851.exe	104

C:\Users\Admin\AppData\Local\Temp\afd708116f94388ca2b5958afb17515de63bf7342aa4adbdea2feb8f3faa0cf2N.exe
"C:\Users\Admin\AppData\Local\Temp\afd708116f94388ca2b5958afb17515de63bf7342aa4adbdea2feb8f3faa0cf2N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37251.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37251.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38367.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49633.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45331.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58735.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10686.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13748.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32690.exe
        9⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57552.exe
        10⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15170.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58040.exe
        12⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47769.exe
        12⤵
        
        PID:15608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40115.exe
        11⤵
        
        PID:13448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12546.exe
        11⤵
        
        PID:16208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31267.exe
        10⤵
        
        PID:9716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
        10⤵
        
        PID:13532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6509.exe
        10⤵
        
        PID:14412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56475.exe
        10⤵
        
        PID:15504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19948.exe
        9⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        10⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19430.exe
        9⤵
        
        PID:12036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5221.exe
        9⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24007.exe
        8⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56483.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18544.exe
        10⤵
        
        PID:9608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2624.exe
        10⤵
        
        PID:12972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1614.exe
        9⤵
        
        PID:10716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40031.exe
        9⤵
        
        PID:452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12610.exe
        8⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45186.exe
        9⤵
        
        PID:9656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41731.exe
        8⤵
        
        PID:12992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23413.exe
        8⤵
        
        PID:16296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        8⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33846.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62108.exe
        8⤵
        
        PID:3884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56997.exe
        9⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6675.exe
        9⤵
        
        PID:10800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28474.exe
        8⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21251.exe
        8⤵
        
        PID:14824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60320.exe
        8⤵
        
        PID:15076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46054.exe
        8⤵
        
        PID:14032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27471.exe
        8⤵
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37743.exe
        7⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29047.exe
        8⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26581.exe
        9⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35870.exe
        8⤵
        
        PID:12400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45250.exe
        8⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52456.exe
        7⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        8⤵
        
        PID:10376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54813.exe
        7⤵
        
        PID:12064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15325.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32223.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15284.exe
        8⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34501.exe
        9⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5902.exe
        10⤵
        
        PID:14740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25218.exe
        10⤵
        
        PID:1800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35735.exe
        9⤵
        
        PID:10232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54337.exe
        10⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8516.exe
        9⤵
        
        PID:14824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39715.exe
        8⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23871.exe
        8⤵
        
        PID:12120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28992.exe
        8⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1449.exe
        7⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63857.exe
        8⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62591.exe
        9⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26664.exe
        8⤵
        
        PID:11824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41166.exe
        8⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46591.exe
        7⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23934.exe
        8⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41304.exe
        7⤵
        
        PID:11728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30176.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62108.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56997.exe
        8⤵
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46390.exe
        9⤵
        
        PID:14288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64775.exe
        9⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5030.exe
        8⤵
        
        PID:12436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1244.exe
        8⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27405.exe
        7⤵
        
        PID:8500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12811.exe
        8⤵
        
        PID:8892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43764.exe
        7⤵
        
        PID:13748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39445.exe
        7⤵
        
        PID:15412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40066.exe
        7⤵
        
        PID:16216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20554.exe
        7⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43608.exe
        6⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29047.exe
        7⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30303.exe
        8⤵
        
        PID:11212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22692.exe
        8⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60292.exe
        7⤵
        
        PID:13676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42377.exe
        7⤵
        
        PID:13500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43791.exe
        6⤵
        
        PID:7268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20379.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30533.exe
        6⤵
        
        PID:15020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32577.exe
        6⤵
        
        PID:14588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59290.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53473.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10240.exe
        7⤵
        
        PID:2352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1086.exe
        8⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36639.exe
        9⤵
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34029.exe
        10⤵
        
        PID:8408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41569.exe
        11⤵
        
        PID:12292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25749.exe
        11⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32056.exe
        10⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21664.exe
        10⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35735.exe
        9⤵
        
        PID:10208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8516.exe
        9⤵
        
        PID:14888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5105.exe
        9⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32503.exe
        8⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62197.exe
        9⤵
        
        PID:14496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40106.exe
        9⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48529.exe
        8⤵
        
        PID:12024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23989.exe
        8⤵
        
        PID:13404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        7⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51906.exe
        8⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11444.exe
        9⤵
        
        PID:11204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12840.exe
        10⤵
        
        PID:15840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22692.exe
        9⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49140.exe
        8⤵
        
        PID:10772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
        7⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11382.exe
        8⤵
        
        PID:12724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33069.exe
        7⤵
        
        PID:12340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56333.exe
        8⤵
        
        PID:16108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23047.exe
        6⤵
        
        PID:3836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6623.exe
        7⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34501.exe
        8⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35456.exe
        9⤵
        
        PID:10972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15133.exe
        9⤵
        
        PID:15852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44223.exe
        9⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46426.exe
        8⤵
        
        PID:10864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3422.exe
        9⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25485.exe
        7⤵
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46717.exe
        8⤵
        
        PID:15148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26296.exe
        8⤵
        
        PID:15004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-714.exe
        8⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52342.exe
        7⤵
        
        PID:13280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22750.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19810.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1138.exe
        8⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26664.exe
        7⤵
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11926.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18768.exe
        7⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6356.exe
        7⤵
        
        PID:15988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17645.exe
        6⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-723.exe
        7⤵
        
        PID:13404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        7⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32638.exe
        6⤵
        
        PID:9820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63679.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53027.exe
        6⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26551.exe
        7⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60671.exe
        8⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25429.exe
        7⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14573.exe
        7⤵
        
        PID:13684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9305.exe
        7⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60053.exe
        6⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27506.exe
        7⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16479.exe
        8⤵
        
        PID:15388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57454.exe
        8⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4733.exe
        7⤵
        
        PID:15300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-462.exe
        6⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42052.exe
        7⤵
        
        PID:6268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46670.exe
        6⤵
        
        PID:14580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10966.exe
        6⤵
        
        PID:15472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32806.exe
        6⤵
        
        PID:6852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63945.exe
        5⤵
        
        PID:716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32773.exe
        6⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10510.exe
        7⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27095.exe
        7⤵
        
        PID:12928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19712.exe
        8⤵
        
        PID:13932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32112.exe
        8⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55981.exe
        7⤵
        
        PID:15528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12811.exe
        7⤵
        
        PID:8876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25045.exe
        6⤵
        
        PID:8600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41407.exe
        6⤵
        
        PID:13624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32839.exe
        6⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-134.exe
        6⤵
        
        PID:1112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24994.exe
        5⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62591.exe
        6⤵
        
        PID:9392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64334.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12386.exe
        6⤵
        
        PID:7644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56970.exe
        5⤵
        
        PID:9896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38535.exe
        5⤵
        
        PID:14592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45886.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13618.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58626.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46421.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11200.exe
        8⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52015.exe
        9⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27999.exe
        10⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25363.exe
        11⤵
        
        PID:12636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45631.exe
        11⤵
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35351.exe
        9⤵
        
        PID:9600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5684.exe
        10⤵
        
        PID:15176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45631.exe
        10⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13586.exe
        9⤵
        
        PID:14296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22239.exe
        9⤵
        
        PID:3420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28153.exe
        9⤵
        
        PID:15140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20102.exe
        9⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10359.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6274.exe
        9⤵
        
        PID:11424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32993.exe
        9⤵
        
        PID:15852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20926.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33636.exe
        8⤵
        
        PID:15328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52293.exe
        8⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        7⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30033.exe
        8⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        9⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6965.exe
        9⤵
        
        PID:16216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6191.exe
        8⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30316.exe
        7⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26930.exe
        8⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64620.exe
        8⤵
        
        PID:13516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28526.exe
        8⤵
        
        PID:14592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2080.exe
        8⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51444.exe
        7⤵
        
        PID:9948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42737.exe
        8⤵
        
        PID:16348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38004.exe
        7⤵
        
        PID:14572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15286.exe
        7⤵
        
        PID:16072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45030.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22576.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34501.exe
        8⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62591.exe
        9⤵
        
        PID:9924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10628.exe
        9⤵
        
        PID:14240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46426.exe
        8⤵
        
        PID:10552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51936.exe
        7⤵
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2337.exe
        8⤵
        
        PID:11476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43270.exe
        8⤵
        
        PID:15096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14074.exe
        8⤵
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61217.exe
        8⤵
        
        PID:16220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36006.exe
        7⤵
        
        PID:13200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60211.exe
        7⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64420.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37743.exe
        6⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36639.exe
        7⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45186.exe
        8⤵
        
        PID:10104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14180.exe
        8⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44223.exe
        8⤵
        
        PID:13036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35735.exe
        7⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58563.exe
        8⤵
        
        PID:13932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8516.exe
        7⤵
        
        PID:15016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60335.exe
        7⤵
        
        PID:3956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59316.exe
        6⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7111.exe
        7⤵
        
        PID:14876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21071.exe
        6⤵
        
        PID:12072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59249.exe
        6⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38720.exe
        7⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28279.exe
        8⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62591.exe
        9⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14876.exe
        9⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50510.exe
        8⤵
        
        PID:10500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26554.exe
        7⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15056.exe
        8⤵
        
        PID:11436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8683.exe
        8⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35129.exe
        7⤵
        
        PID:12940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10350.exe
        7⤵
        
        PID:15348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20504.exe
        7⤵
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29427.exe
        7⤵
        
        PID:14924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1645.exe
        6⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59581.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10136.exe
        7⤵
        
        PID:12144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38613.exe
        7⤵
        
        PID:15796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22692.exe
        7⤵
        
        PID:6252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7723.exe
        6⤵
        
        PID:8472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21694.exe
        6⤵
        
        PID:12624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8002.exe
        5⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8076.exe
        6⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56997.exe
        7⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16405.exe
        7⤵
        
        PID:13188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31971.exe
        7⤵
        
        PID:13068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2487.exe
        6⤵
        
        PID:8376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4376.exe
        6⤵
        
        PID:15292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
        5⤵
        
        PID:1236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63857.exe
        6⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44247.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31127.exe
        7⤵
        
        PID:14596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12811.exe
        7⤵
        
        PID:8920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45902.exe
        6⤵
        
        PID:13700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64621.exe
        6⤵
        
        PID:15200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45629.exe
        6⤵
        
        PID:1268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39839.exe
        6⤵
        
        PID:16196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28407.exe
        5⤵
        
        PID:8824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37615.exe
        6⤵
        
        PID:12380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27157.exe
        6⤵
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11918.exe
        5⤵
        
        PID:13276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23598.exe
        5⤵
        
        PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58635.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10494.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48943.exe
        6⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65253.exe
        7⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56997.exe
        8⤵
        
        PID:8648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51237.exe
        9⤵
        
        PID:13144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
        9⤵
        
        PID:16216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54807.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21664.exe
        8⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39933.exe
        7⤵
        
        PID:9556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9783.exe
        6⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58149.exe
        7⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60536.exe
        7⤵
        
        PID:13492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24442.exe
        7⤵
        
        PID:13584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45099.exe
        7⤵
        
        PID:15072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39165.exe
        6⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40935.exe
        7⤵
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36187.exe
        7⤵
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40719.exe
        6⤵
        
        PID:13972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16380.exe
        6⤵
        
        PID:4460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44345.exe
        5⤵
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52762.exe
        6⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18029.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53633.exe
        7⤵
        
        PID:14620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17357.exe
        7⤵
        
        PID:6400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21567.exe
        6⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22643.exe
        7⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9337.exe
        6⤵
        
        PID:14216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-134.exe
        6⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45008.exe
        5⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18029.exe
        6⤵
        
        PID:9004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8516.exe
        6⤵
        
        PID:14984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17357.exe
        6⤵
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59228.exe
        5⤵
        
        PID:9260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49873.exe
        5⤵
        
        PID:14152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65460.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22301.exe
        5⤵
        
        PID:3524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5938.exe
        6⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15087.exe
        7⤵
        
        PID:8632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53099.exe
        8⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6675.exe
        7⤵
        
        PID:12896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2487.exe
        6⤵
        
        PID:8420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47629.exe
        6⤵
        
        PID:13556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe
        6⤵
        
        PID:14292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9783.exe
        5⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15170.exe
        6⤵
        
        PID:8072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40115.exe
        6⤵
        
        PID:13456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61329.exe
        6⤵
        
        PID:14228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31440.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39165.exe
        5⤵
        
        PID:7616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54454.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51399.exe
        5⤵
        
        PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55280.exe
      4⤵
      PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5938.exe
        5⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8434.exe
        6⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
        7⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38760.exe
        7⤵
        
        PID:16228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54337.exe
        7⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26664.exe
        6⤵
        
        PID:11888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29940.exe
        6⤵
        
        PID:14640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10258.exe
        6⤵
        
        PID:15524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12819.exe
        5⤵
        
        PID:8388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51237.exe
        6⤵
        
        PID:12948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25749.exe
        6⤵
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36171.exe
        5⤵
        
        PID:11200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62871.exe
        5⤵
        
        PID:13992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10440.exe
        5⤵
        
        PID:3444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25672.exe
      4⤵
      PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        5⤵
        
        PID:9904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53226.exe
        5⤵
        
        PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36895.exe
      4⤵
      PID:8084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24788.exe
      4⤵
      PID:14036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33070.exe
      4⤵
      PID:4024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33851.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33851.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57583.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31901.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30915.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14132.exe
        7⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45409.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10100.exe
        9⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
        10⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33893.exe
        9⤵
        
        PID:13596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27117.exe
        9⤵
        
        PID:4584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25429.exe
        8⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49384.exe
        8⤵
        
        PID:13764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11251.exe
        8⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63072.exe
        7⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41569.exe
        8⤵
        
        PID:11112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54419.exe
        8⤵
        
        PID:15988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25749.exe
        8⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35091.exe
        7⤵
        
        PID:13664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29077.exe
        6⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57552.exe
        7⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25773.exe
        8⤵
        
        PID:12712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30137.exe
        8⤵
        
        PID:10492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31251.exe
        8⤵
        
        PID:13404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1614.exe
        7⤵
        
        PID:10652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28032.exe
        7⤵
        
        PID:15464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        7⤵
        
        PID:1584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35169.exe
        6⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12513.exe
        7⤵
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39924.exe
        8⤵
        
        PID:14612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62167.exe
        8⤵
        
        PID:4980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52788.exe
        6⤵
        
        PID:11732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44490.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26385.exe
        6⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26551.exe
        7⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43245.exe
        8⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28850.exe
        9⤵
        
        PID:11192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23949.exe
        9⤵
        
        PID:13736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41166.exe
        9⤵
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26664.exe
        8⤵
        
        PID:11856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37816.exe
        7⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59104.exe
        8⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49715.exe
        8⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35102.exe
        7⤵
        
        PID:12496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19627.exe
        7⤵
        
        PID:3204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13766.exe
        7⤵
        
        PID:15372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22227.exe
        6⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
        7⤵
        
        PID:10372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38760.exe
        7⤵
        
        PID:16284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45579.exe
        6⤵
        
        PID:9940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9327.exe
        7⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64423.exe
        7⤵
        
        PID:13972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3037.exe
        7⤵
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54262.exe
        6⤵
        
        PID:12092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36591.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38611.exe
        6⤵
        
        PID:3304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63857.exe
        7⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36525.exe
        8⤵
        
        PID:10484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44907.exe
        8⤵
        
        PID:15492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4218.exe
        8⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26664.exe
        7⤵
        
        PID:11880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47206.exe
        7⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63966.exe
        6⤵
        
        PID:8348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19141.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10821.exe
        7⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46477.exe
        6⤵
        
        PID:13300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34762.exe
        6⤵
        
        PID:14188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39498.exe
        5⤵
        
        PID:6160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        6⤵
        
        PID:9124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53633.exe
        6⤵
        
        PID:14756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52468.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46287.exe
        5⤵
        
        PID:9580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59788.exe
        5⤵
        
        PID:14304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64536.exe
        5⤵
        
        PID:5232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13981.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42145.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57879.exe
        6⤵
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50069.exe
        7⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6016.exe
        8⤵
        
        PID:9084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57412.exe
        8⤵
        
        PID:13984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-486.exe
        8⤵
        
        PID:15532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7832.exe
        7⤵
        
        PID:9332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48589.exe
        7⤵
        
        PID:14132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42377.exe
        7⤵
        
        PID:13972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-134.exe
        7⤵
        
        PID:2156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48185.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
        7⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17271.exe
        7⤵
        
        PID:13968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52487.exe
        6⤵
        
        PID:11756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46758.exe
        5⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57552.exe
        6⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        7⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32806.exe
        7⤵
        
        PID:7136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35735.exe
        6⤵
        
        PID:10216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48881.exe
        7⤵
        
        PID:14880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
        7⤵
        
        PID:7672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-348.exe
        6⤵
        
        PID:15032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39915.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12610.exe
        5⤵
        
        PID:7488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19826.exe
        6⤵
        
        PID:12376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33508.exe
        6⤵
        
        PID:4792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13853.exe
        6⤵
        
        PID:468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46265.exe
        5⤵
        
        PID:11840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34945.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16847.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30033.exe
        6⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58450.exe
        7⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1211.exe
        8⤵
        
        PID:13440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-453.exe
        7⤵
        
        PID:11812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19446.exe
        7⤵
        
        PID:14708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2487.exe
        6⤵
        
        PID:8368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21768.exe
        6⤵
        
        PID:15804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53338.exe
        5⤵
        
        PID:6260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54999.exe
        6⤵
        
        PID:9724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12574.exe
        6⤵
        
        PID:13624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10672.exe
        6⤵
        
        PID:16216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22692.exe
        6⤵
        
        PID:5424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23980.exe
        5⤵
        
        PID:10704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55175.exe
      4⤵
      PID:4836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52015.exe
        5⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49253.exe
        6⤵
        
        PID:11440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63719.exe
        6⤵
        
        PID:15832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
        6⤵
        
        PID:6464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6191.exe
        5⤵
        
        PID:9936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41295.exe
        5⤵
        
        PID:16248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65342.exe
      4⤵
      PID:5684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        5⤵
        
        PID:9632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9030.exe
      4⤵
      PID:10580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19567.exe
      4⤵
      PID:15100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31560.exe
      4⤵
      PID:14980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15096.exe
      4⤵
      PID:14880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55537.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13187.exe
      4⤵
      Executes dropped EXE
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24439.exe
        5⤵
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55824.exe
        6⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57168.exe
        7⤵
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10017.exe
        8⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        9⤵
        
        PID:12468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40115.exe
        8⤵
        
        PID:13472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22692.exe
        8⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6191.exe
        7⤵
        
        PID:9956
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5784 -s 672
        7⤵
        Program crash
        
        PID:14088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16581.exe
        6⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17885.exe
        7⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9886.exe
        7⤵
        
        PID:14992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64053.exe
        6⤵
        
        PID:9840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13229.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52295.exe
        5⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29047.exe
        6⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44117.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56817.exe
        7⤵
        
        PID:8936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61443.exe
        6⤵
        
        PID:11460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21205.exe
        6⤵
        
        PID:13768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29609.exe
        6⤵
        
        PID:7800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9560.exe
        5⤵
        
        PID:8836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11388.exe
        5⤵
        
        PID:13296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9305.exe
        5⤵
        
        PID:5240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30560.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12928.exe
        5⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49981.exe
        6⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2031.exe
        7⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40115.exe
        6⤵
        
        PID:13464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28526.exe
        6⤵
        
        PID:13644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53267.exe
        6⤵
        
        PID:14100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25429.exe
        5⤵
        
        PID:8732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49384.exe
        5⤵
        
        PID:13964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40031.exe
        5⤵
        
        PID:13636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58819.exe
      4⤵
      PID:7360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
        5⤵
        
        PID:10004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38760.exe
        5⤵
        
        PID:16304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32806.exe
        5⤵
        
        PID:6872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4152.exe
      4⤵
      PID:11596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55009.exe
      4⤵
      PID:2024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33582.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33582.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21725.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21123.exe
        5⤵
        
        PID:3576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50069.exe
        6⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39819.exe
        7⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8516.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61226.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20696.exe
        7⤵
        
        PID:15120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7051.exe
        7⤵
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7832.exe
        6⤵
        
        PID:9368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29964.exe
        7⤵
        
        PID:15108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3472.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31848.exe
        5⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-863.exe
        6⤵
        
        PID:8464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22601.exe
        6⤵
        
        PID:13956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53764.exe
        6⤵
        
        PID:14200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5917.exe
        5⤵
        
        PID:11468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27947.exe
        5⤵
        
        PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35574.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35574.exe
      4⤵
      PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42669.exe
        5⤵
        
        PID:6976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9436.exe
        6⤵
        
        PID:12672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9337.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29113.exe
        6⤵
        
        PID:12152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50702.exe
        5⤵
        
        PID:8196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17357.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37115.exe
      4⤵
      PID:7392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16131.exe
        5⤵
        
        PID:8996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34853.exe
        5⤵
        
        PID:14068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34878.exe
        5⤵
        
        PID:15272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8683.exe
        5⤵
        
        PID:7820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17017.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59358.exe
      4⤵
      PID:5736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11725.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11725.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21123.exe
      4⤵
      PID:2364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33733.exe
        5⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16816.exe
        6⤵
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29619.exe
        6⤵
        
        PID:3108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25429.exe
        5⤵
        
        PID:8552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42871.exe
        6⤵
        
        PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49384.exe
        5⤵
        
        PID:14600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47901.exe
        5⤵
        
        PID:14360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34980.exe
        5⤵
        
        PID:15432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19419.exe
        5⤵
        
        PID:3180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe
      4⤵
      PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11086.exe
        5⤵
        
        PID:8024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9462.exe
        6⤵
        
        PID:15888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40115.exe
        5⤵
        
        PID:14480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17042.exe
        5⤵
        
        PID:14656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19939.exe
        5⤵
        
        PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62697.exe
        5⤵
        
        PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49087.exe
      4⤵
      PID:9612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42010.exe
      4⤵
      PID:12860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59790.exe
      4⤵
      PID:15340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22692.exe
      4⤵
      PID:3944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55548.exe
    3⤵
    PID:976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57552.exe
      4⤵
      PID:7004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22545.exe
        5⤵
        
        PID:9488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-920.exe
        5⤵
        
        PID:14244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39409.exe
        5⤵
        
        PID:7668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46426.exe
      4⤵
      PID:10544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36799.exe
        5⤵
        
        PID:2180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1211.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10340.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10340.exe
    3⤵
    PID:7472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20080.exe
      4⤵
      PID:12416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33917.exe
      4⤵
      PID:7880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60646.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60646.exe
    3⤵
    PID:11780
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57396.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57396.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6654.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6654.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16551.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13187.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36691.exe
        6⤵
        
        PID:2936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8351.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
        8⤵
        
        PID:9968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36084.exe
        8⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45250.exe
        8⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52264.exe
        7⤵
        
        PID:9976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54126.exe
        7⤵
        
        PID:14652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33685.exe
        6⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62591.exe
        7⤵
        
        PID:9248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65327.exe
        7⤵
        
        PID:15508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44223.exe
        7⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40400.exe
        6⤵
        
        PID:11832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42813.exe
        5⤵
        
        PID:3232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48917.exe
        6⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40853.exe
        7⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10199.exe
        8⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21558.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe
        7⤵
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22139.exe
        6⤵
        
        PID:9148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51329.exe
        6⤵
        
        PID:12244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20554.exe
        6⤵
        
        PID:908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49804.exe
        5⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10593.exe
        6⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25856.exe
        7⤵
        
        PID:12048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45761.exe
        7⤵
        
        PID:15176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18767.exe
        5⤵
        
        PID:9352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1542.exe
        5⤵
        
        PID:14176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18599.exe
        5⤵
        
        PID:15860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13981.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9472.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
        6⤵
        
        PID:4468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1636.exe
        7⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        8⤵
        
        PID:10344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-134.exe
        8⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47687.exe
        7⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27471.exe
        7⤵
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49337.exe
        6⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7490.exe
        7⤵
        
        PID:12220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41735.exe
        6⤵
        
        PID:10512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27471.exe
        6⤵
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2819.exe
        5⤵
        
        PID:2172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62321.exe
        6⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34365.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49715.exe
        8⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7352.exe
        7⤵
        
        PID:16192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40504.exe
        6⤵
        
        PID:9536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54619.exe
        6⤵
        
        PID:14268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43145.exe
        6⤵
        
        PID:14124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49495.exe
        6⤵
        
        PID:15528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-134.exe
        6⤵
        
        PID:14288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2605.exe
        5⤵
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65331.exe
        6⤵
        
        PID:9116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43519.exe
        6⤵
        
        PID:13316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1021.exe
        6⤵
        
        PID:15532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-681.exe
        5⤵
        
        PID:10268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25900.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41159.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6130.exe
        6⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8564.exe
        7⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29312.exe
        8⤵
        
        PID:15040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45897.exe
        7⤵
        
        PID:14972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39933.exe
        6⤵
        
        PID:9544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64536.exe
        6⤵
        
        PID:7948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52954.exe
        5⤵
        
        PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11563.exe
        5⤵
        
        PID:10916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28960.exe
        5⤵
        
        PID:16268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18326.exe
        5⤵
        
        PID:3420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32726.exe
      4⤵
      PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6130.exe
        5⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15170.exe
        6⤵
        
        PID:8124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40115.exe
        6⤵
        
        PID:13440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61329.exe
        6⤵
        
        PID:15204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33998.exe
        6⤵
        
        PID:15788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25429.exe
        5⤵
        
        PID:8564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49384.exe
        5⤵
        
        PID:14020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64536.exe
        5⤵
        
        PID:15892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63889.exe
      4⤵
      PID:6788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36359.exe
        5⤵
        
        PID:7888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64620.exe
        5⤵
        
        PID:13524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9712.exe
        5⤵
        
        PID:13768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2080.exe
        5⤵
        
        PID:11364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52310.exe
      4⤵
      PID:9660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33875.exe
      4⤵
      PID:14328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37429.exe
      4⤵
      PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59358.exe
      4⤵
      PID:5964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52985.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47168.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29893.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21123.exe
        6⤵
        
        PID:5116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50069.exe
        7⤵
        
        PID:2544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3494.exe
        8⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45399.exe
        9⤵
        
        PID:12408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34766.exe
        9⤵
        
        PID:14120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64620.exe
        8⤵
        
        PID:13508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5903.exe
        8⤵
        
        PID:13808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54337.exe
        8⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7832.exe
        7⤵
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20877.exe
        7⤵
        
        PID:14184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61932.exe
        7⤵
        
        PID:15200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33917.exe
        7⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7453.exe
        6⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18029.exe
        7⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25880.exe
        8⤵
        
        PID:9660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41425.exe
        7⤵
        
        PID:13808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29933.exe
        7⤵
        
        PID:14292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17357.exe
        7⤵
        
        PID:7988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6108.exe
        6⤵
        
        PID:9668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11283.exe
        6⤵
        
        PID:13332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17357.exe
        6⤵
        
        PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13016.exe
        5⤵
        
        PID:1116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25757.exe
        6⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62591.exe
        7⤵
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2080.exe
        7⤵
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62570.exe
        6⤵
        
        PID:9916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40805.exe
        6⤵
        
        PID:15204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35169.exe
        5⤵
        
        PID:7428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12513.exe
        6⤵
        
        PID:11044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44030.exe
        6⤵
        
        PID:8264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16851.exe
        6⤵
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46265.exe
        5⤵
        
        PID:11848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-790.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57879.exe
        5⤵
        
        PID:404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50069.exe
        6⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56924.exe
        7⤵
        
        PID:8436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7832.exe
        6⤵
        
        PID:9308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4541.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34762.exe
        6⤵
        
        PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29330.exe
        5⤵
        
        PID:7832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27356.exe
        6⤵
        
        PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29737.exe
        5⤵
        
        PID:12176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3083.exe
        5⤵
        
        PID:15480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9346.exe
      4⤵
      PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12710.exe
        5⤵
        
        PID:6760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        6⤵
        
        PID:8884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22348.exe
        6⤵
        
        PID:15548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8299.exe
        5⤵
        
        PID:11148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36120.exe
      4⤵
      PID:7236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59104.exe
        5⤵
        
        PID:13344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44223.exe
        5⤵
        
        PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43137.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43137.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13467.exe
      4⤵
      PID:2956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14094.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14094.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21725.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4355.exe
        5⤵
        
        PID:868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-396.exe
        6⤵
        
        PID:8592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16405.exe
        6⤵
        
        PID:13176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44044.exe
        5⤵
        
        PID:10920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41603.exe
        5⤵
        
        PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5725.exe
      4⤵
      PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29047.exe
        5⤵
        
        PID:7688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18544.exe
        6⤵
        
        PID:9984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45902.exe
        5⤵
        
        PID:13692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12386.exe
        5⤵
        
        PID:7648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11780.exe
      4⤵
      PID:7544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62793.exe
      4⤵
      PID:12132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21557.exe
      4⤵
      PID:6488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64438.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64438.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57879.exe
      4⤵
      PID:2276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57552.exe
        5⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5632.exe
        6⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57795.exe
        7⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42244.exe
        7⤵
        
        PID:16212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
        6⤵
        
        PID:13416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52456.exe
        5⤵
        
        PID:9740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
        5⤵
        
        PID:12412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52391.exe
        5⤵
        
        PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19948.exe
      4⤵
      PID:7292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4599.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36151.exe
      4⤵
      PID:12368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25726.exe
      4⤵
      PID:15168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16084.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16084.exe
    3⤵
    PID:4504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28279.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6758.exe
        5⤵
        
        PID:12348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57848.exe
        5⤵
        
        PID:14568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21938.exe
        5⤵
        
        PID:15444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16851.exe
        5⤵
        
        PID:7624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10245.exe
      4⤵
      PID:10688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1021.exe
      4⤵
      PID:15028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43736.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43736.exe
    3⤵
    PID:7864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18544.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37691.exe
      4⤵
      PID:14080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21601.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21601.exe
    3⤵
    PID:12080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15525.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15525.exe
    3⤵
    PID:1900
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22013.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22013.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3372
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51361.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51361.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24309.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5388.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49327.exe
        6⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23043.exe
        7⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28575.exe
        8⤵
        
        PID:9024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7635.exe
        8⤵
        
        PID:13812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28526.exe
        8⤵
        
        PID:14644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        8⤵
        
        PID:9220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25429.exe
        7⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53054.exe
        7⤵
        
        PID:3204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16581.exe
        6⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        7⤵
        
        PID:10168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12386.exe
        7⤵
        
        PID:7796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37603.exe
        6⤵
        
        PID:10516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27703.exe
        6⤵
        
        PID:15200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36072.exe
        6⤵
        
        PID:14312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36067.exe
        5⤵
        
        PID:3992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60567.exe
        6⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62591.exe
        7⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36084.exe
        7⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1614.exe
        6⤵
        
        PID:10432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52276.exe
        6⤵
        
        PID:12152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55589.exe
        5⤵
        
        PID:7308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62591.exe
        6⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2080.exe
        6⤵
        
        PID:10192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62217.exe
        5⤵
        
        PID:11504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10027.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57879.exe
        5⤵
        
        PID:1816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57552.exe
        6⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48372.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7364.exe
        7⤵
        
        PID:14344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-829.exe
        7⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17645.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
        6⤵
        
        PID:12968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56475.exe
        6⤵
        
        PID:7652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64412.exe
        5⤵
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45631.exe
        6⤵
        
        PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40400.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16363.exe
      4⤵
      PID:3824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57573.exe
        5⤵
        
        PID:8696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6675.exe
        5⤵
        
        PID:6904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41819.exe
      4⤵
      PID:9036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51812.exe
      4⤵
      PID:13976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61812.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61812.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29893.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38528.exe
        5⤵
        
        PID:3744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50069.exe
        6⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34221.exe
        7⤵
        
        PID:8232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-945.exe
        7⤵
        
        PID:7156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7832.exe
        6⤵
        
        PID:9324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49384.exe
        6⤵
        
        PID:13728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5813.exe
        6⤵
        
        PID:15536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17357.exe
        6⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47116.exe
        5⤵
        
        PID:6376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56924.exe
        6⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42737.exe
        7⤵
        
        PID:16204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29964.exe
        7⤵
        
        PID:10876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56511.exe
        6⤵
        
        PID:15400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17357.exe
        6⤵
        
        PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64437.exe
        5⤵
        
        PID:9320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64536.exe
        5⤵
        
        PID:5368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13016.exe
      4⤵
      PID:2252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33925.exe
        5⤵
        
        PID:6840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
        6⤵
        
        PID:9532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4943.exe
        6⤵
        
        PID:15420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8216.exe
        5⤵
        
        PID:10012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10078.exe
        5⤵
        
        PID:14624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30870.exe
        5⤵
        
        PID:15028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24862.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24862.exe
      4⤵
      PID:7352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
        5⤵
        
        PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
        5⤵
        
        PID:16276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9422.exe
        5⤵
        
        PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29353.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29353.exe
      4⤵
      PID:11604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26428.exe
      4⤵
      PID:16360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9123.exe
      4⤵
      PID:3308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58573.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58573.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23069.exe
      4⤵
      PID:5024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13888.exe
        5⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32083.exe
        6⤵
        
        PID:8276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62398.exe
        6⤵
        
        PID:1284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13369.exe
        5⤵
        
        PID:10048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47904.exe
        5⤵
        
        PID:14676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        5⤵
        
        PID:2112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23379.exe
      4⤵
      PID:7376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        5⤵
        
        PID:9988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40400.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40400.exe
      4⤵
      PID:11864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11202.exe
      4⤵
      PID:16192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4923.exe
      4⤵
      PID:2596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32425.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32425.exe
    3⤵
    PID:5308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36639.exe
      4⤵
      PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48372.exe
        5⤵
        
        PID:9788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7364.exe
        5⤵
        
        PID:13400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2041.exe
        5⤵
        
        PID:14272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62286.exe
        5⤵
        
        PID:16132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4599.exe
        5⤵
        
        PID:5396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31267.exe
      4⤵
      PID:9708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
      4⤵
      PID:13540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60272.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60272.exe
    3⤵
    PID:7848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
      4⤵
      PID:10116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45250.exe
      4⤵
      PID:15524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4536.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4536.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:12052
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55180.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55180.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24610.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24610.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21725.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21123.exe
        5⤵
        
        PID:4308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50261.exe
        6⤵
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35735.exe
        6⤵
        
        PID:10200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8516.exe
        6⤵
        
        PID:14800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32131.exe
        6⤵
        
        PID:13764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48953.exe
        5⤵
        
        PID:7408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16323.exe
        6⤵
        
        PID:9688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38160.exe
        7⤵
        
        PID:6760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8019.exe
        6⤵
        
        PID:13384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27157.exe
        6⤵
        
        PID:6468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5890.exe
        5⤵
        
        PID:7260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7828.exe
        5⤵
        
        PID:14264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44368.exe
        5⤵
        
        PID:15572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13016.exe
      4⤵
      PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25757.exe
        5⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18544.exe
        6⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11049.exe
        6⤵
        
        PID:15184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33917.exe
        6⤵
        
        PID:7824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1614.exe
        5⤵
        
        PID:10948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37127.exe
        6⤵
        
        PID:4560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17043.exe
        6⤵
        
        PID:7564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29142.exe
        5⤵
        
        PID:14608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39061.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39061.exe
      4⤵
      PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33536.exe
        5⤵
        
        PID:9080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33784.exe
        5⤵
        
        PID:14012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34423.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34423.exe
      4⤵
      PID:10360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35028.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35028.exe
    3⤵
    PID:740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12928.exe
      4⤵
      PID:5756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10100.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61217.exe
        6⤵
        
        PID:14600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41547.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6182.exe
        5⤵
        
        PID:13640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57006.exe
        5⤵
        
        PID:14240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33917.exe
        5⤵
        
        PID:5080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25429.exe
      4⤵
      PID:7628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49384.exe
      4⤵
      PID:13804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55493.exe
      4⤵
      PID:16108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40031.exe
      4⤵
      PID:14668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-795.exe
    3⤵
    PID:6860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62591.exe
      4⤵
      PID:8752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19151.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19151.exe
    3⤵
    PID:10020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56280.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56280.exe
    3⤵
    PID:14632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11251.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11251.exe
    3⤵
    PID:6516
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48367.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23069.exe
      4⤵
      PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50069.exe
        5⤵
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48829.exe
        6⤵
        
        PID:8724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6675.exe
        6⤵
        
        PID:12884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25045.exe
        5⤵
        
        PID:8704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20493.exe
        5⤵
        
        PID:13732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10440.exe
        5⤵
        
        PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64521.exe
      4⤵
      PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12046.exe
        5⤵
        
        PID:9136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43519.exe
        5⤵
        
        PID:14604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51591.exe
        5⤵
        
        PID:8432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28557.exe
      4⤵
      PID:10352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46758.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46758.exe
    3⤵
    PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57552.exe
      4⤵
      PID:6652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31158.exe
        5⤵
        
        PID:10424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41425.exe
        5⤵
        
        PID:15340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1614.exe
      4⤵
      PID:10940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55682.exe
      4⤵
      PID:10296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12610.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12610.exe
    3⤵
    PID:7436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37485.exe
      4⤵
      PID:12392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53686.exe
      4⤵
      PID:12972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23610.exe
      4⤵
      PID:7508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41731.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41731.exe
    3⤵
    PID:13088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26428.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26428.exe
    3⤵
    PID:16376
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20763.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20763.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4355.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4355.exe
    3⤵
    PID:928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12710.exe
      4⤵
      PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40033.exe
        5⤵
        
        PID:9776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57502.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8299.exe
      4⤵
      PID:11152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60981.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60981.exe
    3⤵
    PID:7520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29244.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29244.exe
    3⤵
    PID:12212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6293.exe
    3⤵
    PID:7344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19995.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19995.exe
    3⤵
    PID:16012
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58223.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58223.exe
  2⤵
  PID:5132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43437.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43437.exe
    3⤵
    PID:7456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61522.exe
      4⤵
      PID:9644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40974.exe
      4⤵
      PID:6920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5175.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5175.exe
    3⤵
    PID:11788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33096.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33096.exe
  2⤵
  PID:7368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45631.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45631.exe
    3⤵
    PID:552
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44128.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44128.exe
  2⤵
  PID:12440
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33627.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33627.exe
  2⤵
  PID:13688
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33461.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33461.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1156

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4056

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:3424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10686.exe

Filesize
468KB

MD5
6fbbe730d1075615898931860e40dfb7

SHA1
3c3a6f44ee8ae9117c6b4d67400c4ac5ba54b7dd

SHA256
e5e71a299d896f7b21c3ce6e881f0ba835d839fdc31ba05621834f48f7dcd81a

SHA512
27c3a3de984d43c33f9597ad9164af0e7060c0ce76c8e17984c9d6334cb338a63dcb5aeef2f287b767f61d8bf790a66ee27f9cecc72f97587a48daceebe12bbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11294.exe

Filesize
468KB

MD5
566334ea2577b6d8921da98a4ba33976

SHA1
05d9716e9cb7e78a5bc8f9bba5ff1a2d4bae4632

SHA256
260f15e0a18c7ebc3a2ebe8ef231d77bc17c21e7f10f3e7aa7a8ceee0599ff68

SHA512
160ee6ece81051ee68a9c5692a1bc42b144f47ac34fa4b34b6a9b664fff3d1a1daa9f36b66f37fda6688f9ca6f3fa8d85e8e82e4daad37d6fd0a6d5cdab27794

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13618.exe

Filesize
468KB

MD5
248e579b2795162c469920a087e6f99f

SHA1
25fbb25e70371458ec32e8ab365c553464ed18b1

SHA256
73d501bcd58205dda6e086989f7a0897d6a2c3714785fb5ca44d3b9033fcb796

SHA512
a5ba70974ec5b06e8a92d3a13ec8e7c644df5905be73e6754ce32b04ff12a46bc6039fb8346f9bbc69ddc6871318d27a2b9b7f8da164a0443ae24d1ad3867e3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13981.exe

Filesize
468KB

MD5
97647ad1b64101746d437e4409a80173

SHA1
199b646f832a20bbe475d754df3c5b7a1b762dbd

SHA256
eb5c1b374b1b6482a8dcb6fcc13a7d7005159758e812d4cc20224ec67293c7c4

SHA512
cfdd52d0e85e71fd9a57f75b937e1bf16866576934577221b7a85b0a1189cf93b3f4b338fd12f97d445530fc3edbf9b67f3c34d3e66e6d57a6e11cc334a4ce6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14094.exe

Filesize
468KB

MD5
5200e521fa5bb2077c78750063d8dd17

SHA1
29ffa25baaed48a5d04db5aec065bad6892d6430

SHA256
c1e371287ff51fbad7ac17a5ff268bccc68c7b41ab456f4ac3108ab65a843cda

SHA512
f770554825a279caba42cce77158f1bb2e546dd92e9156fbd5ba479f8542a15f97a1e0bf99038e4f7155ad1df0b52ef14ac5503591899e18964ecfce51b42e7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15325.exe

Filesize
468KB

MD5
d801187a891b6e3f95a9f3d76874cfa0

SHA1
6a0d31676222d8b7e5fd41e095ea0e5261574cfb

SHA256
77043e4cdf9cbe0cf97e371b86b79ba62b1b501c7aed24fb131ace9a313b6105

SHA512
423fb1f2ca9d0c6090a9e43257c001cca68310816e41edc53cb45d6340b8143798dcfbfb0042920c5b304953775498088bb155fe04113f3c2fdae2223db47cbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16551.exe

Filesize
468KB

MD5
5a3a40b4452db2ef3e6dfa2bfb1e92bc

SHA1
975f62c6bf37ea10d0ad1981ebf86b8780d48a31

SHA256
ad5c26cef5d7b1803228b3ffe8e94e8ac53fed2688fa5b2bdc55c619edc62b78

SHA512
1826892448990f963edcd0faa48f2c7805f3c9fec8044799d1c9f6a84b625f789e0cd76e5954b690ee4394e09ecaa10bc842cebbf3336d5dd631e8ab3bbfcc22

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22013.exe

Filesize
468KB

MD5
0d54e7a3783a599299716bcca728adec

SHA1
de9fbc4a5280228fbd22873e8622e1614198539a

SHA256
6f7d62b9c903b4f61cbcb72aca3f1ffb7a630fc0a5cb1988296b7a94b122b383

SHA512
f3c7f5818c1fa94bb026c35889d6fbd5ae72d753092d449efec1ec0feb45fd342ee68526bdb6099ec69f85e1576ce72b549d9c51e3ef2e78c62e7a22f3cc1b62

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24309.exe

Filesize
468KB

MD5
ba5c2a088a4e5ede8f9256c8caf4c608

SHA1
a63ff5dabd9e3ab07581b7f12279c719d548b717

SHA256
e89c6c99a242052775a75fd65241dceef58c509b22117bb25e59d4dbe049a009

SHA512
fa19a12fc81debf6f6cc9d51ad50f059cabfac397b268c739de8ad0818cdeebbe27023749b1e486e967d96a5e7d9c0c1f040012bec4c9dd31427cf5e7a61ea78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24610.exe

Filesize
468KB

MD5
7703f5c7179d8cde9b61fcb748676cc3

SHA1
87c6a125e4b8b455882cccfbb009d8f2ec9f904d

SHA256
b3b0f3f17c94400a0f8f6882c5f300769c6fc9460e818eccbb2e92cbb8343593

SHA512
b0fd1da73033121e41b118808c97d935ed98975032344373ee903286d783ac5c0978f82dd8f106ee892e11cd6f43f40a9216d048d8266d7d22b15aab6edd96c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31901.exe

Filesize
468KB

MD5
6322739a4ad046efd6ba865b7996bff0

SHA1
5e76b4ff27ace0a0b333b0ffff4b0fc365a7e76f

SHA256
b32ab91ff91f1a146ef44439097cb4486f13ca3a30fe17b9799c89a541987515

SHA512
21906e00902c0eb4a1e122f11e405af0c2da6f228cc3f6759eda7793e90d600e55b40ffb70cb901ec905fb08d4e44b7e2db4421f73b0db8cf52fd0603d190c97

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33582.exe

Filesize
468KB

MD5
f4dcee9fe186dee555ea799d457f242c

SHA1
44073eb305d6487f9daadc48a1d7b06cc365df72

SHA256
58b884b7f5dfbe43b105d57791359d5bdd962f1ea4878b417e12b90d1719bfc2

SHA512
bef268ad7fa7a45ce4ef15f9428093a687cca374401dae2e1ab376e33a3f1336010f14835b1496db6d92424c1003bdf1df888c7f6d9ed6edd98ad18bb1dc7a26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33851.exe

Filesize
468KB

MD5
5282554f2981f3a3ccb80b0003fe50ee

SHA1
74a8615e00ea88b2ee9761a9d301fd32451ee944

SHA256
12a048627037da5b29bb881b492c84bc85b153df362bc50766b94f4dfdfdd928

SHA512
55fe812f8d46f3d7520b64b76502b8cfa5861d4c52a36770c49a7333e4c5c01d3b6c7976fdeaa9222e775107ecc70e0e250913f549adc8c75aee77feedd21560

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37251.exe

Filesize
468KB

MD5
6f25692205c88833a5ce1f4096d30fda

SHA1
2534be654ca90bb74fc4f38789427b54e0ea9a14

SHA256
350cd3c03e4600c0435da6f88fe35d30845c6dae6675ac62455bc9b47df90fb9

SHA512
68d279aaab1a64cb2b0f84d38b66e12caba468b60a5ccc669acc42eecfb5b6e96a1316609b458a18e79597b0113c47a45bc77296bded3a9d2404aeb299e9a4aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38367.exe

Filesize
468KB

MD5
adbf96e789cbc1a1bf36dd327f713e12

SHA1
c3161af93cd8b1f5346ed6a263351012535229eb

SHA256
8b6f04aa0ac80d26d94b924ea4bf185dbe27086bc3cc05658a194c507b781ef6

SHA512
bd5bbaccadeb4e8e65b404f7d726346c9b7973833d7222319260113493d72ae6f4abc09ef894a2738d739eed907a355d74d77c7823a4df7533221ccfc8e1f0a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45331.exe

Filesize
468KB

MD5
50939644000970b177648ef2b6ae0828

SHA1
7181bc01493f18ce56c5ded44af7a462c2e65dcb

SHA256
acd0072ec6c4852412b72c0a0289759f0912f9cb7ebb324d9e439a11c21acbbe

SHA512
5330b8590d05381faefdfd8438a2542a1df99055c1adae2681515ea7f3dc1c2766b3b73980e0f9590c7a74a885383d927556e7399314c09062ae286d0e645b1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45886.exe

Filesize
468KB

MD5
63bde4b00bb0db03064ae574559658b9

SHA1
37011d5f531043f88dd39e173e1304c805349bd9

SHA256
7bdc31f6eee2b4fdc05d7a0efbdcb81002a570007d894118df2f868ee5224c3a

SHA512
5f311822d708ec6e62ac45956da779ef29c9e34020de3b5feb98b323ffd9477d10ce7ff1e56dbbb4f9ffee101fb61a64a7a18d0f0afbb9bc5ce96ecfbbc276ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47168.exe

Filesize
468KB

MD5
e009f48b2dc20d7852157fe8babd341f

SHA1
e2e67e02c9ed657d286ec7041679ff42ceba6c2d

SHA256
e8a96a1527e05e2b6dfe11f38f39057b343816464019e6e07690f42b2d0f6b58

SHA512
b072beea837137d030f24739d0565512b00a22acdaa871079d832db2831d6b9d6d184e27e242bbd30a1108f73df646bbdfd4708fec891c87e28a82478de6799b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49633.exe

Filesize
468KB

MD5
a29be0517acc84590989fb367ed2ae5d

SHA1
aba2430ca645a58eef73a2367c6736dcd18c33a7

SHA256
bfd41660f04642a1df6e832f4c88e9240348e69d79b651da5d4271161c2e5328

SHA512
ed340f15a56e3b4f158ec47ebf2648e7bfa8f94e1fbfc3f2c257a7f8c3cdb5680048e08b4ae0d424029078c27be4ac0c8a38269d29c9028b516872a353441bab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49981.exe

Filesize
468KB

MD5
09bdd7930b9bc54ce69121ff98a5157e

SHA1
6b92b23c8d4b3b82c886bdb30a00d8b3764ca9ec

SHA256
471eb9f707df0d36fe07cf0eeeaae61105d1d2bf4f84d6c1c003baa93906bf2a

SHA512
85a29308f35f1987742e18ab422141413e80d2515989d7de5fb998b4a24de045cd74f7f5e27a026aa2ffb90dc987d49d80e2867797117c351d915eac644071db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51361.exe

Filesize
468KB

MD5
461ed3010b9dc0f7ad5e8f03d619ddb2

SHA1
a0eeeff946e5176908cf772ebd1d73707cf229e1

SHA256
bdeebd5eb0b742c91b68257e3cae46a28c57ab5606a981512ee85ca882ff991d

SHA512
23a96f2e7cae8adffbb2c8166640c720bb960b1613957107f6218706dc8bea753feb075337246aa19418ef79c0c9b31b37ec696f8d062a3ad9e58c80c6c569db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52985.exe

Filesize
468KB

MD5
161298ad2199e33e33e62cfefde1c09e

SHA1
04f188aeb82281edd5620a54da02466f8b1712c5

SHA256
35e1400087d1bd8cf150ee97beb78228e02ebbe1c302786d394f43ffb6ebfac8

SHA512
3ec63faa3627bd025bd95400c2b32a6de7297d7febce48b19d89492b24fe9ef2720e06daa8301b1ffd9d27849ced3e4e5bb25b2a60cf716933055b5cdd63786f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55180.exe

Filesize
468KB

MD5
cd112f94505f6ce8492cc5bc7a57ea26

SHA1
6a2fae3a4b2369fd62759fe5c5f7b440fa72f019

SHA256
1344d8878fa5a183806741c93ff123246d082097afd1750b986f721f4bdc52eb

SHA512
036ed7c9ffa5f1fa1ac9d40f242e1ea3e7b9c243ee0b3363902f75ae3733d9b1bcc443c85e44da7360ad175a25777e2458fa4c2c9cd5d51f0528bb10709cea15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55537.exe

Filesize
468KB

MD5
a32f5576faeb7b41ba5b783948065e73

SHA1
0eb427ca24ff4b54ba47a9e038849389d628fa4d

SHA256
5e93a9e93b318f6ab6946de3a8c2c56860ae5abf174382c5fca30063233b694b

SHA512
3c5c8553036c5824ebc8b0298276c827a8f7a89610a156fe960a053c7d77ed70a1e24dfece47a108585a925a4874b700088a9e4875e40bd94eec167d98f975e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57396.exe

Filesize
468KB

MD5
e1c7b329863686373b3e32aabeb62570

SHA1
127129a12c2c9896fc898fc514c20d71e28c2b82

SHA256
c2dcd1f90dcdacc4b5b09a0e3fc7f4e55b4d3b88ddc9c202dfa22c843cff3056

SHA512
d3dff4c4ee91077024865e1fd890289b2522fabd6b7206e0ad74a49fb0aadc5d95caa4dda051ca32972e4b87634e70adcf3924471b514f2b049900671c3dc580

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57583.exe

Filesize
468KB

MD5
6b6cab6e198e4d69a1cb3cd931b4d383

SHA1
366c46d642eb4be5944eec6654b1bca0e52924b5

SHA256
a9fa3c7f70a613590c766e341f9c68b17100495eaaf02c1740c2202873b2a511

SHA512
7a113b0ad1ee0a6479a286c9af79ed8280301456203ae2ccde6efe32300972e37a172dfaff807b3ec7300034017428d4d1ff655a9b5723c02f75d51fd92c24c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58626.exe

Filesize
468KB

MD5
ef010ea7432bc52d9287484eada1baee

SHA1
7584b3774cb5d66b6ec11e2fab7aadb57a328f5e

SHA256
26a77fa109ee43650319f1cd1bbc7eb6c8a77ea8f9c48facf8097cbd620a2981

SHA512
e7db1e35ea241dfd344565b0f8dfb8e246d1f0756791720e37f79fe39a2818856ad4ad8df9819f2caa48820357473c288f799b7150f17ddcbfe0bf9f73f7082a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58635.exe

Filesize
468KB

MD5
6f0a8a4ef41d486af27764435e5a3d49

SHA1
e327a86ff084ad242980c87eb07116494afe0536

SHA256
bab4a72be8b4b7e61a2bec744eab1d1066af1396845a4e8648b26f555c88425a

SHA512
1f83c370125e13822ab6cbf37a769d59a1a128105356a898838cc721ce58315e81bb80f066af735420f4550e5c761201e0aa43d82c2adb02475572e314ddca3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58735.exe

Filesize
468KB

MD5
aff2b53fc24f9b9ed447c6702aac24f4

SHA1
6396fc49c559c6ad9b70865ae48c4a90458c0168

SHA256
06fc33f5a04c19510a0ec188c93d445091fc9e6166d044114da9676a4c53394a

SHA512
a10ea2069bdd1533736155a27e51ccbc331eee7a56f63aa525575c3fd6de41d45a6a7aee125e458011534cf2dfb288388695d59087f3c4271d51b87b8e31b872

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59290.exe

Filesize
468KB

MD5
fac5216bf30cef695da0d283cb9c061f

SHA1
77a4320d2bf765fec2dd792f07364537fb910cd5

SHA256
41649b0560bf9f21c359c732e88a37366145ed7acf7e31fba8350777669e2d36

SHA512
9071ef3e3a747d2da6e2894109ddb91d5cfca5859d314a948e07266498e4f63830beebeaec0e06d05dbc854966e3e55e2292eb9b30649a91d29ea40c818e1fc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5938.exe

Filesize
468KB

MD5
86ab67c70ac9385b40885beb2645dec7

SHA1
232c22aa768ed0ac53f031e7340d4dffd3c700eb

SHA256
7c914653ecdd8ad4e424a6f47ffa692d479dc2730d978577ce2d75c159835bb0

SHA512
d85bb869a69261d99e62789fb4c83c25772a395df59096af8e8a9e943420d9f99d4729f91243204847fa9e8c39b3204afa73edf6f97abdd83f456dbcd80cf475

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61812.exe

Filesize
468KB

MD5
e8ca2a6315786db1b6dcff43bb3abfde

SHA1
3d80da9692ad483ae65e81e9c8e5170eeab1d454

SHA256
a1599eb5b3982c7516daab6e7113f21d983ec2612abbe4b255456bf8d5774a26

SHA512
32802b461a831e1af6879c5f97fe4bd2d3f6d459d5ec142a73a9d7b60e8d4d1c6a479a028d4a7745a21c97b9f43d90b46883f1c779f06f910feef5bc6dbafa96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6654.exe

Filesize
468KB

MD5
ee545c56c1ae2a2a56924382ee589428

SHA1
6a36cb87e643889d4bf3cdc0c1d6ec0affb33c9b

SHA256
ea93c785674d420fe0ce714574d05361b8789c687ff1bbffe7a5777a2c070745

SHA512
1fae8ed77be5e3048acae084e20396ce2981ac020c7d2a4132377e1571433942a19129e6565148643445582318205cd0b7a503e42b1493d6b64716392192674f

Download Submit
memory/232-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/404-504-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/696-189-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/716-426-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/740-473-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/744-202-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/800-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/860-310-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/976-568-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1004-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1232-194-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1232-2652-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1424-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1512-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1528-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1548-167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1560-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1568-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1636-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1720-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1932-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1948-163-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1948-3744-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1952-99-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2128-123-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2140-299-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2172-479-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2228-160-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2232-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2252-561-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2276-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2352-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2476-570-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2524-480-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2540-77-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2564-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2620-112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2676-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2936-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2968-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2980-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2992-307-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3032-425-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3076-209-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3116-144-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3160-421-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3192-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3196-249-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3200-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3204-3392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3228-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3232-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3328-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3332-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3372-43-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3388-423-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3468-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3524-428-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3548-38-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3680-164-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3744-500-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3836-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3880-103-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3916-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3940-308-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3952-76-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3992-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4016-3738-0x00007FF9BB200000-0x00007FF9BB259000-memory.dmp

Filesize
356KB

Download
memory/4016-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4044-216-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4088-102-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4108-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4200-309-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4324-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4400-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4424-266-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4468-449-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4504-557-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4532-569-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4572-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4592-476-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4620-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4672-306-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4688-424-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4704-472-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4732-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4736-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4760-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4812-298-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4816-253-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4828-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4836-572-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4844-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4848-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4888-559-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4956-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5000-427-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5024-509-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5088-254-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5116-501-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5348-3516-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/7344-3857-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13404-3419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13584-2637-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14264-2715-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14496-3411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14880-2571-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15032-2437-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15072-3407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15120-3420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15200-3406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15420-3393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16108-3852-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16376-3545-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads