d5c844365b12b308089df5b515cfdd9e3cdf94a3c8304ae43c2ec6efc90d58d2

Analysis

max time kernel
120s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 04:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5c844365b12b308089df5b515cfdd9e3cdf94a3c8304ae43c2ec6efc90d58d2N.exe
Size

468KB
MD5

87744bd0fb4acc3b782727290fcc66a0
SHA1

201035790b7c65d46d7c79d8dd398c12609ccaea
SHA256

d5c844365b12b308089df5b515cfdd9e3cdf94a3c8304ae43c2ec6efc90d58d2
SHA512

51ca944cf6aaf556fc6e904100e341dd4d2874e303f0ed914ab4bb609e3d93d541f9f681f6636851efc1b23d713f02fbd145687c1207ed6c692d65219c551664
SSDEEP

3072:ITJDog5d1O8uxbYeWbi/ff8/Prhjq9p3ndHetVvxrz5mtjA/fHld:ITpo4/uxJWW/ffZLo5rzslA/f

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3572	Unicorn-60634.exe
3916	Unicorn-29885.exe
2836	Unicorn-60289.exe
4188	Unicorn-42765.exe
5028	Unicorn-42765.exe
1396	Unicorn-4839.exe
2304	Unicorn-46465.exe
2548	Unicorn-14524.exe
2284	Unicorn-15786.exe
2288	Unicorn-32122.exe
2104	Unicorn-12256.exe
3584	Unicorn-64721.exe
1988	Unicorn-45121.exe
3860	Unicorn-9079.exe
1420	Unicorn-28691.exe
4364	Unicorn-50394.exe
1204	Unicorn-33024.exe
1616	Unicorn-52890.exe
3440	Unicorn-33216.exe
3208	Unicorn-46568.exe
1348	Unicorn-52698.exe
4900	Unicorn-52698.exe
3620	Unicorn-1852.exe
2432	Unicorn-47524.exe
4368	Unicorn-52122.exe
660	Unicorn-52122.exe
5036	Unicorn-59720.exe
4280	Unicorn-18307.exe
1728	Unicorn-12442.exe
2708	Unicorn-12428.exe
1488	Unicorn-54731.exe
1732	Unicorn-45711.exe
2736	Unicorn-62358.exe
2184	Unicorn-49551.exe
4540	Unicorn-26124.exe
4076	Unicorn-22271.exe
2704	Unicorn-35762.exe
2136	Unicorn-5550.exe
4244	Unicorn-15564.exe
632	Unicorn-24383.exe
4772	Unicorn-15253.exe
1232	Unicorn-23807.exe
4668	Unicorn-48618.exe
1424	Unicorn-37298.exe
1644	Unicorn-56287.exe
4472	Unicorn-7086.exe
2976	Unicorn-8347.exe
4276	Unicorn-23231.exe
2544	Unicorn-39567.exe
812	Unicorn-8741.exe
3472	Unicorn-9006.exe
1944	Unicorn-54678.exe
4732	Unicorn-10002.exe
4240	Unicorn-38834.exe
2240	Unicorn-58700.exe
3020	Unicorn-52570.exe
428	Unicorn-8814.exe
1596	Unicorn-8549.exe
4808	Unicorn-38450.exe
4352	Unicorn-366.exe
5016	Unicorn-30002.exe
3660	Unicorn-3246.exe
1036	Unicorn-3438.exe
1068	Unicorn-49110.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
10952	6752	WerFault.exe	289

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24092.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24790.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57233.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14537.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37802.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4839.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58623.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22889.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45117.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-981.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36847.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5536.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41345.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32729.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31834.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43615.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4725.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26342.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15691.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30538.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60289.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48519.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25624.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52570.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6334.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24672.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64947.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54749.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48819.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40897.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15600.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6137.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1077.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39407.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15480	dwm.exe
Token: SeChangeNotifyPrivilege	15480	dwm.exe
Token: 33	15480	dwm.exe
Token: SeIncBasePriorityPrivilege	15480	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1492	d5c844365b12b308089df5b515cfdd9e3cdf94a3c8304ae43c2ec6efc90d58d2N.exe
3572	Unicorn-60634.exe
2836	Unicorn-60289.exe
3916	Unicorn-29885.exe
5028	Unicorn-42765.exe
4188	Unicorn-42765.exe
1396	Unicorn-4839.exe
2304	Unicorn-46465.exe
2284	Unicorn-15786.exe
2548	Unicorn-14524.exe
2288	Unicorn-32122.exe
2104	Unicorn-12256.exe
3860	Unicorn-9079.exe
3584	Unicorn-64721.exe
1988	Unicorn-45121.exe
1420	Unicorn-28691.exe
4364	Unicorn-50394.exe
1204	Unicorn-33024.exe
1616	Unicorn-52890.exe
3440	Unicorn-33216.exe
4900	Unicorn-52698.exe
4368	Unicorn-52122.exe
3620	Unicorn-1852.exe
2432	Unicorn-47524.exe
1348	Unicorn-52698.exe
3208	Unicorn-46568.exe
4280	Unicorn-18307.exe
1728	Unicorn-12442.exe
660	Unicorn-52122.exe
1488	Unicorn-54731.exe
2708	Unicorn-12428.exe
1732	Unicorn-45711.exe
2736	Unicorn-62358.exe
2184	Unicorn-49551.exe
4540	Unicorn-26124.exe
4076	Unicorn-22271.exe
2136	Unicorn-5550.exe
2704	Unicorn-35762.exe
4244	Unicorn-15564.exe
632	Unicorn-24383.exe
1672	Unicorn-6427.exe
4668	Unicorn-48618.exe
4772	Unicorn-15253.exe
1424	Unicorn-37298.exe
1644	Unicorn-56287.exe
2544	Unicorn-39567.exe
1232	Unicorn-23807.exe
4276	Unicorn-23231.exe
2976	Unicorn-8347.exe
4472	Unicorn-7086.exe
812	Unicorn-8741.exe
3472	Unicorn-9006.exe
2240	Unicorn-58700.exe
1944	Unicorn-54678.exe
428	Unicorn-8814.exe
4240	Unicorn-38834.exe
4732	Unicorn-10002.exe
4808	Unicorn-38450.exe
3020	Unicorn-52570.exe
1596	Unicorn-8549.exe
4352	Unicorn-366.exe
5016	Unicorn-30002.exe
3660	Unicorn-3246.exe
2632	Unicorn-13260.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 3572	1492	d5c844365b12b308089df5b515cfdd9e3cdf94a3c8304ae43c2ec6efc90d58d2N.exe	82
PID 1492 wrote to memory of 3572	1492	d5c844365b12b308089df5b515cfdd9e3cdf94a3c8304ae43c2ec6efc90d58d2N.exe	82
PID 1492 wrote to memory of 3572	1492	d5c844365b12b308089df5b515cfdd9e3cdf94a3c8304ae43c2ec6efc90d58d2N.exe	82
PID 3572 wrote to memory of 3916	3572	Unicorn-60634.exe	83
PID 3572 wrote to memory of 3916	3572	Unicorn-60634.exe	83
PID 3572 wrote to memory of 3916	3572	Unicorn-60634.exe	83
PID 1492 wrote to memory of 2836	1492	d5c844365b12b308089df5b515cfdd9e3cdf94a3c8304ae43c2ec6efc90d58d2N.exe	84
PID 1492 wrote to memory of 2836	1492	d5c844365b12b308089df5b515cfdd9e3cdf94a3c8304ae43c2ec6efc90d58d2N.exe	84
PID 1492 wrote to memory of 2836	1492	d5c844365b12b308089df5b515cfdd9e3cdf94a3c8304ae43c2ec6efc90d58d2N.exe	84
PID 3916 wrote to memory of 5028	3916	Unicorn-29885.exe	87
PID 3916 wrote to memory of 5028	3916	Unicorn-29885.exe	87
PID 3916 wrote to memory of 5028	3916	Unicorn-29885.exe	87
PID 2836 wrote to memory of 4188	2836	Unicorn-60289.exe	88
PID 2836 wrote to memory of 4188	2836	Unicorn-60289.exe	88
PID 2836 wrote to memory of 4188	2836	Unicorn-60289.exe	88
PID 1492 wrote to memory of 1396	1492	d5c844365b12b308089df5b515cfdd9e3cdf94a3c8304ae43c2ec6efc90d58d2N.exe	89
PID 1492 wrote to memory of 1396	1492	d5c844365b12b308089df5b515cfdd9e3cdf94a3c8304ae43c2ec6efc90d58d2N.exe	89
PID 1492 wrote to memory of 1396	1492	d5c844365b12b308089df5b515cfdd9e3cdf94a3c8304ae43c2ec6efc90d58d2N.exe	89
PID 3572 wrote to memory of 2304	3572	Unicorn-60634.exe	90
PID 3572 wrote to memory of 2304	3572	Unicorn-60634.exe	90
PID 3572 wrote to memory of 2304	3572	Unicorn-60634.exe	90
PID 5028 wrote to memory of 2548	5028	Unicorn-42765.exe	93
PID 5028 wrote to memory of 2548	5028	Unicorn-42765.exe	93
PID 5028 wrote to memory of 2548	5028	Unicorn-42765.exe	93
PID 1396 wrote to memory of 2284	1396	Unicorn-4839.exe	94
PID 1396 wrote to memory of 2284	1396	Unicorn-4839.exe	94
PID 1396 wrote to memory of 2284	1396	Unicorn-4839.exe	94
PID 2304 wrote to memory of 2288	2304	Unicorn-46465.exe	95
PID 2304 wrote to memory of 2288	2304	Unicorn-46465.exe	95
PID 2304 wrote to memory of 2288	2304	Unicorn-46465.exe	95
PID 3916 wrote to memory of 2104	3916	Unicorn-29885.exe	96
PID 3916 wrote to memory of 2104	3916	Unicorn-29885.exe	96
PID 3916 wrote to memory of 2104	3916	Unicorn-29885.exe	96
PID 1492 wrote to memory of 3584	1492	d5c844365b12b308089df5b515cfdd9e3cdf94a3c8304ae43c2ec6efc90d58d2N.exe	97
PID 1492 wrote to memory of 3584	1492	d5c844365b12b308089df5b515cfdd9e3cdf94a3c8304ae43c2ec6efc90d58d2N.exe	97
PID 1492 wrote to memory of 3584	1492	d5c844365b12b308089df5b515cfdd9e3cdf94a3c8304ae43c2ec6efc90d58d2N.exe	97
PID 2836 wrote to memory of 1988	2836	Unicorn-60289.exe	98
PID 2836 wrote to memory of 1988	2836	Unicorn-60289.exe	98
PID 2836 wrote to memory of 1988	2836	Unicorn-60289.exe	98
PID 3572 wrote to memory of 3860	3572	Unicorn-60634.exe	99
PID 3572 wrote to memory of 3860	3572	Unicorn-60634.exe	99
PID 3572 wrote to memory of 3860	3572	Unicorn-60634.exe	99
PID 4188 wrote to memory of 1420	4188	Unicorn-42765.exe	101
PID 4188 wrote to memory of 1420	4188	Unicorn-42765.exe	101
PID 4188 wrote to memory of 1420	4188	Unicorn-42765.exe	101
PID 2288 wrote to memory of 4364	2288	Unicorn-32122.exe	104
PID 2288 wrote to memory of 4364	2288	Unicorn-32122.exe	104
PID 2288 wrote to memory of 4364	2288	Unicorn-32122.exe	104
PID 2304 wrote to memory of 1204	2304	Unicorn-46465.exe	105
PID 2304 wrote to memory of 1204	2304	Unicorn-46465.exe	105
PID 2304 wrote to memory of 1204	2304	Unicorn-46465.exe	105
PID 2548 wrote to memory of 1616	2548	Unicorn-14524.exe	106
PID 2548 wrote to memory of 1616	2548	Unicorn-14524.exe	106
PID 2548 wrote to memory of 1616	2548	Unicorn-14524.exe	106
PID 5028 wrote to memory of 3440	5028	Unicorn-42765.exe	107
PID 5028 wrote to memory of 3440	5028	Unicorn-42765.exe	107
PID 5028 wrote to memory of 3440	5028	Unicorn-42765.exe	107
PID 2836 wrote to memory of 3208	2836	Unicorn-60289.exe	108
PID 2836 wrote to memory of 3208	2836	Unicorn-60289.exe	108
PID 2836 wrote to memory of 3208	2836	Unicorn-60289.exe	108
PID 1988 wrote to memory of 4900	1988	Unicorn-45121.exe	110
PID 1988 wrote to memory of 4900	1988	Unicorn-45121.exe	110
PID 1988 wrote to memory of 4900	1988	Unicorn-45121.exe	110
PID 2284 wrote to memory of 1348	2284	Unicorn-15786.exe	109

C:\Users\Admin\AppData\Local\Temp\d5c844365b12b308089df5b515cfdd9e3cdf94a3c8304ae43c2ec6efc90d58d2N.exe
"C:\Users\Admin\AppData\Local\Temp\d5c844365b12b308089df5b515cfdd9e3cdf94a3c8304ae43c2ec6efc90d58d2N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60634.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60634.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29885.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29885.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42765.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14524.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52890.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22271.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18431.exe
        8⤵
        
        PID:1564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14222.exe
        9⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18399.exe
        10⤵
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13477.exe
        10⤵
        
        PID:12716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10320.exe
        10⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12652.exe
        9⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3010.exe
        9⤵
        
        PID:13576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29520.exe
        9⤵
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28373.exe
        8⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11906.exe
        9⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32886.exe
        9⤵
        
        PID:13364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56145.exe
        9⤵
        
        PID:10368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47821.exe
        8⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60934.exe
        8⤵
        
        PID:11308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25692.exe
        8⤵
        
        PID:15912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46473.exe
        8⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15093.exe
        7⤵
        
        PID:1508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4798.exe
        8⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39407.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21634.exe
        10⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9068.exe
        10⤵
        
        PID:15236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55290.exe
        10⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33141.exe
        9⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        9⤵
        
        PID:13560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14153.exe
        9⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23877.exe
        8⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34777.exe
        9⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57549.exe
        8⤵
        
        PID:10648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22710.exe
        8⤵
        
        PID:14376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5536.exe
        8⤵
        
        PID:208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23660.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41164.exe
        8⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43429.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        8⤵
        
        PID:13320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33226.exe
        8⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9861.exe
        7⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11625.exe
        7⤵
        
        PID:11400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49509.exe
        7⤵
        
        PID:15116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49651.exe
        7⤵
        
        PID:10696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35762.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20735.exe
        7⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24591.exe
        8⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40092.exe
        9⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37916.exe
        10⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7810.exe
        10⤵
        
        PID:12104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63786.exe
        10⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11522.exe
        9⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24316.exe
        9⤵
        
        PID:12608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39854.exe
        9⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38841.exe
        9⤵
        
        PID:11572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24754.exe
        8⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
        8⤵
        
        PID:11276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14156.exe
        8⤵
        
        PID:15132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17318.exe
        8⤵
        
        PID:8856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9925.exe
        7⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe
        8⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6741.exe
        8⤵
        
        PID:11508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48519.exe
        8⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36352.exe
        8⤵
        
        PID:10712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18517.exe
        7⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        7⤵
        
        PID:13376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24313.exe
        7⤵
        
        PID:8612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64682.exe
        6⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48156.exe
        7⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43375.exe
        8⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12473.exe
        9⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30181.exe
        8⤵
        
        PID:10716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-620.exe
        8⤵
        
        PID:15160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7625.exe
        8⤵
        
        PID:10344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27452.exe
        7⤵
        
        PID:8228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3394.exe
        7⤵
        
        PID:13504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13568.exe
        7⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35395.exe
        6⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5061.exe
        7⤵
        
        PID:8512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
        7⤵
        
        PID:11268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30144.exe
        7⤵
        
        PID:15596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22156.exe
        6⤵
        
        PID:8708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37653.exe
        6⤵
        
        PID:12548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3176.exe
        6⤵
        
        PID:1116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33216.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5550.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58991.exe
        7⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47663.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe
        9⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14140.exe
        9⤵
        
        PID:12700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57233.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:1416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21625.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29481.exe
        8⤵
        
        PID:9300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18085.exe
        8⤵
        
        PID:13720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46817.exe
        8⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57590.exe
        7⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16716.exe
        8⤵
        
        PID:10396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54067.exe
        8⤵
        
        PID:14940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20893.exe
        8⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20348.exe
        7⤵
        
        PID:9536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51651.exe
        7⤵
        
        PID:14068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38846.exe
        7⤵
        
        PID:8244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41813.exe
        6⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52138.exe
        7⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54927.exe
        8⤵
        
        PID:9560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34738.exe
        8⤵
        
        PID:12920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24672.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43814.exe
        7⤵
        
        PID:9220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
        7⤵
        
        PID:12892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40505.exe
        7⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49997.exe
        6⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21487.exe
        7⤵
        
        PID:9652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64614.exe
        7⤵
        
        PID:12796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42654.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        7⤵
        
        PID:10556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11605.exe
        6⤵
        
        PID:9880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe
        6⤵
        
        PID:14120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33161.exe
        6⤵
        
        PID:9004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15564.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45535.exe
        6⤵
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35551.exe
        7⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45231.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17909.exe
        8⤵
        
        PID:14496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42654.exe
        8⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11029.exe
        7⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57757.exe
        7⤵
        
        PID:12336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30288.exe
        7⤵
        
        PID:9360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57590.exe
        6⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19759.exe
        7⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64614.exe
        7⤵
        
        PID:13552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25117.exe
        7⤵
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4313.exe
        6⤵
        
        PID:9524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51651.exe
        6⤵
        
        PID:14148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55841.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3957.exe
        5⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20575.exe
        6⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28127.exe
        7⤵
        
        PID:10420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18293.exe
        7⤵
        
        PID:13648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44958.exe
        7⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57542.exe
        6⤵
        
        PID:9932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45786.exe
        6⤵
        
        PID:14048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55866.exe
        6⤵
        
        PID:10256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe
        5⤵
        
        PID:7252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3538.exe
        5⤵
        
        PID:10672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30911.exe
        5⤵
        
        PID:14408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11701.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12256.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52122.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49686.exe
        6⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48156.exe
        7⤵
        
        PID:4064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe
        8⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40181.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48519.exe
        8⤵
        
        PID:12644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55377.exe
        8⤵
        
        PID:11728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12652.exe
        7⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-981.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5792.exe
        7⤵
        
        PID:11864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60749.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22063.exe
        7⤵
        
        PID:9412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50198.exe
        7⤵
        
        PID:13844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33821.exe
        7⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53686.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19404.exe
        6⤵
        
        PID:10504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57507.exe
        6⤵
        
        PID:15564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18623.exe
        6⤵
        
        PID:8880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55654.exe
        5⤵
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12796.exe
        5⤵
        
        PID:6184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58495.exe
        6⤵
        
        PID:11156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27813.exe
        6⤵
        
        PID:13960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15600.exe
        6⤵
        
        PID:7312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51942.exe
        5⤵
        
        PID:9924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43516.exe
        5⤵
        
        PID:14080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25816.exe
        5⤵
        
        PID:10376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12442.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8347.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14014.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6926.exe
        7⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43420.exe
        8⤵
        
        PID:11256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44150.exe
        8⤵
        
        PID:14456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41345.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64387.exe
        7⤵
        
        PID:10236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        7⤵
        
        PID:12828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49242.exe
        7⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46378.exe
        6⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41126.exe
        6⤵
        
        PID:9228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        6⤵
        
        PID:14028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
        6⤵
        
        PID:8296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52006.exe
        5⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12814.exe
        6⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30070.exe
        7⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65370.exe
        6⤵
        
        PID:12896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47258.exe
        6⤵
        
        PID:15684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37421.exe
        6⤵
        
        PID:11120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8220.exe
        5⤵
        
        PID:8128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52854.exe
        5⤵
        
        PID:11804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50093.exe
        5⤵
        
        PID:15492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55642.exe
        5⤵
        
        PID:9136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8741.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48332.exe
        5⤵
        
        PID:2276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43548.exe
        6⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52223.exe
        7⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6741.exe
        7⤵
        
        PID:11496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60013.exe
        7⤵
        
        PID:16208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47450.exe
        7⤵
        
        PID:15812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28517.exe
        6⤵
        
        PID:8968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14633.exe
        6⤵
        
        PID:12752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47258.exe
        6⤵
        
        PID:1860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37421.exe
        6⤵
        
        PID:11912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38106.exe
        5⤵
        
        PID:7612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28335.exe
        6⤵
        
        PID:12352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39365.exe
        6⤵
        
        PID:15696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19440.exe
        6⤵
        
        PID:11008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41309.exe
        5⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42008.exe
        5⤵
        
        PID:6324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21420.exe
      4⤵
      PID:4724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36719.exe
        5⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51114.exe
        6⤵
        
        PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57542.exe
        5⤵
        
        PID:9960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45786.exe
        5⤵
        
        PID:14088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49514.exe
        5⤵
        
        PID:8668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40949.exe
      4⤵
      PID:6752
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6752 -s 632
        5⤵
        Program crash
        
        PID:10952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15691.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38788.exe
      4⤵
      PID:4432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63378.exe
      4⤵
      PID:4196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46465.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46465.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32122.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50394.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45711.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-366.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33282.exe
        8⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe
        8⤵
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24028.exe
        8⤵
        
        PID:12024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13753.exe
        8⤵
        
        PID:9484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28290.exe
        7⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26956.exe
        8⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64218.exe
        8⤵
        
        PID:12676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57233.exe
        8⤵
        
        PID:532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30281.exe
        8⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18517.exe
        7⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9420.exe
        7⤵
        
        PID:13708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25110.exe
        7⤵
        
        PID:8156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30002.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5374.exe
        7⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65455.exe
        8⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60175.exe
        9⤵
        
        PID:15020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25417.exe
        9⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8645.exe
        8⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        8⤵
        
        PID:13360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39687.exe
        8⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30229.exe
        7⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19308.exe
        7⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63750.exe
        7⤵
        
        PID:14020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13952.exe
        7⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33753.exe
        6⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40476.exe
        7⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42159.exe
        8⤵
        
        PID:11172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27813.exe
        8⤵
        
        PID:14356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36654.exe
        8⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64387.exe
        7⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        7⤵
        
        PID:12988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47402.exe
        7⤵
        
        PID:7188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44355.exe
        6⤵
        
        PID:7500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54749.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19141.exe
        6⤵
        
        PID:14880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33891.exe
        6⤵
        
        PID:8456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62358.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3438.exe
        6⤵
        Executes dropped EXE
        
        PID:1036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9022.exe
        7⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55935.exe
        8⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20086.exe
        9⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32870.exe
        8⤵
        
        PID:11224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65002.exe
        8⤵
        
        PID:14896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15289.exe
        8⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18994.exe
        7⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24790.exe
        7⤵
        
        PID:10428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22412.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37769.exe
        7⤵
        
        PID:8340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9925.exe
        6⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58495.exe
        7⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44150.exe
        7⤵
        
        PID:14436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41345.exe
        7⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26342.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40109.exe
        6⤵
        
        PID:15676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13609.exe
        6⤵
        
        PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13260.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24591.exe
        6⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6741.exe
        7⤵
        
        PID:11480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60013.exe
        7⤵
        
        PID:16216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16313.exe
        7⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
        6⤵
        
        PID:7344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56326.exe
        6⤵
        
        PID:13060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38401.exe
        6⤵
        
        PID:16160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1077.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18927.exe
        6⤵
        
        PID:13536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63466.exe
        6⤵
        
        PID:9072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45021.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2869.exe
        5⤵
        
        PID:12284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7966.exe
        5⤵
        
        PID:15544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25624.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33024.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49551.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3246.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6334.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55935.exe
        8⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50687.exe
        9⤵
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64022.exe
        9⤵
        
        PID:13696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52113.exe
        9⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32870.exe
        8⤵
        
        PID:10660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64125.exe
        8⤵
        
        PID:14908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1558.exe
        8⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45117.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44479.exe
        8⤵
        
        PID:11360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48307.exe
        8⤵
        
        PID:15828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24672.exe
        8⤵
        
        PID:3912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24790.exe
        7⤵
        
        PID:10448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22412.exe
        7⤵
        
        PID:14472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40697.exe
        7⤵
        
        PID:1700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11461.exe
        6⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20812.exe
        7⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55366.exe
        7⤵
        
        PID:12176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47450.exe
        7⤵
        
        PID:16172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47821.exe
        6⤵
        
        PID:8300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60934.exe
        6⤵
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8505.exe
        6⤵
        
        PID:15600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46473.exe
        6⤵
        
        PID:16316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49110.exe
        5⤵
        Executes dropped EXE
        
        PID:1068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48156.exe
        6⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20812.exe
        7⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55366.exe
        7⤵
        
        PID:12168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47450.exe
        7⤵
        
        PID:1432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12652.exe
        6⤵
        
        PID:9176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17509.exe
        6⤵
        
        PID:12632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49697.exe
        6⤵
        
        PID:10544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5404.exe
        5⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42159.exe
        6⤵
        
        PID:8488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44150.exe
        6⤵
        
        PID:15304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31744.exe
        6⤵
        
        PID:9464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48118.exe
        5⤵
        
        PID:8912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11833.exe
        5⤵
        
        PID:12772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57226.exe
        5⤵
        
        PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26124.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35727.exe
        5⤵
        
        PID:2904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41804.exe
        6⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        7⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32485.exe
        7⤵
        
        PID:11388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3308.exe
        7⤵
        
        PID:15096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57978.exe
        7⤵
        
        PID:11044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1330.exe
        6⤵
        
        PID:7376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21545.exe
        6⤵
        
        PID:12040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49843.exe
        6⤵
        
        PID:15856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5536.exe
        6⤵
        
        PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48166.exe
        5⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe
        6⤵
        
        PID:7824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7810.exe
        6⤵
        
        PID:12084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47450.exe
        6⤵
        
        PID:15920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22512.exe
        6⤵
        
        PID:11760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe
        5⤵
        
        PID:8736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30182.exe
        5⤵
        
        PID:12636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56458.exe
        5⤵
        
        PID:5904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18165.exe
      4⤵
      PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48156.exe
        5⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53276.exe
        6⤵
        
        PID:8036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23554.exe
        6⤵
        
        PID:11196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57885.exe
        6⤵
        
        PID:15336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47402.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12652.exe
        5⤵
        
        PID:8848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16549.exe
        5⤵
        
        PID:13076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21632.exe
        5⤵
        
        PID:8556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42573.exe
      4⤵
      PID:6224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29551.exe
        5⤵
        
        PID:9776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32050.exe
        5⤵
        
        PID:14100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32896.exe
        5⤵
        
        PID:7424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21381.exe
      4⤵
      PID:8744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54719.exe
      4⤵
      PID:12516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29745.exe
      4⤵
      PID:5844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9079.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9079.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52122.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39567.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62748.exe
        6⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20994.exe
        7⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5726.exe
        8⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19829.exe
        8⤵
        
        PID:13996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59521.exe
        8⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62554.exe
        7⤵
        
        PID:10020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19253.exe
        7⤵
        
        PID:14324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16640.exe
        7⤵
        
        PID:11004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18306.exe
        6⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21871.exe
        7⤵
        
        PID:9600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64614.exe
        7⤵
        
        PID:12876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26592.exe
        7⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29014.exe
        6⤵
        
        PID:10464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
        6⤵
        
        PID:13336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14486.exe
        6⤵
        
        PID:15672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34709.exe
        5⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22111.exe
        6⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49478.exe
        6⤵
        
        PID:9208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41642.exe
        6⤵
        
        PID:10908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38490.exe
        5⤵
        
        PID:7508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29596.exe
        6⤵
        
        PID:10220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48307.exe
        6⤵
        
        PID:15820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60033.exe
        6⤵
        
        PID:1076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63274.exe
        6⤵
        
        PID:12452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41309.exe
        5⤵
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46821.exe
        5⤵
        
        PID:15260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39075.exe
        5⤵
        
        PID:8436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38834.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38623.exe
        5⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62079.exe
        6⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41471.exe
        7⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64022.exe
        7⤵
        
        PID:13620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35502.exe
        7⤵
        
        PID:620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64947.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10684.exe
        6⤵
        
        PID:13068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41858.exe
        5⤵
        
        PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46877.exe
        5⤵
        
        PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18677.exe
        5⤵
        
        PID:13500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31021.exe
        5⤵
        
        PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47869.exe
      4⤵
      PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65455.exe
        5⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51916.exe
        6⤵
        
        PID:14176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13001.exe
        6⤵
        
        PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8645.exe
        5⤵
        
        PID:9424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        5⤵
        
        PID:12360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14537.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49830.exe
      4⤵
      PID:7860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10937.exe
        5⤵
        
        PID:896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47645.exe
      4⤵
      PID:10932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20293.exe
      4⤵
      PID:15164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39459.exe
      4⤵
      PID:5596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18307.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18307.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24383.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43615.exe
        5⤵
        
        PID:1452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49199.exe
        6⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26956.exe
        7⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14140.exe
        7⤵
        
        PID:12692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55121.exe
        7⤵
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20886.exe
        7⤵
        
        PID:11708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38309.exe
        6⤵
        
        PID:8628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48262.exe
        6⤵
        
        PID:13300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7072.exe
        6⤵
        
        PID:6200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57590.exe
        5⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe
        6⤵
        
        PID:7780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7810.exe
        6⤵
        
        PID:12112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10236.exe
        6⤵
        
        PID:15628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63210.exe
        6⤵
        
        PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59270.exe
        5⤵
        
        PID:9724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe
        5⤵
        
        PID:14136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61802.exe
        5⤵
        
        PID:9860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19141.exe
      4⤵
      PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59462.exe
        5⤵
        
        PID:8804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17125.exe
        5⤵
        
        PID:12580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe
        5⤵
        
        PID:8552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8220.exe
      4⤵
      PID:8188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62570.exe
      4⤵
      PID:12904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57226.exe
      4⤵
      PID:5724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48618.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48618.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11902.exe
      4⤵
      PID:3648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64383.exe
        5⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe
        6⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6741.exe
        6⤵
        
        PID:11564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60013.exe
        6⤵
        
        PID:16256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-361.exe
        6⤵
        
        PID:16164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19202.exe
        5⤵
        
        PID:8232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19516.exe
        5⤵
        
        PID:12244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16101.exe
        5⤵
        
        PID:15536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38785.exe
        5⤵
        
        PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54986.exe
        5⤵
        
        PID:11960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40293.exe
      4⤵
      PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe
        5⤵
        
        PID:1968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6741.exe
        5⤵
        
        PID:11552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47258.exe
        5⤵
        
        PID:2956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55870.exe
        5⤵
        
        PID:11948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40525.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24028.exe
      4⤵
      PID:12036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59594.exe
      4⤵
      PID:5760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36213.exe
    3⤵
    PID:4192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43932.exe
      4⤵
      PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4574.exe
        5⤵
        
        PID:9688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64614.exe
        5⤵
        
        PID:13344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24672.exe
        5⤵
        
        PID:2324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62259.exe
      4⤵
      PID:8984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13564.exe
      4⤵
      PID:12812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30922.exe
      4⤵
      PID:15764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37421.exe
      4⤵
      PID:11888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41775.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41775.exe
    3⤵
    PID:6156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37916.exe
      4⤵
      PID:7400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6741.exe
      4⤵
      PID:12064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60013.exe
      4⤵
      PID:16196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9161.exe
      4⤵
      PID:3848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1457.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1457.exe
    3⤵
    PID:8868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27849.exe
      4⤵
      PID:3504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60718.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60718.exe
    3⤵
    PID:12564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12753.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12753.exe
    3⤵
    PID:6552
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60289.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60289.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42765.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42765.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28691.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12428.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8814.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30351.exe
        7⤵
        
        PID:4928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57855.exe
        8⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3982.exe
        9⤵
        
        PID:7384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7810.exe
        9⤵
        
        PID:12096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48519.exe
        9⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22128.exe
        9⤵
        
        PID:11636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11221.exe
        8⤵
        
        PID:8688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16549.exe
        8⤵
        
        PID:12732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49313.exe
        8⤵
        
        PID:11048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18306.exe
        7⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe
        8⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11266.exe
        8⤵
        
        PID:11920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-553.exe
        8⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42829.exe
        7⤵
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52102.exe
        7⤵
        
        PID:12720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22256.exe
        7⤵
        
        PID:3048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38841.exe
        7⤵
        
        PID:11720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18866.exe
        6⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21452.exe
        7⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3982.exe
        8⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7810.exe
        8⤵
        
        PID:12120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30538.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11605.exe
        7⤵
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15868.exe
        7⤵
        
        PID:12852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63786.exe
        7⤵
        
        PID:4960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31852.exe
        6⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35775.exe
        7⤵
        
        PID:15412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20086.exe
        7⤵
        
        PID:6456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28739.exe
        6⤵
        
        PID:9784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
        6⤵
        
        PID:12912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57226.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38450.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33282.exe
        6⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe
        7⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17410.exe
        7⤵
        
        PID:11512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3033.exe
        7⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40490.exe
        7⤵
        
        PID:9168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17753.exe
        6⤵
        
        PID:8412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14146.exe
        6⤵
        
        PID:11788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27036.exe
        6⤵
        
        PID:16312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46473.exe
        6⤵
        
        PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51254.exe
        5⤵
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28876.exe
        6⤵
        
        PID:7536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1349.exe
        6⤵
        
        PID:11668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53661.exe
        6⤵
        
        PID:15112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37802.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22156.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28444.exe
        6⤵
        
        PID:11780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41585.exe
        6⤵
        
        PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8414.exe
        5⤵
        
        PID:13084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36021.exe
        5⤵
        
        PID:10440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54731.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58700.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56220.exe
        6⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50367.exe
        7⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19935.exe
        8⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56243.exe
        8⤵
        
        PID:12136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64279.exe
        8⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10837.exe
        7⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-213.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25584.exe
        7⤵
        
        PID:8404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60198.exe
        6⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21487.exe
        7⤵
        
        PID:9640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64614.exe
        7⤵
        
        PID:12868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8144.exe
        7⤵
        
        PID:664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64858.exe
        6⤵
        
        PID:9620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18677.exe
        6⤵
        
        PID:13384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14637.exe
        6⤵
        
        PID:7736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20018.exe
        5⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55551.exe
        6⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-94.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-94.exe
        7⤵
        
        PID:12996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22041.exe
        7⤵
        
        PID:9240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48819.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13388.exe
        6⤵
        
        PID:12544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6137.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59901.exe
        5⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27759.exe
        6⤵
        
        PID:11976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10064.exe
        6⤵
        
        PID:5632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21797.exe
        5⤵
        
        PID:8956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28844.exe
        5⤵
        
        PID:13868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56266.exe
        5⤵
        
        PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8549.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33282.exe
        5⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20812.exe
        6⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55366.exe
        6⤵
        
        PID:12160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48519.exe
        6⤵
        
        PID:14892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55870.exe
        6⤵
        
        PID:7952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe
        5⤵
        
        PID:9056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6082.exe
        5⤵
        
        PID:13264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5920.exe
        5⤵
        
        PID:15844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5593.exe
        5⤵
        
        PID:11580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49301.exe
      4⤵
      PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42159.exe
        5⤵
        
        PID:11244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12930.exe
        5⤵
        
        PID:14012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49617.exe
        5⤵
        
        PID:8200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39983.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39983.exe
      4⤵
      PID:8936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55300.exe
      4⤵
      PID:12804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31401.exe
      4⤵
      PID:8480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45121.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45121.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52698.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7086.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30351.exe
        6⤵
        
        PID:4580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36911.exe
        7⤵
        
        PID:3200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36847.exe
        8⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6741.exe
        8⤵
        
        PID:12216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64279.exe
        8⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64070.exe
        7⤵
        
        PID:8944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12220.exe
        7⤵
        
        PID:13608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29530.exe
        7⤵
        
        PID:8608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18117.exe
        6⤵
        
        PID:7272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22873.exe
        6⤵
        
        PID:9872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18677.exe
        6⤵
        
        PID:13348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56849.exe
        6⤵
        
        PID:5348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4725.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36172.exe
        6⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33436.exe
        7⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52422.exe
        7⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52497.exe
        7⤵
        
        PID:9020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21525.exe
        6⤵
        
        PID:9992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57885.exe
        6⤵
        
        PID:14404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9161.exe
        6⤵
        
        PID:8764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15065.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26342.exe
        5⤵
        
        PID:12056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40109.exe
        5⤵
        
        PID:15688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57226.exe
        5⤵
        
        PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54678.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37964.exe
        5⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20575.exe
        6⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13326.exe
        7⤵
        
        PID:10508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18293.exe
        7⤵
        
        PID:13656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34624.exe
        7⤵
        
        PID:10124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57542.exe
        6⤵
        
        PID:9952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45786.exe
        6⤵
        
        PID:14128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45674.exe
        6⤵
        
        PID:8588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45117.exe
        5⤵
        
        PID:8140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65484.exe
        6⤵
        
        PID:15772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46490.exe
        6⤵
        
        PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24790.exe
        5⤵
        
        PID:3544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25401.exe
        5⤵
        
        PID:14596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22889.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50662.exe
      4⤵
      PID:6336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32367.exe
        5⤵
        
        PID:11220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52422.exe
        5⤵
        
        PID:14480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31936.exe
        5⤵
        
        PID:8028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37724.exe
      4⤵
      PID:8828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4981.exe
      4⤵
      PID:12620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3176.exe
      4⤵
      PID:3320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46568.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46568.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9006.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56220.exe
        5⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20575.exe
        6⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24092.exe
        7⤵
        
        PID:10084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34738.exe
        7⤵
        
        PID:13952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41585.exe
        7⤵
        
        PID:15752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58803.exe
        6⤵
        
        PID:9836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45786.exe
        6⤵
        
        PID:14108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47402.exe
        6⤵
        
        PID:8240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18117.exe
        5⤵
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35055.exe
        6⤵
        
        PID:11644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39925.exe
        6⤵
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36161.exe
        6⤵
        
        PID:8580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24790.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22412.exe
        5⤵
        
        PID:404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29513.exe
        5⤵
        
        PID:7620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10693.exe
      4⤵
      PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44620.exe
        5⤵
        
        PID:7516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43814.exe
        5⤵
        
        PID:10560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49626.exe
        5⤵
        
        PID:14588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30538.exe
        5⤵
        
        PID:16128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37421.exe
        5⤵
        
        PID:11964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12828.exe
      4⤵
      PID:8096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17820.exe
        5⤵
        
        PID:15644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27849.exe
        5⤵
        
        PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42086.exe
      4⤵
      PID:11212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
      4⤵
      PID:14340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49497.exe
      4⤵
      PID:10524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10002.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22287.exe
      4⤵
      PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4238.exe
        5⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42751.exe
        6⤵
        
        PID:12012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29173.exe
        6⤵
        
        PID:15996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        6⤵
        
        PID:964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26713.exe
        5⤵
        
        PID:10496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21365.exe
        5⤵
        
        PID:13484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38785.exe
        5⤵
        
        PID:9736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54794.exe
        5⤵
        
        PID:12440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1781.exe
      4⤵
      PID:7328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1867.exe
        5⤵
        
        PID:16172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20086.exe
        5⤵
        
        PID:7112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38525.exe
      4⤵
      PID:9256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18677.exe
      4⤵
      PID:13296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40897.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15660.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15660.exe
    3⤵
    PID:6008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53276.exe
      4⤵
      PID:8072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16175.exe
        5⤵
        
        PID:15984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27657.exe
        5⤵
        
        PID:15856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5189.exe
      4⤵
      PID:9768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57885.exe
      4⤵
      PID:15328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23687.exe
      4⤵
      PID:9500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61267.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61267.exe
    3⤵
    PID:6288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51263.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51263.exe
    3⤵
    PID:11992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29092.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29092.exe
    3⤵
    PID:15752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63762.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63762.exe
    3⤵
    PID:1472
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4839.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4839.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15786.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52698.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56287.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44876.exe
        6⤵
        
        PID:1196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31327.exe
        7⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40303.exe
        8⤵
        
        PID:8348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23653.exe
        8⤵
        
        PID:11364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48519.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5984.exe
        8⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34085.exe
        7⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
        7⤵
        
        PID:11532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2370.exe
        7⤵
        
        PID:15812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5536.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6578.exe
        6⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37916.exe
        7⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31407.exe
        8⤵
        
        PID:12300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42497.exe
        8⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7810.exe
        7⤵
        
        PID:12076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43978.exe
        7⤵
        
        PID:15976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48135.exe
        7⤵
        
        PID:16192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42253.exe
        6⤵
        
        PID:8924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20498.exe
        6⤵
        
        PID:12740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5398.exe
        6⤵
        
        PID:8664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51046.exe
        5⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32783.exe
        6⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39359.exe
        7⤵
        
        PID:10028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36165.exe
        7⤵
        
        PID:14344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60225.exe
        7⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9906.exe
        6⤵
        
        PID:8208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47213.exe
        6⤵
        
        PID:14488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64746.exe
        6⤵
        
        PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11292.exe
        5⤵
        
        PID:7892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42159.exe
        6⤵
        
        PID:11164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44150.exe
        6⤵
        
        PID:15312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34432.exe
        6⤵
        
        PID:7604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56310.exe
        5⤵
        
        PID:10940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36828.exe
        5⤵
        
        PID:15148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8086.exe
        5⤵
        
        PID:6584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52861.exe
      4⤵
      PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47663.exe
        5⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe
        6⤵
        
        PID:6968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-690.exe
        6⤵
        
        PID:11408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3308.exe
        6⤵
        
        PID:15064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26759.exe
        6⤵
        
        PID:10760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34956.exe
        5⤵
        
        PID:9340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18085.exe
        5⤵
        
        PID:13668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34621.exe
        5⤵
        
        PID:10120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42515.exe
      4⤵
      PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18399.exe
        5⤵
        
        PID:8904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64022.exe
        5⤵
        
        PID:13688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48849.exe
        5⤵
        
        PID:7740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39453.exe
      4⤵
      PID:8960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60835.exe
      4⤵
      PID:12764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63539.exe
      4⤵
      PID:16176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47524.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47524.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23231.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31119.exe
        5⤵
        
        PID:1796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58623.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9742.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16149.exe
        7⤵
        
        PID:11468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52509.exe
        7⤵
        
        PID:15156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        7⤵
        
        PID:9856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20738.exe
        6⤵
        
        PID:8428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25001.exe
        6⤵
        
        PID:11928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39854.exe
        6⤵
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38457.exe
        6⤵
        
        PID:11868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28611.exe
        5⤵
        
        PID:7404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42269.exe
        5⤵
        
        PID:11592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2037.exe
        5⤵
        
        PID:14820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29667.exe
        5⤵
        
        PID:8160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53158.exe
      4⤵
      PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6926.exe
        5⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50239.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3221.exe
        6⤵
        
        PID:15008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18589.exe
        6⤵
        
        PID:9188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64387.exe
        5⤵
        
        PID:10228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        5⤵
        
        PID:12604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42410.exe
        5⤵
        
        PID:8172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15516.exe
      4⤵
      PID:7320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18927.exe
        5⤵
        
        PID:13528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45703.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44390.exe
      4⤵
      PID:9896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
      4⤵
      PID:12588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6166.exe
      4⤵
      PID:8576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52570.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52570.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33282.exe
      4⤵
      PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52892.exe
        5⤵
        
        PID:8120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24092.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16956.exe
        6⤵
        
        PID:15000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65274.exe
        6⤵
        
        PID:7088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19989.exe
        5⤵
        
        PID:11068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
        5⤵
        
        PID:15252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54714.exe
        5⤵
        
        PID:9756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46669.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9429.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9429.exe
      4⤵
      PID:12148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8505.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8505.exe
      4⤵
      PID:15576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22249.exe
      4⤵
      PID:4008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38742.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38742.exe
    3⤵
    PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60671.exe
      4⤵
      PID:7476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57183.exe
        5⤵
        
        PID:13848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19161.exe
        5⤵
        
        PID:5236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34213.exe
      4⤵
      PID:11684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53661.exe
      4⤵
      PID:15184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31834.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21756.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21756.exe
    3⤵
    PID:8064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60518.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60518.exe
    3⤵
    PID:11840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50623.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50623.exe
    3⤵
    PID:15740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58872.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58872.exe
    3⤵
    PID:6708
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64721.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64721.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1852.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1852.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23807.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23807.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14014.exe
        5⤵
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57855.exe
        6⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42159.exe
        7⤵
        
        PID:11236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44150.exe
        7⤵
        
        PID:15344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15600.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6508.exe
        6⤵
        
        PID:9788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51651.exe
        6⤵
        
        PID:14164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15789.exe
        6⤵
        
        PID:9520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53565.exe
        5⤵
        
        PID:7652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53503.exe
        6⤵
        
        PID:11772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23205.exe
        6⤵
        
        PID:4428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56145.exe
        6⤵
        
        PID:8600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63414.exe
        5⤵
        
        PID:10632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63930.exe
        5⤵
        
        PID:14512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40121.exe
        5⤵
        
        PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34133.exe
      4⤵
      PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-110.exe
        5⤵
        
        PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9522.exe
        5⤵
        
        PID:9444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        5⤵
        
        PID:12780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44138.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45226.exe
      4⤵
      PID:7912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43311.exe
        5⤵
        
        PID:10976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13013.exe
        5⤵
        
        PID:14608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28189.exe
        5⤵
        
        PID:3728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56310.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56310.exe
      4⤵
      PID:10924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6268.exe
      4⤵
      PID:15224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64490.exe
      4⤵
      PID:9292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37298.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37298.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43615.exe
      4⤵
      PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2878.exe
        5⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55695.exe
        6⤵
        
        PID:10116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17525.exe
        6⤵
        
        PID:14000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32896.exe
        6⤵
        
        PID:4184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11221.exe
        5⤵
        
        PID:8700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32694.exe
        5⤵
        
        PID:3876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-496.exe
        5⤵
        
        PID:9092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14357.exe
      4⤵
      PID:7116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19285.exe
        5⤵
        
        PID:8464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58938.exe
        6⤵
        
        PID:8452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15506.exe
        5⤵
        
        PID:13220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57233.exe
        5⤵
        
        PID:2004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45273.exe
        5⤵
        
        PID:10172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49933.exe
      4⤵
      PID:8368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10581.exe
      4⤵
      PID:11836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8204.exe
      4⤵
      PID:16240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54538.exe
      4⤵
      PID:1324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63629.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63629.exe
    3⤵
    PID:1760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41903.exe
      4⤵
      PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59135.exe
        5⤵
        
        PID:7868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33253.exe
        5⤵
        
        PID:11812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3692.exe
        5⤵
        
        PID:15400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21465.exe
        5⤵
        
        PID:6300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36197.exe
      4⤵
      PID:8372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63503.exe
        5⤵
        
        PID:12880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43609.exe
        5⤵
        
        PID:15940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58670.exe
        5⤵
        
        PID:11676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4716.exe
      4⤵
      PID:11680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57425.exe
      4⤵
      PID:1312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55862.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55862.exe
    3⤵
    PID:6844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62911.exe
      4⤵
      PID:10432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64614.exe
      4⤵
      PID:6380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42414.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42414.exe
      4⤵
      PID:8408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2940.exe
    3⤵
    PID:9916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26450.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26450.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:14156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39075.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39075.exe
    3⤵
    PID:8280
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59720.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59720.exe
  2⤵
  - Executes dropped EXE
  PID:5036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6427.exe
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44876.exe
      4⤵
      PID:3540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62463.exe
        5⤵
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
        6⤵
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6741.exe
        6⤵
        
        PID:12208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11305.exe
        6⤵
        
        PID:15588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57978.exe
        6⤵
        
        PID:11040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12652.exe
        5⤵
        
        PID:6916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28918.exe
        6⤵
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24928.exe
        6⤵
        
        PID:11600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1474.exe
        5⤵
        
        PID:13052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30672.exe
        5⤵
        
        PID:3296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16562.exe
      4⤵
      PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48111.exe
        5⤵
        
        PID:10616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
        5⤵
        
        PID:14368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39726.exe
        5⤵
        
        PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24764.exe
      4⤵
      PID:8644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63622.exe
      4⤵
      PID:12328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54346.exe
      4⤵
      PID:3188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49894.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49894.exe
    3⤵
    PID:2128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21452.exe
      4⤵
      PID:6712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13326.exe
        5⤵
        
        PID:10580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19445.exe
        5⤵
        
        PID:14388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60033.exe
        5⤵
        
        PID:15628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49478.exe
      4⤵
      PID:9280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
      4⤵
      PID:13568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21705.exe
      4⤵
      PID:15968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32729.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32729.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29193.exe
      4⤵
      PID:5660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61110.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61110.exe
    3⤵
    PID:9320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10012.exe
    3⤵
    PID:13740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56458.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56458.exe
    3⤵
    PID:5488
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15253.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15253.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43615.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43615.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51119.exe
      4⤵
      PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18399.exe
        5⤵
        
        PID:8752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64022.exe
        5⤵
        
        PID:13600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52497.exe
        5⤵
        
        PID:8756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11221.exe
      4⤵
      PID:8724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40653.exe
      4⤵
      PID:12524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38401.exe
      4⤵
      PID:15860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18306.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18306.exe
    3⤵
    PID:6396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5740.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5740.exe
    3⤵
    PID:9904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51651.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51651.exe
    3⤵
    PID:14060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49313.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49313.exe
    3⤵
    PID:6800
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31484.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31484.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33685.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33685.exe
    3⤵
    PID:7176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26044.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26044.exe
    3⤵
    PID:10972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7253.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7253.exe
    3⤵
    PID:14952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33853.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33853.exe
    3⤵
    PID:6284
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45732.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45732.exe
  2⤵
  PID:7464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3954.exe
    3⤵
    PID:10352
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2010.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2010.exe
  2⤵
  PID:11488
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10277.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10277.exe
  2⤵
  PID:2664
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33759.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33759.exe
  2⤵
  PID:5640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6752 -ip 6752
1⤵
PID:10100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 13844 -ip 13844
1⤵
PID:15672

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12256.exe

Filesize
468KB

MD5
97f34678c8eec4a6dab4870d58dde16a

SHA1
db22b5d6b582bdc28fea5a3d4438447f61194e96

SHA256
1e6088626ea0c051429c3f3de0acff78c2f637ed20550b19dcac3b4760aca628

SHA512
82b115f04ba1d07777073c1be5c454b0fafb682d57f75f1354f5d166db317679bce8a2e6b07acb058d87502ccc9fefc0dba4df087bb93d8e4276a1ee5b6f29fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12428.exe

Filesize
468KB

MD5
ed19f4ebca7c82c5bf2f1237b35aab2b

SHA1
9debc25ccbff011e8a331e4340f5d0e878541f07

SHA256
7624648644fd58acf0be1769e11d670a849f4fe5355a2136b0417d4b1f81e169

SHA512
fd33f552451489f0278f24630e7b57756d232e4a1d7d4afea69a1c8c1a0170cd47d1f1d53d720c1ddef4584cceb45d93ebe49ee04af1267d170e8a463ad2a4b8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12442.exe

Filesize
468KB

MD5
bcd6a657b1d0df3793879b6292e404d9

SHA1
0265ba40361886d9e609b16f18b36596655d8407

SHA256
d89648f4a931831bdf6dabe32a20313781cc45e70b2b956572096db9ec26497b

SHA512
ce6819594e18d4c88b15766fdaa615dfa7994b3baf7504070adbbb89c78a38689adb1889d293e6d07946af6636f9b24071881f5172c8de1ae79a1c553753a30f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14524.exe

Filesize
468KB

MD5
5f330199450b584dffe6d9adb673b563

SHA1
97ad7578571c9e32ccb4f814c3cd47a12714c015

SHA256
56c8b507914bed7f534a031a78fa198d8c175eed6bb69ccbfc0f0012b64840ce

SHA512
ae5230448fbd097af5a43d8846fa1b786ab64f48eb993420f4fef8c5aae7ee32c3de89049693066f3785ff61439d8db0e77883a49ccc257b2e8765496d963327

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15786.exe

Filesize
468KB

MD5
4e8bc48476131d5b4ad4bedda848e38f

SHA1
45573326501a0dec78c0e42c22f26391d7db7e55

SHA256
650c3831bff6929626cb6afc18e5808ef9fa2e52bbf57e089bf093c9742be405

SHA512
fe95a083a61bd98b902d6d1a077957654eae8368018d39abb7c5110edde2101e200bb5438d6250709059f6870dca6b694d77912bb0d33d798c1c3414c75b658c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18307.exe

Filesize
468KB

MD5
b9c90965e59d8ab802b51cf1f97d6b2c

SHA1
538954cced3efd47c3e6e5b53d78aba716657b29

SHA256
4fc322f91e4dc78b9cbce9cc33c192428319c699bf4ca6461d6c46895b4514c6

SHA512
a6b004d8cd30827d4c5d6bf9b15e3109ab9cd1e01d7ddb31a9711ee8093f8caedc8e6602dd7b1679f3d18a388671f2be8aa23e908e13613dbf929771fd970ab3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1852.exe

Filesize
468KB

MD5
00dc5eac03221950325202347b301b34

SHA1
ca36873d224443f2860dc56f8a0a13d36dcdd041

SHA256
64a3cea6bc31cb7bfa098a90bfaf9dc0016072aac39e4344da5e2293f4458b27

SHA512
25a6a892b7a4c798892f9150b2d14615d9b16948d5304b9640ec8828ece1fc4a7f8a350606f57bc1a8a7c6fca755d91ecb57af30e8d47c2757bf2c3161003bd8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28691.exe

Filesize
468KB

MD5
90d2e7bcd97f05385530b4df209b9241

SHA1
0ad7fd4e93c9a5ff03578e4adf75a66e99c80c69

SHA256
4e5be3d72ffd3debf59bae623a50a6d82431808db09ecc32665fe94f8b710c22

SHA512
6342e36d6a42a40bb7a63ceae65a0e3fd7b73a277adcbc2bcd115c2b9947132e1755c18eb57099614a130a395f8de65965e6dfda3f0480970bb1e8d56e8398de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29481.exe

Filesize
468KB

MD5
c53f57f0c2c4fbaf770ab279ccb5426d

SHA1
75f6e18b9df2fb9dca0f711bebd854c0d0e57b5c

SHA256
dfb92a4516598630bedf05affadb11514553bdc524b8cb92eb9cb3c45adc1727

SHA512
112c438531330826eb9d1a7f898d3676445051e1b787806da5febb562514cfb751b49cd77a0b1a83a3dd845b4fc1e6bea10fbb269081f764977f226eec88a776

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29885.exe

Filesize
468KB

MD5
6bff5b1e0190e61369fad2827aec7905

SHA1
796debbd5675e57b729bb91494cedcf7dd4c4ddd

SHA256
9b009332b99edb80b5e5766c56dc4b1f0fe742a38f0f91c1c040237b14a85103

SHA512
2dfee5152cfcadd89ac8509d127a8fa3b668317a75d8191e27ae2e7d4939f51b501156dbb121ae2991a66a9f7720bbffef65cd7d7626468846ed9b4c0b474543

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32122.exe

Filesize
468KB

MD5
0c789d0d41cd008b09088b588da7a765

SHA1
25fe84ed41d1d795ee441355fab38daf4ca4a5fc

SHA256
324746671ed4fea2c51527d64b96bbbed06d34fb9a1f3e2f139452f6523d687d

SHA512
838d419a50b394942e43746b68d0b12ced61f3a80acb4d9fca9c7a0fc59dd0d12cb5a143dd1c5c10635f5a7b193fd4ff3863886a58b7f5bfbdf86d51500c4bbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33024.exe

Filesize
468KB

MD5
f292e345181d2421e8e8c5e1149946ab

SHA1
41e09cdd999f9b6a7bf629cec94ffd20c76cb8ca

SHA256
7d561833c7edea50323d88f29c243b704f6b2b318c6f08e277dbb67e39a2c359

SHA512
700198286815aa86457db0838625d0dcbfbd34a89daf61b0417e441cc999976cadb436f0122f779a66c58e34c2b77bcc8510ea9df7d60cc7dc04a578f2a63cca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33216.exe

Filesize
468KB

MD5
bf73f8ec0ce9299b01080842328eba9f

SHA1
71407764312d933634ed09ee4558ec6b694cb7aa

SHA256
45a0b1c134c33de4ac7a23c65fa9ef349a1c9857a20f5125470b55846c2b1064

SHA512
d6f888ec438407faa22c8bbd0fb4b06ba8eee23f65798920375ec6ca80bcb8c893323651cd2e498362dd4727617be4efffc370d0b477624303fe18aa255a9aa4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42765.exe

Filesize
468KB

MD5
080a1fd47044697b6d623f34c1707072

SHA1
b143fa8942313e629caf99a0eeb86d3f9903a771

SHA256
243bd311236d246a43f1f109f0b7616cdffc1d98269cf8817599287b21d2cb00

SHA512
e0dc1a678c2adfd8178819952c6e12d65c0ee4b35052e86bedac170710698509f13f95434b5ad56124c12aa8e39ff18f538b39e06cae7fcd347d991e1fbdc26f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45121.exe

Filesize
468KB

MD5
8967491ec56e48e9389b1c0a166d1a01

SHA1
f8f3cc9981b2160b2401ea7ab1f7805760524943

SHA256
b108a39001062d2865a6e70b75bd21f3c2d2eee971e1288cae5758b1ac1ba3bd

SHA512
1c255dfaeb33ced9659fc71a39be0a50642293e8a64522dd6c47779ea2617ae63761d949aed02afe743c17295ad7f134806842b19c1550bbdf1aa3ee13a6c06b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45711.exe

Filesize
468KB

MD5
e79c1387eef9e42b678ceb270513e6ac

SHA1
654bfb416be7b5a0855ee9414c54279376609c04

SHA256
526f09020e212d15e8684871ec8b76043e3059bcf2445f095f1a22a795969a73

SHA512
c867f72d2dc8f7fcb58d4be18126253144a5d0df327dc25f5fee00be2ec2795e3eafae6105255f98ee28855ff9447ea2bb87c5f1a43d235f9fcd60b8421cfddc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46465.exe

Filesize
468KB

MD5
37a1ceca4831f7e38c706c17cd105e71

SHA1
d402a19a53ee8764710d8b25f28f50c18165adb8

SHA256
2fd95397d9ec6cabb62b243cf1c630008aba7c108ed102c1dd8fb78226d8a37e

SHA512
b0e6888e1507c87f9fcd49eaf89302d0f93202032d7a4b748a3acf06c86dcfb3a874453d6b0df96e138b1496068d7b1d4a99661415e3fc471bf8946f2d01f9dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46568.exe

Filesize
468KB

MD5
9fcc1f785edc1d174ace516540a4805f

SHA1
c6f04ffaf2d79c30743f3f7662e69fa667bca27d

SHA256
f3b798e4ac105d136154d3741c17e1897ec2a407bb8af7bfa9a0c34da9f8a8cc

SHA512
36c4f8593eb02dd8d54ec5a326867120db9fec0df39931ba1d38faafa9b9b14dfdeaa748e39ca107838807e3635c56b44c7005d0c44f0c135d6275a46c8da7fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47524.exe

Filesize
468KB

MD5
7deb6d6ff4e258f7bef51cbdefeffcee

SHA1
eeabffd95c97c193e2051a3cfaf014b26c2fa27a

SHA256
d81c34301f166564b1cbf6bcfcda85d07aea891b49d87a6a3e92531812334ae0

SHA512
710ec81602077a35ad7adc36d986ad32b5b1169c9fc394a4d443a1a5d146eaa30f07254143dac0a8021fe15001a2c9ca213bcc239d4c05eb74fdee6beaaad3f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4839.exe

Filesize
468KB

MD5
d1d07c9eac197ccc3d728ac09a6fd3b7

SHA1
577f0899dc51dc8b43c5a91a39b42eea52190bc6

SHA256
7af2ead31b738a0db6ff3721d01c23e9ee1b9f8b445c8b69de065080aa5541ad

SHA512
e36670fbdcf887d2dff6bc78aa3639c8c75cccaf2808e478c345f43e9bcc60d3ca0b0a0e12d08ca256b36fc8dbc085efd77ac460da1393ab45fe9628a8903e15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50394.exe

Filesize
468KB

MD5
fdaa2e1f45dc67787716af99dec67aef

SHA1
b42cafe8be4ddd98e313a1d04fcc6d1ded34e07f

SHA256
69850c1018d0f87a096f8b6e561570ede2257567afdf1c5b0e4fbf9481c61583

SHA512
e121778adefc4141c3ba4082f99c5576000154c816c0c276d64a84fb5aeffa360b64eac3cdd416897b42e9613061e583edb40e26cc7d3cab7b76379ae83bd1bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52122.exe

Filesize
468KB

MD5
dd942bc00e4fb817b28530adcfa0a249

SHA1
1c4df4efb1c4f13461cf0e8437af6c058fbda6cf

SHA256
5aaa751ec858209e01cf03c9c7a4416560b7c40c8f0a389f8988c7601fcc3659

SHA512
7351ca1bbd9f9607940522faae5f581054b39fdd83fec3892dae580654385ceb1585a236b7a72312fd9f6154ca68e5a5734bd82ed9b161e8ce7a6f2e293832ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52698.exe

Filesize
468KB

MD5
8471c154e2a31496ae5fd0142ac03355

SHA1
98dc3b3ac8c028019b7c0ea0cfc6370466ca770f

SHA256
5ce3e15d7c6ce594cccec2bc607dcc4fdb418920358953afe8c5836c3631fe26

SHA512
d4473ba91da0b77f61a09a4c9173fbd922768e856e011a0575d7b6536f99ad8a5f8de9efcd10a452e4f3f85e0eb271a9c58b32fe2191e7c4567a34f61236ebee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52890.exe

Filesize
468KB

MD5
370d01ec1add0cc90fd240f4277b0f05

SHA1
a2f9e8772d460d4460f3bf934f88ff35404df722

SHA256
8a6cee963e25d5c905068a170592d2eb99aaf74dfe8f79b9790516bf34c023ef

SHA512
f62ab5cf53b4a61b9b359e37d59833bb4aaaf3fdfc440d9b9ab15502afeaa3f56016f76fdf53936610f7d0359211503ed5e87537c4ce39b7f2555325fe6e6a33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54731.exe

Filesize
468KB

MD5
12c33791a9d19bb8d78719ccd64b3d37

SHA1
33d071b36ea8a90d5a1e7315aef1d8f600b81626

SHA256
57c153884f3358a0cd9a80323cb6c50ad57e02ca0d5048c93c6d078c412f3dc5

SHA512
580d0553c30cb8b3cf1ce4ac0484d6ddf3bc95d8acf728e57c93c830839c2f2e1bfc55cbd5a9a71999f063ec210b3389459b64282aecf957624575257fda8c55

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59720.exe

Filesize
468KB

MD5
3ad0aaca8a5e59665a3606de046243df

SHA1
09fb0c7c91b9b5391bf2eea28a4d99a6edc910f6

SHA256
ab73d8f704415b2c1fb7041660c989247945083c4671702e51f9d48430250a74

SHA512
1ec5207e1542daf17d4c12d9de9593e7bbbe1de6327ee0d60dc50c43c669d6ba4f87fc889d12bdb5ad66eb83acd13b250f4d760621bd575bc0aa887c1df9c0fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60289.exe

Filesize
468KB

MD5
35ebc335b301c9fd602e0789be43795a

SHA1
212cd8b9564067587593d67ba82dc7df7807c996

SHA256
e259f5c51fcff15b6a1867a1463ea0fc83fa7fd9e7a81a3cd5f74e2c26f63b9d

SHA512
35365ef8d7c0d7099ed989b56235ca37ca5406e677ea0751dd0474fe2ab498e7553522c3f0dce530649e223219ad01baa6e4144f9dbba71db186276022035cee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60634.exe

Filesize
468KB

MD5
54cedd4433150e635863e4214938f85d

SHA1
0962c2c5ae2f48d24b1f8e392064dd46bcf279f9

SHA256
0e2dda5b932e08dfa80eb840828623506f1e12c9a281f06863bdb5ce36e4a65f

SHA512
d787ed2358e94f980c1cac25b904bec0062379210768c82f60475b8bbce113a921977ef03017fdd8a2cf7b61b61695a549e701183d9dfb68179e9b29d411d88c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62358.exe

Filesize
468KB

MD5
8f7f6ce6770fe1d2e5c2dd31b1979803

SHA1
1bfc2521996f31e83c94ca0bce0f79880f82303c

SHA256
c4993fb0323793bc43156474b3597c45a7b7c400c112740b9abbb36128bb929c

SHA512
832cafd1d1a6df67e5f109050810acb3c5206bb54c5237275a474b636abe0a35999a7da13988cb20b841e2a1d29a73a4c654d1d48783e8609096055e1ccf5bf0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64721.exe

Filesize
468KB

MD5
f0fbdee0f6ac4053e6bef6ab9361842b

SHA1
15e8a3aa290b638fe8361b26ffda4fc0361cec6f

SHA256
2977a0a54a0d2fb6c8a3630bdf303e743637673b1c36e9628a0f48a310e06729

SHA512
a1f51193774392af2578cfc675a9ab58efada6b0ce9464ee078af34af470f76ff61b3f2d9048dd92cda2036d0969cecf37f52b8bc08560545648da536d2539ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9079.exe

Filesize
468KB

MD5
bbfbe3c2d1e41289c17036a43b7f7b82

SHA1
22fcb43f2ba534c05a6d50ee0edd145fbb069239

SHA256
2b10ed96ee401b5d999df41c1c9c04a1d74098284ed5f76378b048be5178f609

SHA512
b9c57ecd9bc239fd9b17bdda768685e45dc64418a4cc5c4dd083c40d77d53067252fd5f70153b6060827ea5994f05920929929eda6f5c42fa196d1ff423fbfbe

Download Submit
memory/428-366-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/632-263-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/660-170-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/812-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1036-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1068-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1204-120-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1232-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1292-496-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1348-160-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1396-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1420-104-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1424-290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1452-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1488-207-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1492-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1508-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1564-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1596-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1600-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1616-125-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1632-419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1644-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1672-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1728-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1732-216-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1760-499-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1796-492-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1944-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1988-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2104-71-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2128-500-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2136-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2184-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2196-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2240-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2276-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2284-69-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2288-70-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2304-47-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2416-474-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2432-163-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2544-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2548-53-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2632-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2704-245-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2708-205-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2736-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2836-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2904-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2976-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3020-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3208-153-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3272-435-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3440-132-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3472-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3540-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3572-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3584-79-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3596-433-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3620-175-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3648-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3660-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3860-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3916-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4076-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4168-464-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4188-30-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4192-490-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4240-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4244-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4276-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4280-171-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4304-491-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4352-367-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4364-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4368-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4460-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4472-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4540-233-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4668-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4692-417-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4724-497-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4732-344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4772-265-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4808-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5016-363-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5036-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5132-501-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5332-535-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5376-553-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5404-556-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5412-560-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5436-561-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5452-562-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5468-563-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads