083a9842746e2f2ef6763fe478ad0a29b34e0650f92e460f3ab185db78eaacf2

Analysis

max time kernel
150s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 18:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

083a9842746e2f2ef6763fe478ad0a29b34e0650f92e460f3ab185db78eaacf2.exe
Size

468KB
MD5

1db1efe18eb8eec69ac2d77176a1fe52
SHA1

a1624343b767c19e0014c8b3c819e2436a4d9862
SHA256

083a9842746e2f2ef6763fe478ad0a29b34e0650f92e460f3ab185db78eaacf2
SHA512

749971b690176409dfab4a8670f6e64b73262ec054ac581f053c2005ab9810b17fc48f645b458c1af1cf9eeb1c4516a5d45ad6fcb5297836bdba2ca093ed8a42
SSDEEP

3072:W1N/ogLdaM8Unb/sP35Kff1cfhjfI8JnmHevV1Mc2e3GVX52WlG:W1Bo9BUnYPpKff2xPgc20+X52

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
5032	Unicorn-52801.exe
816	Unicorn-8836.exe
2580	Unicorn-54508.exe
4448	Unicorn-52931.exe
4352	Unicorn-37149.exe
5024	Unicorn-61099.exe
1536	Unicorn-59821.exe
3768	Unicorn-13626.exe
3776	Unicorn-13626.exe
3336	Unicorn-25879.exe
224	Unicorn-19748.exe
3528	Unicorn-25614.exe
1236	Unicorn-25879.exe
2708	Unicorn-6013.exe
4776	Unicorn-24984.exe
3588	Unicorn-29553.exe
3460	Unicorn-37721.exe
4468	Unicorn-52666.exe
1012	Unicorn-26023.exe
1960	Unicorn-49973.exe
2364	Unicorn-13116.exe
1124	Unicorn-27969.exe
3308	Unicorn-47835.exe
2716	Unicorn-47835.exe
4464	Unicorn-51919.exe
1472	Unicorn-42989.exe
1984	Unicorn-29096.exe
368	Unicorn-13579.exe
812	Unicorn-52687.exe
2336	Unicorn-56506.exe
4752	Unicorn-33205.exe
4120	Unicorn-37311.exe
2876	Unicorn-2308.exe
4924	Unicorn-9106.exe
2388	Unicorn-13190.exe
628	Unicorn-17275.exe
1280	Unicorn-17275.exe
2552	Unicorn-13745.exe
5068	Unicorn-49682.exe
1112	Unicorn-30081.exe
556	Unicorn-31473.exe
4160	Unicorn-31473.exe
5012	Unicorn-50502.exe
3576	Unicorn-4830.exe
212	Unicorn-37595.exe
3820	Unicorn-47809.exe
2996	Unicorn-45763.exe
4780	Unicorn-53931.exe
3428	Unicorn-34595.exe
1068	Unicorn-51131.exe
2100	Unicorn-40195.exe
4192	Unicorn-56532.exe
2644	Unicorn-50295.exe
3224	Unicorn-23653.exe
3408	Unicorn-34513.exe
3080	Unicorn-49533.exe
4908	Unicorn-32397.exe
1212	Unicorn-61077.exe
3368	Unicorn-15869.exe
2800	Unicorn-30813.exe
2104	Unicorn-38235.exe
2724	Unicorn-61348.exe
4628	Unicorn-471.exe
5052	Unicorn-471.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3328	3588	WerFault.exe	98
11696	10836	WerFault.exe	502

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65496.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42989.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12223.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58645.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35651.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5126.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61909.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27549.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61976.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64036.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56381.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28588.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16693.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31677.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28781.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49885.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57747.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14276.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54098.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49172.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28583.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7319.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37989.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51141.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41489.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15008	dwm.exe
Token: SeChangeNotifyPrivilege	15008	dwm.exe
Token: 33	15008	dwm.exe
Token: SeIncBasePriorityPrivilege	15008	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
468	083a9842746e2f2ef6763fe478ad0a29b34e0650f92e460f3ab185db78eaacf2.exe
5032	Unicorn-52801.exe
816	Unicorn-8836.exe
2580	Unicorn-54508.exe
4448	Unicorn-52931.exe
4352	Unicorn-37149.exe
5024	Unicorn-61099.exe
1536	Unicorn-59821.exe
3776	Unicorn-13626.exe
3768	Unicorn-13626.exe
2708	Unicorn-6013.exe
1236	Unicorn-25879.exe
3336	Unicorn-25879.exe
3528	Unicorn-25614.exe
224	Unicorn-19748.exe
4776	Unicorn-24984.exe
3460	Unicorn-37721.exe
1012	Unicorn-26023.exe
4468	Unicorn-52666.exe
1960	Unicorn-49973.exe
2364	Unicorn-13116.exe
1984	Unicorn-29096.exe
1124	Unicorn-27969.exe
368	Unicorn-13579.exe
2716	Unicorn-47835.exe
1472	Unicorn-42989.exe
3308	Unicorn-47835.exe
4464	Unicorn-51919.exe
812	Unicorn-52687.exe
2336	Unicorn-56506.exe
4752	Unicorn-33205.exe
4120	Unicorn-37311.exe
2876	Unicorn-2308.exe
4924	Unicorn-9106.exe
2388	Unicorn-13190.exe
628	Unicorn-17275.exe
1280	Unicorn-17275.exe
2552	Unicorn-13745.exe
5068	Unicorn-49682.exe
1112	Unicorn-30081.exe
556	Unicorn-31473.exe
4160	Unicorn-31473.exe
3428	Unicorn-34595.exe
4780	Unicorn-53931.exe
1068	Unicorn-51131.exe
2996	Unicorn-45763.exe
5012	Unicorn-50502.exe
4192	Unicorn-56532.exe
3820	Unicorn-47809.exe
212	Unicorn-37595.exe
2100	Unicorn-40195.exe
3576	Unicorn-4830.exe
3224	Unicorn-23653.exe
3408	Unicorn-34513.exe
2644	Unicorn-50295.exe
3080	Unicorn-49533.exe
1212	Unicorn-61077.exe
4908	Unicorn-32397.exe
2800	Unicorn-30813.exe
3368	Unicorn-15869.exe
2104	Unicorn-38235.exe
2724	Unicorn-61348.exe
4628	Unicorn-471.exe
5052	Unicorn-471.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 468 wrote to memory of 5032	468	083a9842746e2f2ef6763fe478ad0a29b34e0650f92e460f3ab185db78eaacf2.exe	83
PID 468 wrote to memory of 5032	468	083a9842746e2f2ef6763fe478ad0a29b34e0650f92e460f3ab185db78eaacf2.exe	83
PID 468 wrote to memory of 5032	468	083a9842746e2f2ef6763fe478ad0a29b34e0650f92e460f3ab185db78eaacf2.exe	83
PID 5032 wrote to memory of 816	5032	Unicorn-52801.exe	84
PID 5032 wrote to memory of 816	5032	Unicorn-52801.exe	84
PID 5032 wrote to memory of 816	5032	Unicorn-52801.exe	84
PID 468 wrote to memory of 2580	468	083a9842746e2f2ef6763fe478ad0a29b34e0650f92e460f3ab185db78eaacf2.exe	85
PID 468 wrote to memory of 2580	468	083a9842746e2f2ef6763fe478ad0a29b34e0650f92e460f3ab185db78eaacf2.exe	85
PID 468 wrote to memory of 2580	468	083a9842746e2f2ef6763fe478ad0a29b34e0650f92e460f3ab185db78eaacf2.exe	85
PID 816 wrote to memory of 4448	816	Unicorn-8836.exe	86
PID 816 wrote to memory of 4448	816	Unicorn-8836.exe	86
PID 816 wrote to memory of 4448	816	Unicorn-8836.exe	86
PID 5032 wrote to memory of 4352	5032	Unicorn-52801.exe	88
PID 5032 wrote to memory of 4352	5032	Unicorn-52801.exe	88
PID 5032 wrote to memory of 4352	5032	Unicorn-52801.exe	88
PID 2580 wrote to memory of 5024	2580	Unicorn-54508.exe	87
PID 2580 wrote to memory of 5024	2580	Unicorn-54508.exe	87
PID 2580 wrote to memory of 5024	2580	Unicorn-54508.exe	87
PID 468 wrote to memory of 1536	468	083a9842746e2f2ef6763fe478ad0a29b34e0650f92e460f3ab185db78eaacf2.exe	89
PID 468 wrote to memory of 1536	468	083a9842746e2f2ef6763fe478ad0a29b34e0650f92e460f3ab185db78eaacf2.exe	89
PID 468 wrote to memory of 1536	468	083a9842746e2f2ef6763fe478ad0a29b34e0650f92e460f3ab185db78eaacf2.exe	89
PID 4448 wrote to memory of 3776	4448	Unicorn-52931.exe	91
PID 4448 wrote to memory of 3776	4448	Unicorn-52931.exe	91
PID 4448 wrote to memory of 3776	4448	Unicorn-52931.exe	91
PID 4352 wrote to memory of 3768	4352	Unicorn-37149.exe	90
PID 4352 wrote to memory of 3768	4352	Unicorn-37149.exe	90
PID 4352 wrote to memory of 3768	4352	Unicorn-37149.exe	90
PID 5024 wrote to memory of 3336	5024	Unicorn-61099.exe	92
PID 5024 wrote to memory of 3336	5024	Unicorn-61099.exe	92
PID 5024 wrote to memory of 3336	5024	Unicorn-61099.exe	92
PID 5032 wrote to memory of 224	5032	Unicorn-52801.exe	93
PID 5032 wrote to memory of 224	5032	Unicorn-52801.exe	93
PID 5032 wrote to memory of 224	5032	Unicorn-52801.exe	93
PID 1536 wrote to memory of 1236	1536	Unicorn-59821.exe	95
PID 1536 wrote to memory of 1236	1536	Unicorn-59821.exe	95
PID 1536 wrote to memory of 1236	1536	Unicorn-59821.exe	95
PID 468 wrote to memory of 3528	468	083a9842746e2f2ef6763fe478ad0a29b34e0650f92e460f3ab185db78eaacf2.exe	94
PID 468 wrote to memory of 3528	468	083a9842746e2f2ef6763fe478ad0a29b34e0650f92e460f3ab185db78eaacf2.exe	94
PID 468 wrote to memory of 3528	468	083a9842746e2f2ef6763fe478ad0a29b34e0650f92e460f3ab185db78eaacf2.exe	94
PID 816 wrote to memory of 2708	816	Unicorn-8836.exe	96
PID 816 wrote to memory of 2708	816	Unicorn-8836.exe	96
PID 816 wrote to memory of 2708	816	Unicorn-8836.exe	96
PID 2580 wrote to memory of 4776	2580	Unicorn-54508.exe	97
PID 2580 wrote to memory of 4776	2580	Unicorn-54508.exe	97
PID 2580 wrote to memory of 4776	2580	Unicorn-54508.exe	97
PID 3768 wrote to memory of 3588	3768	Unicorn-13626.exe	98
PID 3768 wrote to memory of 3588	3768	Unicorn-13626.exe	98
PID 3768 wrote to memory of 3588	3768	Unicorn-13626.exe	98
PID 3776 wrote to memory of 3460	3776	Unicorn-13626.exe	100
PID 3776 wrote to memory of 3460	3776	Unicorn-13626.exe	100
PID 3776 wrote to memory of 3460	3776	Unicorn-13626.exe	100
PID 4448 wrote to memory of 4468	4448	Unicorn-52931.exe	101
PID 4448 wrote to memory of 4468	4448	Unicorn-52931.exe	101
PID 4448 wrote to memory of 4468	4448	Unicorn-52931.exe	101
PID 4352 wrote to memory of 1012	4352	Unicorn-37149.exe	102
PID 4352 wrote to memory of 1012	4352	Unicorn-37149.exe	102
PID 4352 wrote to memory of 1012	4352	Unicorn-37149.exe	102
PID 2708 wrote to memory of 1960	2708	Unicorn-6013.exe	104
PID 2708 wrote to memory of 1960	2708	Unicorn-6013.exe	104
PID 2708 wrote to memory of 1960	2708	Unicorn-6013.exe	104
PID 816 wrote to memory of 2364	816	Unicorn-8836.exe	105
PID 816 wrote to memory of 2364	816	Unicorn-8836.exe	105
PID 816 wrote to memory of 2364	816	Unicorn-8836.exe	105
PID 1536 wrote to memory of 1124	1536	Unicorn-59821.exe	106

C:\Users\Admin\AppData\Local\Temp\083a9842746e2f2ef6763fe478ad0a29b34e0650f92e460f3ab185db78eaacf2.exe
"C:\Users\Admin\AppData\Local\Temp\083a9842746e2f2ef6763fe478ad0a29b34e0650f92e460f3ab185db78eaacf2.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:468
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52801.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52801.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8836.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8836.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52931.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13626.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37721.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37311.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15869.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62521.exe
        9⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56403.exe
        10⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50591.exe
        11⤵
        
        PID:14712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26613.exe
        11⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:12948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24720.exe
        10⤵
        
        PID:16676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11239.exe
        9⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64727.exe
        10⤵
        
        PID:16004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35907.exe
        10⤵
        
        PID:9924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-958.exe
        9⤵
        
        PID:10752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63934.exe
        9⤵
        
        PID:14876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27593.exe
        9⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19905.exe
        8⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58707.exe
        9⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58764.exe
        9⤵
        
        PID:12336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45328.exe
        9⤵
        
        PID:1364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6594.exe
        9⤵
        
        PID:13188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43257.exe
        8⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14276.exe
        8⤵
        
        PID:11644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25032.exe
        8⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30813.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1068.exe
        8⤵
        
        PID:1396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37929.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60129.exe
        10⤵
        
        PID:14172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47226.exe
        10⤵
        
        PID:16844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
        9⤵
        
        PID:12988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35794.exe
        9⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-933.exe
        8⤵
        
        PID:8136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-814.exe
        9⤵
        
        PID:14024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59478.exe
        9⤵
        
        PID:16816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35769.exe
        8⤵
        
        PID:10836
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10836 -s 212
        9⤵
        Program crash
        
        PID:11696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50326.exe
        8⤵
        
        PID:12936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18023.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57926.exe
        8⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33640.exe
        7⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37929.exe
        8⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
        8⤵
        
        PID:12964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15374.exe
        8⤵
        
        PID:17376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53861.exe
        7⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53164.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16607.exe
        7⤵
        
        PID:15616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50746.exe
        7⤵
        
        PID:9300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13745.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22859.exe
        7⤵
        
        PID:4932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61151.exe
        8⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12007.exe
        9⤵
        
        PID:7660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26806.exe
        9⤵
        
        PID:10460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29237.exe
        9⤵
        
        PID:12612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32260.exe
        9⤵
        
        PID:12764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25629.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49365.exe
        8⤵
        
        PID:12280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33321.exe
        8⤵
        
        PID:15772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43509.exe
        8⤵
        
        PID:14008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56828.exe
        7⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        8⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16579.exe
        8⤵
        
        PID:10976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35651.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65317.exe
        8⤵
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65021.exe
        7⤵
        
        PID:8788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41608.exe
        7⤵
        
        PID:10352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-216.exe
        7⤵
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2722.exe
        6⤵
        
        PID:2124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62433.exe
        7⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19739.exe
        7⤵
        
        PID:10292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63319.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23272.exe
        7⤵
        
        PID:6980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59044.exe
        6⤵
        
        PID:7324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41297.exe
        7⤵
        
        PID:12168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9636.exe
        7⤵
        
        PID:12588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28280.exe
        7⤵
        
        PID:15020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40789.exe
        6⤵
        
        PID:9564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43983.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39558.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34410.exe
        6⤵
        
        PID:10300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52666.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2308.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38235.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37825.exe
        8⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19455.exe
        9⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43957.exe
        10⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52604.exe
        9⤵
        
        PID:10196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-112.exe
        9⤵
        
        PID:15152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53806.exe
        9⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56164.exe
        8⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48789.exe
        8⤵
        
        PID:10928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49160.exe
        8⤵
        
        PID:15736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7557.exe
        8⤵
        
        PID:12916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34792.exe
        7⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4078.exe
        8⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5349.exe
        8⤵
        
        PID:9348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        8⤵
        
        PID:14044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21325.exe
        8⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20341.exe
        7⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15070.exe
        7⤵
        
        PID:11108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        7⤵
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52977.exe
        7⤵
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61348.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21489.exe
        7⤵
        
        PID:5232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31707.exe
        8⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55173.exe
        9⤵
        
        PID:9420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16143.exe
        9⤵
        
        PID:14520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55424.exe
        9⤵
        
        PID:17200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30045.exe
        8⤵
        
        PID:10548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39391.exe
        8⤵
        
        PID:14364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21325.exe
        8⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17269.exe
        7⤵
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6605.exe
        7⤵
        
        PID:11612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59466.exe
        7⤵
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27593.exe
        7⤵
        
        PID:16804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40658.exe
        6⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20415.exe
        7⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54675.exe
        8⤵
        
        PID:14568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60848.exe
        8⤵
        
        PID:16664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10522.exe
        7⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40265.exe
        6⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64597.exe
        7⤵
        
        PID:14836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18061.exe
        7⤵
        
        PID:15584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11747.exe
        6⤵
        
        PID:12088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6711.exe
        6⤵
        
        PID:15668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29926.exe
        6⤵
        
        PID:11196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45763.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55915.exe
        6⤵
        
        PID:3276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29761.exe
        7⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15012.exe
        8⤵
        
        PID:14672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32835.exe
        8⤵
        
        PID:16876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30045.exe
        7⤵
        
        PID:10500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32592.exe
        7⤵
        
        PID:14608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55944.exe
        7⤵
        
        PID:16632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51696.exe
        6⤵
        
        PID:7396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40237.exe
        6⤵
        
        PID:10436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3647.exe
        6⤵
        
        PID:14484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25981.exe
        6⤵
        
        PID:17284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28100.exe
        5⤵
        
        PID:3248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51141.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61312.exe
        6⤵
        
        PID:10376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63319.exe
        6⤵
        
        PID:14632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34647.exe
        6⤵
        
        PID:17308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20029.exe
        5⤵
        
        PID:7452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1978.exe
        5⤵
        
        PID:10356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43893.exe
        5⤵
        
        PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25961.exe
        5⤵
        
        PID:7768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6013.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49973.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13190.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3808.exe
        7⤵
        
        PID:1896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27903.exe
        8⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        9⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26885.exe
        9⤵
        
        PID:10856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33321.exe
        9⤵
        
        PID:12660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58903.exe
        9⤵
        
        PID:13268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61016.exe
        8⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54217.exe
        8⤵
        
        PID:12268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29302.exe
        8⤵
        
        PID:16660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6283.exe
        7⤵
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        8⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16579.exe
        8⤵
        
        PID:10984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33321.exe
        8⤵
        
        PID:12628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36344.exe
        8⤵
        
        PID:12712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15244.exe
        7⤵
        
        PID:8540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27218.exe
        7⤵
        
        PID:11988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23669.exe
        7⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
        7⤵
        
        PID:14040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4747.exe
        6⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24203.exe
        7⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33051.exe
        8⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13263.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13065.exe
        8⤵
        
        PID:15752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32950.exe
        8⤵
        
        PID:11232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1509.exe
        7⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21352.exe
        7⤵
        
        PID:12400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26881.exe
        7⤵
        
        PID:14180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58519.exe
        7⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53651.exe
        6⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60440.exe
        7⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49365.exe
        7⤵
        
        PID:10424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        7⤵
        
        PID:12644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36344.exe
        7⤵
        
        PID:13300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4005.exe
        6⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9040.exe
        6⤵
        
        PID:11048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31792.exe
        6⤵
        
        PID:2360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30081.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63891.exe
        6⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63289.exe
        7⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12007.exe
        8⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22722.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2594.exe
        8⤵
        
        PID:15676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59095.exe
        8⤵
        
        PID:11216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25629.exe
        7⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45739.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53064.exe
        8⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26806.exe
        7⤵
        
        PID:10484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        7⤵
        
        PID:12680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9318.exe
        7⤵
        
        PID:9804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43808.exe
        6⤵
        
        PID:5252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30721.exe
        7⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33487.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65251.exe
        8⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33306.exe
        8⤵
        
        PID:9016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44244.exe
        7⤵
        
        PID:10276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4004.exe
        7⤵
        
        PID:13408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61289.exe
        7⤵
        
        PID:17180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43065.exe
        6⤵
        
        PID:7672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28780.exe
        6⤵
        
        PID:11552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59466.exe
        6⤵
        
        PID:14664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9887.exe
        6⤵
        
        PID:8352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4860.exe
        5⤵
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33845.exe
        6⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3403.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        6⤵
        
        PID:15460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1726.exe
        6⤵
        
        PID:7616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9267.exe
        5⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23949.exe
        6⤵
        
        PID:13868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2794.exe
        6⤵
        
        PID:17156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18422.exe
        5⤵
        
        PID:10060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43983.exe
        5⤵
        
        PID:14844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39205.exe
        5⤵
        
        PID:10080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13116.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9106.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55147.exe
        6⤵
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27903.exe
        7⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12007.exe
        8⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26806.exe
        8⤵
        
        PID:10784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27675.exe
        8⤵
        
        PID:16104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5618.exe
        8⤵
        
        PID:12836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25629.exe
        7⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26806.exe
        7⤵
        
        PID:10444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6678.exe
        7⤵
        
        PID:14192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37889.exe
        7⤵
        
        PID:15048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-445.exe
        6⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        7⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7882.exe
        8⤵
        
        PID:14884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59949.exe
        8⤵
        
        PID:9664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63642.exe
        7⤵
        
        PID:11060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1224.exe
        7⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3864.exe
        7⤵
        
        PID:10152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15244.exe
        6⤵
        
        PID:8576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31302.exe
        6⤵
        
        PID:12548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54461.exe
        6⤵
        
        PID:16972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44026.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34701.exe
        6⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11068.exe
        7⤵
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7617.exe
        7⤵
        
        PID:11876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21015.exe
        7⤵
        
        PID:328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18367.exe
        7⤵
        
        PID:12876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1509.exe
        6⤵
        
        PID:8564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6962.exe
        6⤵
        
        PID:12468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55944.exe
        6⤵
        
        PID:16600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6204.exe
        5⤵
        
        PID:4364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28583.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3211.exe
        6⤵
        
        PID:10336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45573.exe
        6⤵
        
        PID:15636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59095.exe
        6⤵
        
        PID:10508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45230.exe
        5⤵
        
        PID:7320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-270.exe
        5⤵
        
        PID:11668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34352.exe
        5⤵
        
        PID:3412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36875.exe
        5⤵
        
        PID:12744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49682.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49682.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43279.exe
        5⤵
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46953.exe
        6⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51141.exe
        7⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59193.exe
        8⤵
        
        PID:11700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61809.exe
        7⤵
        
        PID:12068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2594.exe
        7⤵
        
        PID:14264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25629.exe
        6⤵
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26806.exe
        6⤵
        
        PID:10328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        6⤵
        
        PID:15548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12032.exe
        6⤵
        
        PID:10156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7356.exe
        5⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40041.exe
        6⤵
        
        PID:8316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46704.exe
        6⤵
        
        PID:11600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1070.exe
        6⤵
        
        PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2033.exe
        5⤵
        
        PID:8848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26087.exe
        6⤵
        
        PID:14992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23590.exe
        6⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39145.exe
        6⤵
        
        PID:12864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18936.exe
        5⤵
        
        PID:12508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63800.exe
        5⤵
        
        PID:8496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2060.exe
      4⤵
      PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9210.exe
        5⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        6⤵
        
        PID:7880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56844.exe
        6⤵
        
        PID:10820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        6⤵
        
        PID:12592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36344.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51286.exe
        5⤵
        
        PID:8780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21352.exe
        5⤵
        
        PID:12384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19187.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37989.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25843.exe
        5⤵
        
        PID:8284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63855.exe
        6⤵
        
        PID:11512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42090.exe
        6⤵
        
        PID:15544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29212.exe
        6⤵
        
        PID:3156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45142.exe
        5⤵
        
        PID:12568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1070.exe
        5⤵
        
        PID:6796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22870.exe
      4⤵
      PID:9352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37406.exe
      4⤵
      PID:13036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28675.exe
      4⤵
      PID:11128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37149.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37149.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13626.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29553.exe
        5⤵
        Executes dropped EXE
        
        PID:3588
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3588 -s 212
        6⤵
        Program crash
        
        PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56532.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10990.exe
        6⤵
        
        PID:2384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53943.exe
        7⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34587.exe
        8⤵
        
        PID:8844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19865.exe
        9⤵
        
        PID:14324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6128.exe
        9⤵
        
        PID:15836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18724.exe
        9⤵
        
        PID:11292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        8⤵
        
        PID:13440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61289.exe
        8⤵
        
        PID:17232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56330.exe
        7⤵
        
        PID:9424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32426.exe
        7⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21133.exe
        7⤵
        
        PID:7620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35229.exe
        6⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64929.exe
        7⤵
        
        PID:8924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11701.exe
        7⤵
        
        PID:13052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25574.exe
        7⤵
        
        PID:16620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10174.exe
        6⤵
        
        PID:9268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27602.exe
        6⤵
        
        PID:11640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51555.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64559.exe
        5⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62879.exe
        6⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3476.exe
        7⤵
        
        PID:8944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11701.exe
        7⤵
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28781.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15489.exe
        6⤵
        
        PID:9368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61207.exe
        6⤵
        
        PID:12308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8881.exe
        6⤵
        
        PID:7380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54830.exe
        5⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18033.exe
        6⤵
        
        PID:8720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5453.exe
        6⤵
        
        PID:14164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52025.exe
        6⤵
        
        PID:7832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29138.exe
        5⤵
        
        PID:9948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42447.exe
        5⤵
        
        PID:13496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        5⤵
        
        PID:15956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31296.exe
        5⤵
        
        PID:16428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26023.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17275.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3808.exe
        6⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46953.exe
        7⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57747.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9558.exe
        9⤵
        
        PID:14704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16499.exe
        9⤵
        
        PID:16828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52760.exe
        8⤵
        
        PID:10732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2594.exe
        8⤵
        
        PID:15596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65317.exe
        8⤵
        
        PID:17368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1509.exe
        7⤵
        
        PID:8584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29520.exe
        7⤵
        
        PID:12420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57415.exe
        7⤵
        
        PID:14904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23122.exe
        7⤵
        
        PID:13120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7356.exe
        6⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46263.exe
        7⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        7⤵
        
        PID:13540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62742.exe
        7⤵
        
        PID:7224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10393.exe
        6⤵
        
        PID:9432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29626.exe
        6⤵
        
        PID:4036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9446.exe
        6⤵
        
        PID:17296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4747.exe
        5⤵
        
        PID:3940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28287.exe
        6⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23923.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33295.exe
        8⤵
        
        PID:13328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54818.exe
        8⤵
        
        PID:16572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
        7⤵
        
        PID:12980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13729.exe
        7⤵
        
        PID:17120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49942.exe
        6⤵
        
        PID:7464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18857.exe
        6⤵
        
        PID:11592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59466.exe
        6⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55941.exe
        6⤵
        
        PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51513.exe
        5⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        6⤵
        
        PID:7896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-243.exe
        6⤵
        
        PID:10872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        6⤵
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38675.exe
        6⤵
        
        PID:9156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5349.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18552.exe
        5⤵
        
        PID:12496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17990.exe
        5⤵
        
        PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36875.exe
        5⤵
        
        PID:12696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37595.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-492.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13678.exe
        6⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64737.exe
        7⤵
        
        PID:8632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45142.exe
        7⤵
        
        PID:12688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51742.exe
        7⤵
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1647.exe
        7⤵
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11213.exe
        6⤵
        
        PID:9524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13952.exe
        6⤵
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19187.exe
        6⤵
        
        PID:436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17331.exe
        5⤵
        
        PID:6844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58707.exe
        6⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36393.exe
        7⤵
        
        PID:14952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32835.exe
        7⤵
        
        PID:8084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2163.exe
        6⤵
        
        PID:12452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51742.exe
        6⤵
        
        PID:4504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63100.exe
        6⤵
        
        PID:9688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23002.exe
        5⤵
        
        PID:9400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38292.exe
        5⤵
        
        PID:12808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39111.exe
        5⤵
        
        PID:7568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31530.exe
      4⤵
      PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29761.exe
        5⤵
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56242.exe
        6⤵
        
        PID:12032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27455.exe
        6⤵
        
        PID:2740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20697.exe
        6⤵
        
        PID:16808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
        5⤵
        
        PID:12928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52624.exe
        5⤵
        
        PID:17168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22174.exe
      4⤵
      PID:7920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47159.exe
      4⤵
      PID:10764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38465.exe
      4⤵
      PID:15564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43065.exe
      4⤵
      PID:10300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19748.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19748.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33205.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32397.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38017.exe
        6⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52573.exe
        7⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35957.exe
        8⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58956.exe
        8⤵
        
        PID:11920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28991.exe
        8⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41985.exe
        8⤵
        
        PID:15308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47970.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        7⤵
        
        PID:12416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45830.exe
        7⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17331.exe
        6⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56569.exe
        7⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1390.exe
        8⤵
        
        PID:14380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12223.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8193.exe
        7⤵
        
        PID:12996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36649.exe
        7⤵
        
        PID:8204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12696.exe
        6⤵
        
        PID:9484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46460.exe
        6⤵
        
        PID:10888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18498.exe
        6⤵
        
        PID:16732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23989.exe
        5⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62879.exe
        6⤵
        
        PID:3896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52485.exe
        7⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10828.exe
        7⤵
        
        PID:10268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6935.exe
        7⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64498.exe
        6⤵
        
        PID:9492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40595.exe
        6⤵
        
        PID:12476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49247.exe
        6⤵
        
        PID:15952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44705.exe
        6⤵
        
        PID:10252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48965.exe
        5⤵
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7944.exe
        6⤵
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        6⤵
        
        PID:13528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52436.exe
        6⤵
        
        PID:7432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35474.exe
        5⤵
        
        PID:9716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15812.exe
        5⤵
        
        PID:13712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20629.exe
        5⤵
        
        PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61077.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62521.exe
        5⤵
        
        PID:4972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60487.exe
        6⤵
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17793.exe
        6⤵
        
        PID:10216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-112.exe
        6⤵
        
        PID:15144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19187.exe
        6⤵
        
        PID:16512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16693.exe
        5⤵
        
        PID:7800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56381.exe
        5⤵
        
        PID:10676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-535.exe
        5⤵
        
        PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31677.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39506.exe
      4⤵
      PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        5⤵
        
        PID:8044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17076.exe
        5⤵
        
        PID:11624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64047.exe
        5⤵
        
        PID:14244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
        5⤵
        
        PID:12752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53669.exe
      4⤵
      PID:4168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
      4⤵
      PID:12144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
      4⤵
      PID:15964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13398.exe
      4⤵
      PID:9988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29096.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29096.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4830.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6714.exe
        5⤵
        
        PID:3588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48105.exe
        6⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48977.exe
        7⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        7⤵
        
        PID:13476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14846.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
        7⤵
        
        PID:10724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
        6⤵
        
        PID:8872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        6⤵
        
        PID:12716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39107.exe
        6⤵
        
        PID:5584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46189.exe
        5⤵
        
        PID:5432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64036.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62849.exe
        5⤵
        
        PID:15132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12845.exe
        5⤵
        
        PID:7992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11929.exe
      4⤵
      PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        5⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6050.exe
        6⤵
        
        PID:14508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49172.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56844.exe
        5⤵
        
        PID:10812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2594.exe
        5⤵
        
        PID:15700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38675.exe
        5⤵
        
        PID:10176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24974.exe
      4⤵
      PID:7932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6823.exe
      4⤵
      PID:10776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27170.exe
      4⤵
      PID:2936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48743.exe
      4⤵
      PID:16824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52666.exe
      4⤵
      PID:9364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51131.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49885.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62879.exe
        5⤵
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48785.exe
        6⤵
        
        PID:9032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16548.exe
        6⤵
        
        PID:5684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22146.exe
        6⤵
        
        PID:11268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58276.exe
        5⤵
        
        PID:9552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52847.exe
        5⤵
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57607.exe
        5⤵
        
        PID:8412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19624.exe
        5⤵
        
        PID:7172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8587.exe
      4⤵
      PID:6712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43139.exe
        5⤵
        
        PID:9088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8001.exe
        5⤵
        
        PID:11720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52025.exe
        5⤵
        
        PID:16720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7434.exe
      4⤵
      PID:9844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63756.exe
      4⤵
      PID:14328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30441.exe
      4⤵
      PID:5044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
      4⤵
      PID:12044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6329.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6329.exe
    3⤵
    PID:1780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19455.exe
      4⤵
      PID:6412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44130.exe
      4⤵
      PID:12844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36972.exe
      4⤵
      PID:7780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22704.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22704.exe
    3⤵
    PID:7952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46778.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46778.exe
    3⤵
    PID:10800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53666.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53666.exe
    3⤵
    PID:15768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63878.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63878.exe
    3⤵
    PID:7600
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54508.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54508.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61099.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61099.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25879.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51919.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47809.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49885.exe
        7⤵
        
        PID:1476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60357.exe
        8⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
        9⤵
        
        PID:8728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7617.exe
        9⤵
        
        PID:12368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1070.exe
        9⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29303.exe
        8⤵
        
        PID:8920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        8⤵
        
        PID:12436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37662.exe
        8⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43589.exe
        7⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35821.exe
        8⤵
        
        PID:11780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54098.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24782.exe
        8⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5488.exe
        7⤵
        
        PID:9824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9895.exe
        7⤵
        
        PID:14012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17813.exe
        7⤵
        
        PID:17240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11929.exe
        6⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60487.exe
        7⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62511.exe
        8⤵
        
        PID:10652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39708.exe
        8⤵
        
        PID:14208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32758.exe
        8⤵
        
        PID:11564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16692.exe
        7⤵
        
        PID:11952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61909.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28176.exe
        7⤵
        
        PID:12748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24974.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32117.exe
        7⤵
        
        PID:14352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43141.exe
        7⤵
        
        PID:16856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12330.exe
        6⤵
        
        PID:11928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58281.exe
        6⤵
        
        PID:9840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28323.exe
        6⤵
        
        PID:16592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42795.exe
        5⤵
        
        PID:380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46953.exe
        6⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13616.exe
        7⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14358.exe
        8⤵
        
        PID:9164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8001.exe
        8⤵
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25958.exe
        8⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48930.exe
        7⤵
        
        PID:9976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        7⤵
        
        PID:13428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27164.exe
        7⤵
        
        PID:16764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41773.exe
        6⤵
        
        PID:7248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11840.exe
        6⤵
        
        PID:11044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19009.exe
        6⤵
        
        PID:16228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27161.exe
        6⤵
        
        PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22376.exe
        5⤵
        
        PID:432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60487.exe
        6⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
        6⤵
        
        PID:12956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2546.exe
        6⤵
        
        PID:8384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52709.exe
        5⤵
        
        PID:7260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18495.exe
        6⤵
        
        PID:15292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54151.exe
        6⤵
        
        PID:3328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47505.exe
        6⤵
        
        PID:16924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10979.exe
        5⤵
        
        PID:10968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29311.exe
        5⤵
        
        PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44435.exe
        5⤵
        
        PID:10748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13579.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-471.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21057.exe
        6⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23923.exe
        7⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49911.exe
        8⤵
        
        PID:10400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10689.exe
        8⤵
        
        PID:14452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15268.exe
        8⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3403.exe
        7⤵
        
        PID:10448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63319.exe
        7⤵
        
        PID:14620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3235.exe
        7⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
        6⤵
        
        PID:7496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17705.exe
        6⤵
        
        PID:11068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50113.exe
        6⤵
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63133.exe
        6⤵
        
        PID:10476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45893.exe
        5⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        6⤵
        
        PID:8016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35053.exe
        6⤵
        
        PID:10900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41489.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65317.exe
        6⤵
        
        PID:7232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57945.exe
        5⤵
        
        PID:8216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35457.exe
        5⤵
        
        PID:12536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12523.exe
        5⤵
        
        PID:15608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63191.exe
        5⤵
        
        PID:7232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48660.exe
      4⤵
      PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62713.exe
        5⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        6⤵
        
        PID:7864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52760.exe
        6⤵
        
        PID:10740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        6⤵
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38675.exe
        6⤵
        
        PID:17264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61016.exe
        5⤵
        
        PID:8412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54217.exe
        5⤵
        
        PID:12276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9776.exe
        5⤵
        
        PID:5552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15272.exe
      4⤵
      PID:6100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51141.exe
        5⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60326.exe
        6⤵
        
        PID:11824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62266.exe
        6⤵
        
        PID:15612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24782.exe
        6⤵
        
        PID:16684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56496.exe
        5⤵
        
        PID:10612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2594.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59095.exe
        5⤵
        
        PID:10648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1939.exe
      4⤵
      PID:7732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20644.exe
      4⤵
      PID:11528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58885.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5925.exe
      4⤵
      PID:12760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24984.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24984.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52687.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50295.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-492.exe
        6⤵
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37929.exe
        7⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20776.exe
        7⤵
        
        PID:11856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30467.exe
        7⤵
        
        PID:15464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60458.exe
        7⤵
        
        PID:9984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20777.exe
        6⤵
        
        PID:7808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56381.exe
        6⤵
        
        PID:10668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65496.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13971.exe
        6⤵
        
        PID:10172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11929.exe
        5⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45173.exe
        6⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19237.exe
        7⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7617.exe
        7⤵
        
        PID:12392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55826.exe
        7⤵
        
        PID:14084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18367.exe
        7⤵
        
        PID:3716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46216.exe
        6⤵
        
        PID:9332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53039.exe
        6⤵
        
        PID:12892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47340.exe
        6⤵
        
        PID:10184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57901.exe
        5⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17675.exe
        6⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
        7⤵
        
        PID:15204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37604.exe
        7⤵
        
        PID:17108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        6⤵
        
        PID:13616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2594.exe
        6⤵
        
        PID:14088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30506.exe
        6⤵
        
        PID:11120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47017.exe
        6⤵
        
        PID:10396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18561.exe
        5⤵
        
        PID:9468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37794.exe
        5⤵
        
        PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13906.exe
        5⤵
        
        PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16454.exe
        5⤵
        
        PID:8376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34513.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4529.exe
        5⤵
        
        PID:6000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40259.exe
        6⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54675.exe
        7⤵
        
        PID:14020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65124.exe
        7⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42297.exe
        6⤵
        
        PID:10284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63319.exe
        6⤵
        
        PID:14584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22395.exe
        6⤵
        
        PID:17144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63677.exe
        5⤵
        
        PID:7476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64597.exe
        6⤵
        
        PID:14920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37814.exe
        6⤵
        
        PID:10004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25922.exe
        6⤵
        
        PID:14816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14276.exe
        5⤵
        
        PID:11660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42930.exe
        5⤵
        
        PID:15500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12562.exe
        5⤵
        
        PID:9024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37341.exe
      4⤵
      PID:4148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39527.exe
        5⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13782.exe
        6⤵
        
        PID:8836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7617.exe
        6⤵
        
        PID:12484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47256.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53808.exe
        5⤵
        
        PID:9232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        5⤵
        
        PID:12292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13541.exe
        5⤵
        
        PID:7356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56906.exe
      4⤵
      PID:7500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49689.exe
      4⤵
      PID:10488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17341.exe
      4⤵
      PID:15032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11244.exe
      4⤵
      PID:16964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56506.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23653.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-492.exe
        5⤵
        
        PID:116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60487.exe
        6⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44369.exe
        7⤵
        
        PID:14500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44704.exe
        7⤵
        
        PID:16388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21571.exe
        6⤵
        
        PID:12940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58161.exe
        6⤵
        
        PID:16748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20777.exe
        5⤵
        
        PID:7816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26087.exe
        6⤵
        
        PID:15000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57340.exe
        6⤵
        
        PID:16812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56381.exe
        5⤵
        
        PID:10660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6181.exe
        5⤵
        
        PID:3400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
        5⤵
        
        PID:12464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11929.exe
      4⤵
      PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29761.exe
        5⤵
        
        PID:6336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8524.exe
        5⤵
        
        PID:11904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2594.exe
        5⤵
        
        PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52297.exe
        5⤵
        
        PID:9452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47593.exe
        5⤵
        
        PID:5072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24974.exe
      4⤵
      PID:7964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34499.exe
        5⤵
        
        PID:11432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48531.exe
        5⤵
        
        PID:15988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16202.exe
        5⤵
        
        PID:16588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51225.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60995.exe
      4⤵
      PID:5604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7892.exe
      4⤵
      PID:6972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49533.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49533.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-492.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-492.exe
      4⤵
      PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6086.exe
        5⤵
        
        PID:6608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22527.exe
        6⤵
        
        PID:8712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8001.exe
        6⤵
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53688.exe
        6⤵
        
        PID:14136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37896.exe
        6⤵
        
        PID:2604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3813.exe
        5⤵
        
        PID:10012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60413.exe
        5⤵
        
        PID:13724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7319.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7757.exe
      4⤵
      PID:6564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-802.exe
      4⤵
      PID:10464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42542.exe
      4⤵
      PID:14888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24118.exe
      4⤵
      PID:4496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24546.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24546.exe
    3⤵
    PID:4648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12007.exe
      4⤵
      PID:7668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37107.exe
        5⤵
        
        PID:13568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26806.exe
      4⤵
      PID:10624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55879.exe
      4⤵
      PID:9324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65317.exe
      4⤵
      PID:11124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19264.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19264.exe
    3⤵
    PID:7688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64405.exe
      4⤵
      PID:13792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25972.exe
      4⤵
      PID:14120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14832.exe
      4⤵
      PID:8980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32673.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32673.exe
    3⤵
    PID:12080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31684.exe
    3⤵
    PID:684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60442.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60442.exe
    3⤵
    PID:15396
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59821.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59821.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25879.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25879.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47835.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17275.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63891.exe
        6⤵
        
        PID:4600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46953.exe
        7⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51141.exe
        8⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64213.exe
        9⤵
        
        PID:13880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61424.exe
        9⤵
        
        PID:16852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56496.exe
        8⤵
        
        PID:10308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2594.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13786.exe
        8⤵
        
        PID:13636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25629.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26806.exe
        7⤵
        
        PID:10428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2594.exe
        7⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21570.exe
        7⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58006.exe
        6⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30721.exe
        7⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11920.exe
        7⤵
        
        PID:13400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4036.exe
        7⤵
        
        PID:15580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63709.exe
        7⤵
        
        PID:10848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31196.exe
        6⤵
        
        PID:7528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28588.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51298.exe
        6⤵
        
        PID:14760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48781.exe
        6⤵
        
        PID:9012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56662.exe
        5⤵
        
        PID:640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60118.exe
        6⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3284.exe
        7⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        7⤵
        
        PID:13544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58082.exe
        7⤵
        
        PID:16612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41285.exe
        6⤵
        
        PID:9584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58712.exe
        6⤵
        
        PID:12064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51363.exe
        6⤵
        
        PID:7484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57325.exe
        5⤵
        
        PID:6544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10928.exe
        6⤵
        
        PID:14696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34781.exe
        6⤵
        
        PID:8340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3185.exe
        5⤵
        
        PID:9808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62683.exe
        5⤵
        
        PID:13996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2155.exe
        5⤵
        
        PID:7352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50502.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4529.exe
        5⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40259.exe
        6⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21718.exe
        7⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52244.exe
        7⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4440.exe
        6⤵
        
        PID:11944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        6⤵
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65317.exe
        6⤵
        
        PID:8472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43257.exe
        5⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16601.exe
        6⤵
        
        PID:12216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39376.exe
        6⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8034.exe
        6⤵
        
        PID:11240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14276.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42930.exe
        5⤵
        
        PID:14256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25664.exe
      4⤵
      PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27275.exe
        5⤵
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50347.exe
        6⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29595.exe
        7⤵
        
        PID:13852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
        6⤵
        
        PID:13488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        6⤵
        
        PID:12620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27549.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52847.exe
        5⤵
        
        PID:11696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8881.exe
        5⤵
        
        PID:7552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19957.exe
      4⤵
      PID:7696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49497.exe
      4⤵
      PID:10632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50842.exe
      4⤵
      PID:5412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49770.exe
      4⤵
      PID:2156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45769.exe
      4⤵
      PID:9724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27969.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31473.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53393.exe
        5⤵
        
        PID:2460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17981.exe
        6⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5614.exe
        7⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44369.exe
        8⤵
        
        PID:14472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58645.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15102.exe
        8⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7617.exe
        7⤵
        
        PID:12516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33075.exe
        7⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26536.exe
        7⤵
        
        PID:12156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30673.exe
        6⤵
        
        PID:9092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21352.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60412.exe
        6⤵
        
        PID:8456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1981.exe
        5⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11452.exe
        6⤵
        
        PID:8752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58764.exe
        6⤵
        
        PID:12328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25099.exe
        6⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1647.exe
        6⤵
        
        PID:10712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59951.exe
        5⤵
        
        PID:9540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24478.exe
        5⤵
        
        PID:13700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25981.exe
        5⤵
        
        PID:17268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36049.exe
      4⤵
      PID:1492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37929.exe
        5⤵
        
        PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48214.exe
        5⤵
        
        PID:12920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62437.exe
        5⤵
        
        PID:17292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53179.exe
      4⤵
      PID:7312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14654.exe
        5⤵
        
        PID:11832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40362.exe
        5⤵
        
        PID:12636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46562.exe
        5⤵
        
        PID:9660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18727.exe
      4⤵
      PID:9328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60519.exe
      4⤵
      PID:14800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24521.exe
      4⤵
      PID:16700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53931.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53931.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23243.exe
      4⤵
      PID:404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53943.exe
        5⤵
        
        PID:4048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6024.exe
        6⤵
        
        PID:7404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7041.exe
        7⤵
        
        PID:11840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27455.exe
        7⤵
        
        PID:12528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6115.exe
        7⤵
        
        PID:13296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61312.exe
        6⤵
        
        PID:10384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24424.exe
        6⤵
        
        PID:14516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51193.exe
        6⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3864.exe
        6⤵
        
        PID:8504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15707.exe
        5⤵
        
        PID:7748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31082.exe
        5⤵
        
        PID:12096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2594.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12032.exe
        5⤵
        
        PID:16708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31145.exe
      4⤵
      PID:6636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59340.exe
        5⤵
        
        PID:12828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17406.exe
        5⤵
        
        PID:7180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38956.exe
      4⤵
      PID:9964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9180.exe
      4⤵
      PID:14856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47271.exe
      4⤵
      PID:15504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21223.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21223.exe
    3⤵
    PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37929.exe
      4⤵
      PID:6352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11016.exe
        5⤵
        
        PID:8868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51914.exe
        5⤵
        
        PID:15120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26067.exe
        5⤵
        
        PID:17084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59671.exe
      4⤵
      PID:12132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63179.exe
      4⤵
      PID:11212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28204.exe
    3⤵
    PID:6928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-264.exe
      4⤵
      PID:11848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9636.exe
      4⤵
      PID:12664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46562.exe
      4⤵
      PID:2612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29453.exe
    3⤵
    PID:10912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57515.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57515.exe
    3⤵
    PID:4068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4171.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4171.exe
    3⤵
    PID:7656
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25614.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25614.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47835.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31473.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10990.exe
        5⤵
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32153.exe
        6⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5614.exe
        7⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7617.exe
        7⤵
        
        PID:12408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3016.exe
        7⤵
        
        PID:7536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61976.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21736.exe
        6⤵
        
        PID:13308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57607.exe
        6⤵
        
        PID:15696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5234.exe
        6⤵
        
        PID:10536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39313.exe
        5⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45739.exe
        6⤵
        
        PID:14340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36535.exe
        6⤵
        
        PID:17384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31938.exe
        5⤵
        
        PID:9956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2111.exe
        5⤵
        
        PID:13416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26858.exe
        5⤵
        
        PID:16568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20097.exe
      4⤵
      PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12007.exe
        5⤵
        
        PID:7744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49365.exe
        5⤵
        
        PID:12260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29237.exe
        5⤵
        
        PID:9800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28176.exe
        5⤵
        
        PID:10076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24974.exe
      4⤵
      PID:7984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51225.exe
      4⤵
      PID:12108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2474.exe
      4⤵
      PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22100.exe
      4⤵
      PID:7228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40195.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40195.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4529.exe
      4⤵
      PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52677.exe
        5⤵
        
        PID:9044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58764.exe
        5⤵
        
        PID:12444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2157.exe
        5⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32743.exe
        5⤵
        
        PID:13564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15244.exe
      4⤵
      PID:8592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12827.exe
      4⤵
      PID:12320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17813.exe
      4⤵
      PID:17212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36766.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36766.exe
    3⤵
    PID:652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60487.exe
      4⤵
      PID:6160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47419.exe
      4⤵
      PID:12008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45573.exe
      4⤵
      PID:14204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20008.exe
      4⤵
      PID:10264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37325.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37325.exe
    3⤵
    PID:9188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64213.exe
      4⤵
      PID:13360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30056.exe
      4⤵
      PID:14104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4526.exe
      4⤵
      PID:10416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4692.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4692.exe
    3⤵
    PID:12312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58265.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58265.exe
    3⤵
    PID:17136
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42989.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42989.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-471.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-471.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39771.exe
      4⤵
      PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38121.exe
        5⤵
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19185.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51914.exe
        6⤵
        
        PID:15160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24697.exe
        6⤵
        
        PID:17276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21301.exe
        5⤵
        
        PID:9880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15872.exe
        5⤵
        
        PID:14968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61289.exe
        5⤵
        
        PID:17188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16693.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56381.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33388.exe
      4⤵
      PID:15500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16487.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22139.exe
      4⤵
      PID:9084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45893.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45893.exe
    3⤵
    PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62433.exe
      4⤵
      PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49172.exe
        5⤵
        
        PID:7776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13403.exe
      4⤵
      PID:12820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11290.exe
      4⤵
      PID:4060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61374.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61374.exe
    3⤵
    PID:7288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27514.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27514.exe
    3⤵
    PID:10960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65424.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65424.exe
    3⤵
    PID:5316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36257.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36257.exe
    3⤵
    PID:15348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34595.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34595.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24613.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24613.exe
    3⤵
    PID:1328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5126.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
        5⤵
        
        PID:8008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44369.exe
        6⤵
        
        PID:14532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12223.exe
        6⤵
        
        PID:8348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35053.exe
        5⤵
        
        PID:10892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59963.exe
        5⤵
        
        PID:12600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39080.exe
        5⤵
        
        PID:14076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51286.exe
      4⤵
      PID:8768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44369.exe
        5⤵
        
        PID:14440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42090.exe
        5⤵
        
        PID:14132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53442.exe
        5⤵
        
        PID:14460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21352.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21352.exe
      4⤵
      PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13860.exe
      4⤵
      PID:5696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12207.exe
      4⤵
      PID:13200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51950.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51950.exe
    3⤵
    PID:6404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32641.exe
      4⤵
      PID:9104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61783.exe
      4⤵
      PID:13448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27740.exe
      4⤵
      PID:8324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54305.exe
    3⤵
    PID:9600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13595.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13595.exe
    3⤵
    PID:13548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47471.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47471.exe
    3⤵
    PID:17344
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47515.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47515.exe
  2⤵
  PID:3504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60357.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60357.exe
    3⤵
    PID:6140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24089.exe
      4⤵
      PID:8912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11701.exe
      4⤵
      PID:13072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33241.exe
      4⤵
      PID:5436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18367.exe
      4⤵
      PID:12816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27357.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27357.exe
    3⤵
    PID:9136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21928.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21928.exe
    3⤵
    PID:12800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49722.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49722.exe
    3⤵
    PID:7852
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33524.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33524.exe
  2⤵
  PID:6552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52485.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52485.exe
    3⤵
    PID:8264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8001.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8001.exe
    3⤵
    PID:1804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22066.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22066.exe
    3⤵
    PID:17352
- C:\Users\Admin\AppData\Local\Temp\Unicorn-49097.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-49097.exe
  2⤵
  PID:9476
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15659.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15659.exe
  2⤵
  PID:13012
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23549.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23549.exe
  2⤵
  PID:4532
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64059.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64059.exe
  2⤵
  PID:13304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3588 -ip 3588
1⤵
PID:3080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 10836 -ip 10836
1⤵
PID:11280

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12827.exe

Filesize
468KB

MD5
19ba8b9748fd00466e4c8f664031a116

SHA1
cd76ea3a10ad8a400f516b12d8b4eacad628def5

SHA256
d5e151f6b1900b483eb722caa60ef3060350531286e8de2858d97ca33fe0c705

SHA512
a1db3c1e18c01621807f2f1d3b27531e34002f99785c2b978e4224f5e1866d2f8199ddfed3293b7246dfa2972eb44037e7caffc830ebd9e950c788d748d5168d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13116.exe

Filesize
468KB

MD5
fe412ceec6fab3101b6e720d2d863912

SHA1
21345d434dd6b33d4e11ac954dbf6c98cc0963d2

SHA256
dc0a8e4332ad8645fcadf418d982e37e18a5a3023af11de6193aa1bf35b98734

SHA512
55d51cccf92ff1c0ac28ab88c690be30b4e37c781fc9600038be960110ac2e771fa034095c6ac34dad031b0f5c38181dc15dd08ec9f32718c78216c2d77da436

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13579.exe

Filesize
468KB

MD5
37b4bcbd486ce110cef0e5df7cb81721

SHA1
d4566f46948cc5a96dec6b5a070fec51471f7c5b

SHA256
846e9a74d62d1d252262217ea3ea50f023e1ca91cb88b257a607f9677b7f337e

SHA512
bec1e8815a890062e2f6da5783fc22ae647737ba5ef788808cf589ed297f4c56553076839ff697c15bef19e378db30c5e929ef0d66c85592a68f79f7571194e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13626.exe

Filesize
468KB

MD5
9a93d18e350ac24d97f2fa9e4c8a1f60

SHA1
8f422dd0f30f46e65b745e4b307ca167c4d933dd

SHA256
2565f4fbe79aff896589151fddebf5024a939f8b3afa6b10ec5d0be379b91d8a

SHA512
9d3725fd7cfe112286061a77af75beb047c6e6cf92f703e28cb099922e02be29253a98b98235807c44668bcb4b9dcaf956cc67e8efb8367b6c96675c817d9843

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15102.exe

Filesize
468KB

MD5
df7757417ba3b983ed6ba0a2f801d06a

SHA1
d9d686c173e52d4d79b97a0dc46f368a42228f3f

SHA256
d8b8d7b0ef9ca5a868ce69976a47d438fb33eb2ae864b4017606763117ad7859

SHA512
c6e2ff9a5beb32bc4ac81dc9bcf985714e4b0c7abeee30203442b76e8fc7fbce81268b234cca3d88dd35399395a887a81a82c22f338c510eb2346009b14379e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19748.exe

Filesize
468KB

MD5
88c79e1ba49d0eacd68fb512ada00964

SHA1
2c13f5613515c93aa2578b8d7f20f3923dfaba73

SHA256
f69581dfbe2b7a3f6f681607bd3ced5e22d7325c93334f2db5e8ee43dce6dd04

SHA512
04e4d19fe5270fba4cf061f9a03cdaa043f9178cfe5065a3f1aceb7e0eac4bae4b95d4ec241b70a73b650a97f42f9ab49b9ded0f0771d86e8384b1096afae25f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2308.exe

Filesize
468KB

MD5
5b74758b843085cf35b10c7eca36661d

SHA1
f4f19407dea6aff7da6f2d069ed15e844ffb94db

SHA256
d04f9034406871d16b0462db9ede6ac5c42584350bfdced95d367384996d90c9

SHA512
f28f8032c67fcec96a44d883f51e244df41faf8f141af2c4cb6109ad5e6cff77fac7c9fca820367d7209207f993969c7a43670d8b8d0397de932742d68e32501

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24984.exe

Filesize
468KB

MD5
75eee90f970e6362f861494977a7c8f2

SHA1
c9f834d244fed57c7a67b887fc3be85481157e5a

SHA256
284de6e6c9addc531917cc0ba99f5fad001c5a6983f1bf5a2df262ee203bfb79

SHA512
2939fc7011424afe0b79bc015a1c86447c07d31e74ceddb4756cf041d53add97b8986b86e1c71a188a4e965ddb22f0cfceeaf42f3f5770f7cb1b44a2e3d3ea77

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25614.exe

Filesize
468KB

MD5
a65369453519d00f6218361f907c5953

SHA1
83cee1a2f38ff082b1c27d356e4a2d7df3115b71

SHA256
20174c575601c4afbf498405cd5515256a8b77bc9600cae7ae0ce51d3c5789ed

SHA512
8e944985f155e7e8f85e42cd43e402071a63374bf9e2e7cec603a1f317bc0c9b8d62bc283d900f5258958c2bbc35bf153c75a50cd3e83885c154489d2d589aa3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25879.exe

Filesize
468KB

MD5
2652dc8f5b2f60680505ba1b35824e39

SHA1
3cf459dfc5c51a1d42ab738bb1a3b5fbca0c07b4

SHA256
060dbaed28852f1e50501e477c449e1e4208f1631ce66e4dd1eba7ddad8ecbcc

SHA512
336273abdee6287f0551d18e45449cf60c800d32126f70924bf2081b846767b3c3c2aefafc9e47227df16058ad70ebacdb7f8c4707d8d8ac8d75341f3893c699

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26023.exe

Filesize
468KB

MD5
0df07ce3a3549e60208e330db314bbd0

SHA1
02538c47c0100d53d898bec89b32d9950fef86e7

SHA256
dc772d06d7a6bd6fb44405d78383adaf75e19bdb065d97a4d65e9bd4adbc6361

SHA512
1095343fa6d73a33a97bf5f882107e60fce66a8e69aa36ab0d0664fadf50d83cefb392a10342d22825da4fd77f738cd219ec04a73102e924762da9bf4637a8f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27969.exe

Filesize
468KB

MD5
574b24df422674b3f10a1681ed720daa

SHA1
5ae81dcc0967c1e280ae5f79530dc8cf7831ca66

SHA256
1700587068cdf0b6685c752c446947f9bdd90513ad4deb574030f64295f8b744

SHA512
95ffca8c9024a57987c725030322b9f77ddd3e9ca201603f063bde98de1aebd429fb2028f59a895f9c679dd29b1c305818ea61634eb084dbb579ebe612b306c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29096.exe

Filesize
468KB

MD5
c91ee4cbec7d129603b4452e09b76ae4

SHA1
0ce232dce1503def475595dc3ed34b177e9a3ef2

SHA256
6f9ed4a85515add630145ff69244993a52d68031431c95aed7a3ae62c4cc2e77

SHA512
3e4790e8f69df40b5f8b561d7b15f2be950c3292318c2d531e93ae6f74f59361efdc291342a6a0227175587a46db7572fb581e2ec88bc445ad251365e067a368

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29553.exe

Filesize
468KB

MD5
d17e69512bc40141cf8c059e38481130

SHA1
3ec363d8da76f612f5eb3ad007b520c0b8c20b8f

SHA256
1ef390b7f5a95b6b59cbf13ff963fc3b0a39ae3e0b698c8109c323d06cfb1feb

SHA512
4d04ef979df8cb9b0f9041dc9c6675a3615be2e49c7c025795a26188967a8641fa4ad6fd283f89505cc415ed3056fb4cf6216888140c8a6728c84f8bf5ba09d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33205.exe

Filesize
468KB

MD5
d3be0376b3dd947b0c99bc896337f453

SHA1
92a887967da0e94c1b7b5632c04cf4c06144cfb6

SHA256
ce4a6eea66f5930cb180a5ad8468477c76803994bda6ef9b831a34bad28688e4

SHA512
c7919e5638d5f6b0bea9fabdad9077fb2c6b6e8385c5fa2147988c93428086da0b0be95a90f4bb5fe12987970a5ba81fc3154008af84017e6d5ff7c3b0277548

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37149.exe

Filesize
468KB

MD5
7a717d138496d46197a66582ac85ac7c

SHA1
b3a54ebe5857d84295d0caa10ab97df415d9dd37

SHA256
fc5c8b390198c1d3bc3952307d7ae2888dc28db41183d6e6f7562f35f687b065

SHA512
4ad84f6a1dacb7d0e5ca21e5ce832fc800a72d633c7358eae7954c46641e0d61ae7d669ff8bf10fb6c6cb6962bd9c7567d6eda5680ecf6555cfdc8ebd4093c26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37311.exe

Filesize
468KB

MD5
9977ffdde59522267740a18c0b909097

SHA1
e5ba34fa154db352931002aa5c9ad917404e0b35

SHA256
d13efddebbf57de5329ca8571e98d733d919ba3ecd4a9307743b4ed18c010f34

SHA512
e64adf707778e8bbeed90ffff32e5e487708a8bebc6451c1dfad9a00b67ffbde374f2d72dd13119f6a2667b25ff60202a9bfd0181da9aaa3bbde128b965d2a76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37721.exe

Filesize
468KB

MD5
f593b9941e0c2ed5d3da27819f49f7e1

SHA1
e0be870d4537048a16f2a364e8c19dfd13ef55fe

SHA256
f018d2c4a38cb25cb6b2e0bbfdad103a6516c2eb2a02e7f795c6759b0ed91f98

SHA512
575eadeb722c9f28a83da47a051b68ec82ce9b57056c43073b47c46df39e4fc01cf3e29f3ede27708bb3fd9be3bb994889bbf50566ef00b3c15d641f83f88bf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42989.exe

Filesize
468KB

MD5
ec5912716272261606dba89651d6317f

SHA1
7d5f32a10b60483a3f3a37d83a27de2fd9904392

SHA256
95e5e8e1bbd9120011c664f77e34d3c6bd8ff322328c7f5b87df3a4ffc4fc6d9

SHA512
abb9a6f420378b89984c781f4bad90b37c893ce34cf29646f54a31712f628d64ca29d35ce657470e50bde7b9e96d11c7a59b41a805669cb6c091d3fe24aec469

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47835.exe

Filesize
468KB

MD5
06121226f2f6851dcf8623919bfa756b

SHA1
7f4d1c9bb37307fdeee341ec32cc85dc0c740ca1

SHA256
877700c126c3092db1f08b7e333d2772786a77284466b6ac56c81e9643d378c0

SHA512
1a6b161c24d286462969a6e55759e69a52e1ac7e850483cf376de32875aa430826e027ac9c68f5630f3c8d9f7125fe7a8d9ad5c43ba5a649cd5bc0619b2e510e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49973.exe

Filesize
468KB

MD5
761635f7fb830ee084dbd7127522382c

SHA1
1c8b708ffc5cef3c1c116d178f9b05a8c33a6f8d

SHA256
b24a412fe4fcdd950e29d2fc6009d0e3266db731161e33ac80e3eaadae0999cb

SHA512
477031519f9c75c04c4f4e252e3e6157851e127d92f087e5a74dbc167e9d2324bb27da91a47b8400d62deaab3d714c3e0e83fcaee982572e9bae6d1f0f5d70a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51919.exe

Filesize
468KB

MD5
ac12d31f826842aa130c71996c4d6dec

SHA1
81e453fe49fd11b5693a58631fe18dd658ab3ab4

SHA256
1bb7d99c98c9405475d0b25ba4fae54ccfd5809e57d5aba2f8e8a4e539224de7

SHA512
e747121b159d6d4279fd4cf5dc2b3144b6a2010ee460fad4aed31435463e249929d90c7c2f02d64355f0ef56134de182e0c0f2023ad96ee9b7358d74bfb1b85c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52666.exe

Filesize
468KB

MD5
c242e0fa92d94aea33c128599a2ee744

SHA1
cd2fc449894f8989eda146badd1b6933a818675f

SHA256
8ee2d46045634e7db56d75ad38a73450094b261aed35557f90e1f6cc506bc9d9

SHA512
b691e05ccf6e16680b275b35ad612f30d0c7e8b2104e075dede14f78624f8fe310db0b04ee1157b43d80151907545aaa2295a3cad6b167b271a3bd98588c9566

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52687.exe

Filesize
468KB

MD5
1b663556734659670ad6f1bade992132

SHA1
583ccc0ded5b36a57fcdd1017e172ec228af17de

SHA256
227062fab2e0e599aca90f7131155d2a61eaa3f204ab9c71fbd79486eda49b29

SHA512
45e12d4fec6f52720d43546445de7f74f70cc3c3810dc8859875c4a1b3061eb61e8f91d8075a42d52c568cb84d301f4763d9940184e5c3f687fb780ca7394f36

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52801.exe

Filesize
468KB

MD5
4ae5b32c73cc7a0daf3e8f9754eb889b

SHA1
811a24f1ec5b9625858fb46e054f0189e7a97373

SHA256
5b092924e2985157c32e09d129d6d99ba0b558212edda2451c9b7cedcc2baadf

SHA512
2c19a9fbd76df4a788a2a0b2a9597641324a2c3a634055eebcaff6cbb4bc5793128530c1fa46f58ba780f9c1ef69a21571f28e025b1873d4afc4c7bd8fcc5277

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52931.exe

Filesize
468KB

MD5
df8170006fc40453210fd9db3a17f146

SHA1
bfd87d94e6540d0b086b7b15912893234431f6e1

SHA256
b6de42010915568378ff520629b4f63de586207f9294a9b54f37e62cfb839e24

SHA512
b237c6e02713098003dd5edff064c19a38ca5bb89e663316306160f06134a0b6ed7d31e875f0da714c622c8e75c0bde6f9842084dae78006c7181260e976333b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54508.exe

Filesize
468KB

MD5
71d5735e5d768db7f5b79920197d951e

SHA1
0ba0d36cde3fe051b1322ca4dd9a7b36e4d0a3ce

SHA256
29b55ab4147cad016ec86f9c06751a67aa0f5d5f7d996ec800e72f0da113fc21

SHA512
592367b85f57dc92cc4fa637a38c374b5b956c4a95916bc34db86d9176097c1de1094c8d4a37d4d5d8e1a93e08b3b26f50cf8d3f6e2a252978881dc4f3a23915

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56506.exe

Filesize
468KB

MD5
247515acfb0b9ae2ebe1b92361322638

SHA1
1d50a6cbde08cc9e3a9b51f29e8519072223825b

SHA256
65009f2605360f3b7aa08562d056271e2d51012df09d8c9831ad65434461827f

SHA512
8023936fea192f9d53ab16b06a18fc4a53d5195b413bcdfe9752002beaf3b206dad8ea1f8ea5c1ec2cd5876732672d84cf804da98536fa5458307c0567a82073

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59821.exe

Filesize
468KB

MD5
30539b9d5c992d9f9867cd2574cd503f

SHA1
3483fbdbba10615ce01d5817055d04823b2bb2c1

SHA256
3899b9e2cb15e4747d6a4e511c5c277525bd84a668444f9087dc0a8cf50bb07c

SHA512
5c8184aa1b39bdd74a6539495e96e4687f5598f7f98429f3b707a83e0f03cfc050e04b3a9e1dc4ef00d03efa978fd496859419132b8db4cc3ee290e570dba5a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6013.exe

Filesize
468KB

MD5
8281defbadb0820f0f11daf651437f85

SHA1
0504ac6173e2a3fdc3331f0d18132ed5e3771217

SHA256
fd3b05d0b7847be0bef124315018511d4bda78183351cfb0ff4f49c823fbd930

SHA512
36cd012dd0beae3a6d3bd05270f4eafd90ad8d47953b25ee47a87f919151a1a5579df9d31b769a2a0366922dc7e4b11a3745fc30c520119faefa3b171e6ebe17

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61099.exe

Filesize
468KB

MD5
92aa13a842717b69499b7ed251180f32

SHA1
4cf1d59883fbf81175a9216305a39eba5964f1f1

SHA256
320144d9c9f9c2f88722caa2c505986473a13cf70bd90f8d2b7aa313a91653d1

SHA512
4c0bd48df4f323ff8a7a3808a2e6d3d352a55b68e61539f7fd48bc25990646108b8299df4bb01954dcdcf98f7d53852d04d7b2de2aff989175a9a33574453019

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8836.exe

Filesize
468KB

MD5
cfa19787026b7edc6adbb8dd5488ea81

SHA1
8ebdcc52c4b38b68ccfe5df8cf1344898b89b51c

SHA256
9c816af54b0e0895651fe244aeb310155c20ae5f54fd85e849ce8573a9630409

SHA512
e3923d4b6fdcf480d460ae74621388ff5bf2e44a853bfbaabf554b3a267139e7833fb4654eac9379606afad295d10389401923cbb44a1d28ccc021f934abff8f

Download Submit
memory/212-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/224-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/368-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/380-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/404-464-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/468-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/556-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/628-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/640-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/812-193-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/816-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1012-123-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1068-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1112-263-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1124-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1212-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1328-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1396-571-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1472-171-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1476-463-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1492-528-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1536-49-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1780-573-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1896-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1960-141-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1984-173-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2100-310-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2104-366-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2124-465-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2160-525-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2336-199-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2364-142-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2384-460-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2388-235-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2452-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2460-424-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2500-469-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2552-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2580-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2644-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2700-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2708-90-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2724-367-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2796-458-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2800-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2824-575-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2876-221-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2996-293-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3080-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3168-544-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3224-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3276-479-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3308-164-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3336-81-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3368-356-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3408-344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3428-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3460-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3504-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3528-89-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3576-290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3588-520-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3588-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3588-189-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3768-59-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3820-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3940-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4120-215-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4148-523-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4160-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4192-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4352-34-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4400-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4416-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4448-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4464-168-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4468-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4600-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4628-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4752-207-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4776-99-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4780-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4864-521-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4908-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4924-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4932-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5012-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5024-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5032-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5048-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5068-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5132-574-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5152-576-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5164-577-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5208-590-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5232-592-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/10172-3379-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads