885b092d99aee3177c44e5312a8fbcac24573ea243e20962981f5125138aa40a

Analysis

max time kernel
120s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30-09-2024 09:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

885b092d99aee3177c44e5312a8fbcac24573ea243e20962981f5125138aa40aN.exe
Size

468KB
MD5

e461bdd7c37da73cee7f41d93ac65b00
SHA1

0fa665ac327d7f764a493328e119a987bfc60682
SHA256

885b092d99aee3177c44e5312a8fbcac24573ea243e20962981f5125138aa40a
SHA512

a81b91f15ce986101e6de3c6d73fb601f14581b13e3591c3769aa742ea4419416d89a5609453dbd371661a34eae050ede4b26ee50f1045d65420325ed1c56fcf
SSDEEP

3072:thoCow1djy8U6bYCfz5jffHEChj+IpBnmHdPVStuHb3+rKNFrlL:thlo+LU6hf1jffy0EAuHD4KNF

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1056	Unicorn-43572.exe
4024	Unicorn-58128.exe
744	Unicorn-50515.exe
528	Unicorn-43868.exe
4444	Unicorn-62242.exe
1488	Unicorn-40338.exe
2016	Unicorn-60204.exe
216	Unicorn-30988.exe
1856	Unicorn-39710.exe
632	Unicorn-63660.exe
620	Unicorn-2762.exe
2844	Unicorn-26712.exe
2052	Unicorn-26712.exe
4068	Unicorn-14194.exe
1440	Unicorn-32833.exe
848	Unicorn-57760.exe
4108	Unicorn-946.exe
916	Unicorn-20812.exe
4668	Unicorn-6321.exe
4364	Unicorn-13603.exe
4624	Unicorn-13603.exe
4984	Unicorn-16925.exe
3236	Unicorn-1906.exe
1596	Unicorn-21772.exe
4396	Unicorn-19725.exe
1988	Unicorn-50360.exe
2172	Unicorn-46831.exe
3300	Unicorn-1159.exe
4288	Unicorn-38662.exe
4272	Unicorn-58263.exe
4860	Unicorn-2503.exe
4020	Unicorn-64511.exe
1264	Unicorn-55596.exe
864	Unicorn-4349.exe
1592	Unicorn-26816.exe
4800	Unicorn-52591.exe
2428	Unicorn-28906.exe
4312	Unicorn-49135.exe
444	Unicorn-60832.exe
3576	Unicorn-35752.exe
3996	Unicorn-15886.exe
4608	Unicorn-894.exe
5008	Unicorn-24844.exe
5088	Unicorn-63638.exe
2860	Unicorn-53240.exe
1212	Unicorn-45072.exe
3976	Unicorn-45072.exe
4484	Unicorn-7858.exe
2456	Unicorn-8123.exe
3208	Unicorn-18329.exe
3216	Unicorn-4594.exe
2296	Unicorn-24460.exe
3736	Unicorn-24460.exe
2132	Unicorn-24460.exe
2364	Unicorn-33182.exe
2656	Unicorn-27582.exe
3876	Unicorn-25014.exe
3036	Unicorn-38750.exe
2856	Unicorn-35949.exe
380	Unicorn-4615.exe
1928	Unicorn-1086.exe
1044	Unicorn-20952.exe
4572	Unicorn-6653.exe
664	Unicorn-9254.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1840	6932	WerFault.exe	273
15180	10712	WerFault.exe	514

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45974.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6842.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29764.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1995.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10622.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7952.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8075.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28803.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52495.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7342.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15295.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50515.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9925.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6154.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39710.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47727.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56491.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56491.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29586.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32156.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45944.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24288.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65513.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55243.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40251.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56855.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58338.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47727.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31730.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51284.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34860.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44630.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47694.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7498.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17276	dwm.exe
Token: SeChangeNotifyPrivilege	17276	dwm.exe
Token: 33	17276	dwm.exe
Token: SeIncBasePriorityPrivilege	17276	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1140	885b092d99aee3177c44e5312a8fbcac24573ea243e20962981f5125138aa40aN.exe
1056	Unicorn-43572.exe
744	Unicorn-50515.exe
4024	Unicorn-58128.exe
2016	Unicorn-60204.exe
4444	Unicorn-62242.exe
528	Unicorn-43868.exe
1488	Unicorn-40338.exe
216	Unicorn-30988.exe
1856	Unicorn-39710.exe
620	Unicorn-2762.exe
2844	Unicorn-26712.exe
2052	Unicorn-26712.exe
4068	Unicorn-14194.exe
632	Unicorn-63660.exe
1440	Unicorn-32833.exe
848	Unicorn-57760.exe
4108	Unicorn-946.exe
916	Unicorn-20812.exe
4668	Unicorn-6321.exe
4364	Unicorn-13603.exe
4624	Unicorn-13603.exe
4984	Unicorn-16925.exe
1988	Unicorn-50360.exe
3236	Unicorn-1906.exe
2172	Unicorn-46831.exe
4288	Unicorn-38662.exe
1596	Unicorn-21772.exe
4396	Unicorn-19725.exe
3300	Unicorn-1159.exe
4272	Unicorn-58263.exe
4860	Unicorn-2503.exe
4020	Unicorn-64511.exe
1264	Unicorn-55596.exe
864	Unicorn-4349.exe
4800	Unicorn-52591.exe
1592	Unicorn-26816.exe
2428	Unicorn-28906.exe
4312	Unicorn-49135.exe
444	Unicorn-60832.exe
3576	Unicorn-35752.exe
3996	Unicorn-15886.exe
4608	Unicorn-894.exe
5008	Unicorn-24844.exe
5088	Unicorn-63638.exe
3976	Unicorn-45072.exe
1212	Unicorn-45072.exe
2860	Unicorn-53240.exe
4484	Unicorn-7858.exe
3736	Unicorn-24460.exe
3036	Unicorn-38750.exe
3208	Unicorn-18329.exe
2656	Unicorn-27582.exe
3876	Unicorn-25014.exe
2296	Unicorn-24460.exe
3216	Unicorn-4594.exe
2364	Unicorn-33182.exe
2132	Unicorn-24460.exe
2856	Unicorn-35949.exe
2456	Unicorn-8123.exe
1044	Unicorn-20952.exe
1928	Unicorn-1086.exe
4572	Unicorn-6653.exe
380	Unicorn-4615.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1140 wrote to memory of 1056	1140	885b092d99aee3177c44e5312a8fbcac24573ea243e20962981f5125138aa40aN.exe	82
PID 1140 wrote to memory of 1056	1140	885b092d99aee3177c44e5312a8fbcac24573ea243e20962981f5125138aa40aN.exe	82
PID 1140 wrote to memory of 1056	1140	885b092d99aee3177c44e5312a8fbcac24573ea243e20962981f5125138aa40aN.exe	82
PID 1056 wrote to memory of 4024	1056	Unicorn-43572.exe	83
PID 1056 wrote to memory of 4024	1056	Unicorn-43572.exe	83
PID 1056 wrote to memory of 4024	1056	Unicorn-43572.exe	83
PID 1140 wrote to memory of 744	1140	885b092d99aee3177c44e5312a8fbcac24573ea243e20962981f5125138aa40aN.exe	84
PID 1140 wrote to memory of 744	1140	885b092d99aee3177c44e5312a8fbcac24573ea243e20962981f5125138aa40aN.exe	84
PID 1140 wrote to memory of 744	1140	885b092d99aee3177c44e5312a8fbcac24573ea243e20962981f5125138aa40aN.exe	84
PID 744 wrote to memory of 528	744	Unicorn-50515.exe	87
PID 744 wrote to memory of 528	744	Unicorn-50515.exe	87
PID 744 wrote to memory of 528	744	Unicorn-50515.exe	87
PID 1140 wrote to memory of 4444	1140	885b092d99aee3177c44e5312a8fbcac24573ea243e20962981f5125138aa40aN.exe	88
PID 1140 wrote to memory of 4444	1140	885b092d99aee3177c44e5312a8fbcac24573ea243e20962981f5125138aa40aN.exe	88
PID 1140 wrote to memory of 4444	1140	885b092d99aee3177c44e5312a8fbcac24573ea243e20962981f5125138aa40aN.exe	88
PID 4024 wrote to memory of 2016	4024	Unicorn-58128.exe	89
PID 4024 wrote to memory of 2016	4024	Unicorn-58128.exe	89
PID 4024 wrote to memory of 2016	4024	Unicorn-58128.exe	89
PID 1056 wrote to memory of 1488	1056	Unicorn-43572.exe	90
PID 1056 wrote to memory of 1488	1056	Unicorn-43572.exe	90
PID 1056 wrote to memory of 1488	1056	Unicorn-43572.exe	90
PID 2016 wrote to memory of 216	2016	Unicorn-60204.exe	94
PID 2016 wrote to memory of 216	2016	Unicorn-60204.exe	94
PID 2016 wrote to memory of 216	2016	Unicorn-60204.exe	94
PID 4024 wrote to memory of 1856	4024	Unicorn-58128.exe	95
PID 4024 wrote to memory of 1856	4024	Unicorn-58128.exe	95
PID 4024 wrote to memory of 1856	4024	Unicorn-58128.exe	95
PID 528 wrote to memory of 632	528	Unicorn-43868.exe	96
PID 528 wrote to memory of 632	528	Unicorn-43868.exe	96
PID 528 wrote to memory of 632	528	Unicorn-43868.exe	96
PID 744 wrote to memory of 620	744	Unicorn-50515.exe	97
PID 744 wrote to memory of 620	744	Unicorn-50515.exe	97
PID 744 wrote to memory of 620	744	Unicorn-50515.exe	97
PID 1488 wrote to memory of 2052	1488	Unicorn-40338.exe	99
PID 1488 wrote to memory of 2052	1488	Unicorn-40338.exe	99
PID 1488 wrote to memory of 2052	1488	Unicorn-40338.exe	99
PID 4444 wrote to memory of 2844	4444	Unicorn-62242.exe	98
PID 4444 wrote to memory of 2844	4444	Unicorn-62242.exe	98
PID 4444 wrote to memory of 2844	4444	Unicorn-62242.exe	98
PID 1140 wrote to memory of 4068	1140	885b092d99aee3177c44e5312a8fbcac24573ea243e20962981f5125138aa40aN.exe	100
PID 1140 wrote to memory of 4068	1140	885b092d99aee3177c44e5312a8fbcac24573ea243e20962981f5125138aa40aN.exe	100
PID 1140 wrote to memory of 4068	1140	885b092d99aee3177c44e5312a8fbcac24573ea243e20962981f5125138aa40aN.exe	100
PID 1056 wrote to memory of 1440	1056	Unicorn-43572.exe	101
PID 1056 wrote to memory of 1440	1056	Unicorn-43572.exe	101
PID 1056 wrote to memory of 1440	1056	Unicorn-43572.exe	101
PID 216 wrote to memory of 848	216	Unicorn-30988.exe	104
PID 216 wrote to memory of 848	216	Unicorn-30988.exe	104
PID 216 wrote to memory of 848	216	Unicorn-30988.exe	104
PID 2016 wrote to memory of 4108	2016	Unicorn-60204.exe	105
PID 2016 wrote to memory of 4108	2016	Unicorn-60204.exe	105
PID 2016 wrote to memory of 4108	2016	Unicorn-60204.exe	105
PID 1856 wrote to memory of 916	1856	Unicorn-39710.exe	106
PID 1856 wrote to memory of 916	1856	Unicorn-39710.exe	106
PID 1856 wrote to memory of 916	1856	Unicorn-39710.exe	106
PID 4024 wrote to memory of 4668	4024	Unicorn-58128.exe	107
PID 4024 wrote to memory of 4668	4024	Unicorn-58128.exe	107
PID 4024 wrote to memory of 4668	4024	Unicorn-58128.exe	107
PID 4068 wrote to memory of 4364	4068	Unicorn-14194.exe	109
PID 4068 wrote to memory of 4364	4068	Unicorn-14194.exe	109
PID 4068 wrote to memory of 4364	4068	Unicorn-14194.exe	109
PID 2052 wrote to memory of 4624	2052	Unicorn-26712.exe	108
PID 2052 wrote to memory of 4624	2052	Unicorn-26712.exe	108
PID 2052 wrote to memory of 4624	2052	Unicorn-26712.exe	108
PID 1488 wrote to memory of 3236	1488	Unicorn-40338.exe	110

C:\Users\Admin\AppData\Local\Temp\885b092d99aee3177c44e5312a8fbcac24573ea243e20962981f5125138aa40aN.exe
"C:\Users\Admin\AppData\Local\Temp\885b092d99aee3177c44e5312a8fbcac24573ea243e20962981f5125138aa40aN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1140
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43572.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43572.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58128.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58128.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30988.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57760.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2503.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4615.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6810.exe
        9⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10163.exe
        10⤵
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62392.exe
        11⤵
        
        PID:13092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28318.exe
        11⤵
        
        PID:15100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1095.exe
        11⤵
        
        PID:15772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
        10⤵
        
        PID:12652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11057.exe
        10⤵
        
        PID:13692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58211.exe
        10⤵
        
        PID:18384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52030.exe
        9⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43783.exe
        9⤵
        
        PID:13540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2758.exe
        9⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21418.exe
        8⤵
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51284.exe
        9⤵
        
        PID:7156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
        10⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38354.exe
        10⤵
        
        PID:13664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36733.exe
        10⤵
        
        PID:2480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-778.exe
        9⤵
        
        PID:11000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25633.exe
        9⤵
        
        PID:15952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12473.exe
        8⤵
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29874.exe
        8⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26395.exe
        8⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1086.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6810.exe
        8⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe
        9⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52030.exe
        8⤵
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43783.exe
        8⤵
        
        PID:13520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2758.exe
        8⤵
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56534.exe
        7⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50900.exe
        8⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54852.exe
        9⤵
        
        PID:9672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4682.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42386.exe
        8⤵
        
        PID:10424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4299.exe
        8⤵
        
        PID:19228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53323.exe
        7⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56855.exe
        8⤵
        
        PID:13624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48943.exe
        8⤵
        
        PID:18720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22569.exe
        7⤵
        
        PID:11388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26395.exe
        7⤵
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64511.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20952.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6810.exe
        8⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32400.exe
        9⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65132.exe
        10⤵
        
        PID:11728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12034.exe
        10⤵
        
        PID:14764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51335.exe
        10⤵
        
        PID:17008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30902.exe
        9⤵
        
        PID:10704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5788.exe
        9⤵
        
        PID:16908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10125.exe
        8⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47727.exe
        9⤵
        
        PID:12800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55669.exe
        9⤵
        
        PID:19156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59631.exe
        8⤵
        
        PID:11700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58211.exe
        8⤵
        
        PID:18408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45923.exe
        7⤵
        
        PID:4148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39032.exe
        8⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17320.exe
        9⤵
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        9⤵
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-778.exe
        8⤵
        
        PID:10992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        8⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35206.exe
        7⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31235.exe
        7⤵
        
        PID:11516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
        7⤵
        
        PID:14584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6653.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24372.exe
        7⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
        8⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2135.exe
        9⤵
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28373.exe
        9⤵
        
        PID:15620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27002.exe
        8⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        8⤵
        
        PID:13036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        8⤵
        
        PID:4644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
        7⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19138.exe
        8⤵
        
        PID:12624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        8⤵
        
        PID:15452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52407.exe
        7⤵
        
        PID:14100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
        7⤵
        
        PID:14792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37973.exe
        6⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1995.exe
        7⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36344.exe
        8⤵
        
        PID:10524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33263.exe
        8⤵
        
        PID:15916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8310.exe
        7⤵
        
        PID:10360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28373.exe
        7⤵
        
        PID:15144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65175.exe
        6⤵
        
        PID:9208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25307.exe
        6⤵
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-946.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55596.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63328.exe
        7⤵
        
        PID:512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40516.exe
        8⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12799.exe
        9⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52851.exe
        10⤵
        
        PID:10088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        10⤵
        
        PID:13736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33003.exe
        10⤵
        
        PID:19048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
        9⤵
        
        PID:11204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58211.exe
        9⤵
        
        PID:18416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
        8⤵
        
        PID:7796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19010.exe
        9⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56491.exe
        8⤵
        
        PID:14088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62259.exe
        7⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22120.exe
        8⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22180.exe
        9⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23950.exe
        9⤵
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46471.exe
        8⤵
        
        PID:10440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7952.exe
        8⤵
        
        PID:15596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6041.exe
        7⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44328.exe
        8⤵
        
        PID:10680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23950.exe
        8⤵
        
        PID:15636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18790.exe
        7⤵
        
        PID:11660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
        7⤵
        
        PID:2996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31018.exe
        6⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20096.exe
        7⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12799.exe
        8⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-415.exe
        9⤵
        
        PID:10800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27517.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:17640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43338.exe
        8⤵
        
        PID:9856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15202.exe
        8⤵
        
        PID:3656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
        7⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55044.exe
        8⤵
        
        PID:9836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23950.exe
        8⤵
        
        PID:5040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7498.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        7⤵
        
        PID:14672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53410.exe
        6⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22120.exe
        7⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
        8⤵
        
        PID:12668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52090.exe
        8⤵
        
        PID:12688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43982.exe
        8⤵
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17393.exe
        7⤵
        
        PID:12044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51427.exe
        7⤵
        
        PID:14744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        7⤵
        
        PID:3004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24159.exe
        6⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62304.exe
        7⤵
        
        PID:13824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8567.exe
        7⤵
        
        PID:15964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10125.exe
        6⤵
        
        PID:11624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26395.exe
        6⤵
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4349.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5767.exe
        6⤵
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22954.exe
        7⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18524.exe
        8⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26264.exe
        9⤵
        
        PID:10728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57967.exe
        10⤵
        
        PID:15648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34077.exe
        9⤵
        
        PID:14900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51136.exe
        9⤵
        
        PID:17064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61987.exe
        8⤵
        
        PID:12712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33885.exe
        8⤵
        
        PID:15116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64983.exe
        8⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18973.exe
        7⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47035.exe
        7⤵
        
        PID:17696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29586.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47200.exe
        7⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6611.exe
        8⤵
        
        PID:11736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55669.exe
        8⤵
        
        PID:19128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59107.exe
        7⤵
        
        PID:9912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7269.exe
        7⤵
        
        PID:13664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35465.exe
        7⤵
        
        PID:15104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21886.exe
        7⤵
        
        PID:18056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47458.exe
        6⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65132.exe
        7⤵
        
        PID:10700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
        7⤵
        
        PID:17372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31235.exe
        6⤵
        
        PID:11380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39706.exe
        6⤵
        
        PID:15708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54511.exe
        5⤵
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62664.exe
        6⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26588.exe
        7⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
        8⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
        8⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-778.exe
        7⤵
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24288.exe
        7⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9218.exe
        6⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47727.exe
        7⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47866.exe
        7⤵
        
        PID:15340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23758.exe
        7⤵
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25369.exe
        6⤵
        
        PID:11396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4299.exe
        6⤵
        
        PID:19032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10153.exe
        5⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30776.exe
        6⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25444.exe
        7⤵
        
        PID:13292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
        7⤵
        
        PID:14928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29762.exe
        7⤵
        
        PID:16748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10622.exe
        6⤵
        
        PID:12608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25102.exe
        6⤵
        
        PID:16128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7614.exe
        5⤵
        
        PID:8044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48668.exe
        5⤵
        
        PID:14272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38647.exe
        5⤵
        
        PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39710.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20812.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26816.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50692.exe
        7⤵
        
        PID:1276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63624.exe
        8⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33848.exe
        9⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4299.exe
        9⤵
        
        PID:19236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9086.exe
        8⤵
        
        PID:9896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61852.exe
        9⤵
        
        PID:16220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
        8⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33774.exe
        7⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22180.exe
        8⤵
        
        PID:9620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40479.exe
        8⤵
        
        PID:14484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52990.exe
        7⤵
        
        PID:9888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34027.exe
        7⤵
        
        PID:14168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14143.exe
        7⤵
        
        PID:14436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18382.exe
        6⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14423.exe
        7⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18524.exe
        8⤵
        
        PID:8308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10622.exe
        8⤵
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64983.exe
        8⤵
        
        PID:4948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5238.exe
        7⤵
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50938.exe
        7⤵
        
        PID:14316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23943.exe
        7⤵
        
        PID:2388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63846.exe
        6⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
        7⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24288.exe
        7⤵
        
        PID:4596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43287.exe
        6⤵
        
        PID:9356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52935.exe
        6⤵
        
        PID:15932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28906.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54776.exe
        6⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49452.exe
        7⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30776.exe
        8⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19138.exe
        9⤵
        
        PID:12640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28034.exe
        9⤵
        
        PID:14856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10622.exe
        8⤵
        
        PID:12584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23758.exe
        8⤵
        
        PID:1068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20998.exe
        7⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57762.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23943.exe
        7⤵
        
        PID:4696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45295.exe
        6⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1995.exe
        7⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45864.exe
        8⤵
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13618.exe
        8⤵
        
        PID:17048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
        7⤵
        
        PID:12976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58211.exe
        7⤵
        
        PID:17564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63706.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56803.exe
        6⤵
        
        PID:14212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36003.exe
        6⤵
        
        PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28033.exe
        5⤵
        
        PID:824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49452.exe
        6⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51284.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2135.exe
        8⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        8⤵
        
        PID:15924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-778.exe
        7⤵
        
        PID:11080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38442.exe
        7⤵
        
        PID:14116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        7⤵
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12969.exe
        6⤵
        
        PID:7968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11774.exe
        6⤵
        
        PID:12936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21957.exe
        6⤵
        
        PID:14828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        6⤵
        
        PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2674.exe
        5⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12275.exe
        6⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47727.exe
        7⤵
        
        PID:13028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55669.exe
        7⤵
        
        PID:19164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59631.exe
        6⤵
        
        PID:12436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64983.exe
        6⤵
        
        PID:3952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53698.exe
        5⤵
        
        PID:8712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40922.exe
        5⤵
        
        PID:13620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2859.exe
        5⤵
        
        PID:4688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9254.exe
        5⤵
        Executes dropped EXE
        
        PID:664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44792.exe
        6⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20968.exe
        7⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3679.exe
        8⤵
        
        PID:12020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19674.exe
        8⤵
        
        PID:15564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27002.exe
        7⤵
        
        PID:9780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        7⤵
        
        PID:14032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33003.exe
        7⤵
        
        PID:19220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
        6⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40244.exe
        7⤵
        
        PID:11372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19853.exe
        7⤵
        
        PID:14648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50296.exe
        7⤵
        
        PID:15548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7498.exe
        6⤵
        
        PID:11948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        6⤵
        
        PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61578.exe
        5⤵
        
        PID:2748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1995.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17380.exe
        7⤵
        
        PID:14232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19674.exe
        7⤵
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
        6⤵
        
        PID:12660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56174.exe
        6⤵
        
        PID:13680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        6⤵
        
        PID:1520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7350.exe
        5⤵
        
        PID:8900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46410.exe
        5⤵
        
        PID:11756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6842.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52591.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9851.exe
        5⤵
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45944.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12799.exe
        7⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17136.exe
        8⤵
        
        PID:10712
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10712 -s 640
        9⤵
        Program crash
        
        PID:15180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34138.exe
        8⤵
        
        PID:19196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
        7⤵
        
        PID:11220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        7⤵
        
        PID:14152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3406.exe
        6⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22180.exe
        7⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36202.exe
        7⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40554.exe
        6⤵
        
        PID:10548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30054.exe
        6⤵
        
        PID:19276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21418.exe
        5⤵
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51284.exe
        6⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55044.exe
        7⤵
        
        PID:10172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41631.exe
        7⤵
        
        PID:15532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-778.exe
        6⤵
        
        PID:11072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        6⤵
        
        PID:15004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18834.exe
        5⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24100.exe
        6⤵
        
        PID:12032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
        6⤵
        
        PID:18000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
        5⤵
        
        PID:12928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43138.exe
        5⤵
        
        PID:15136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        5⤵
        
        PID:6664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25233.exe
      4⤵
      PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49452.exe
        5⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42732.exe
        6⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47727.exe
        7⤵
        
        PID:2636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41631.exe
        7⤵
        
        PID:1080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14618.exe
        6⤵
        
        PID:13192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7952.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-474.exe
        5⤵
        
        PID:6944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12335.exe
        6⤵
        
        PID:14080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34344.exe
        6⤵
        
        PID:16952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12925.exe
        5⤵
        
        PID:11648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24288.exe
        5⤵
        
        PID:15172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26290.exe
      4⤵
      PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7571.exe
        5⤵
        
        PID:12480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28034.exe
        5⤵
        
        PID:2768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39044.exe
      4⤵
      PID:9328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24013.exe
      4⤵
      PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36624.exe
      4⤵
      PID:1516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40338.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40338.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13603.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35752.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23028.exe
        7⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51180.exe
        8⤵
        
        PID:3648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
        9⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12228.exe
        9⤵
        
        PID:13344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5238.exe
        8⤵
        
        PID:8488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50938.exe
        8⤵
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34138.exe
        8⤵
        
        PID:19172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3302.exe
        7⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30776.exe
        8⤵
        
        PID:8272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42910.exe
        9⤵
        
        PID:12856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55669.exe
        9⤵
        
        PID:19148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10622.exe
        8⤵
        
        PID:12600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40479.exe
        8⤵
        
        PID:4852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26949.exe
        7⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56855.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49599.exe
        8⤵
        
        PID:16120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64203.exe
        7⤵
        
        PID:13512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64615.exe
        6⤵
        
        PID:3644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
        7⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33524.exe
        8⤵
        
        PID:13384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
        8⤵
        
        PID:16020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59867.exe
        7⤵
        
        PID:9660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        7⤵
        
        PID:13672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20630.exe
        7⤵
        
        PID:544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47694.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5022.exe
        6⤵
        
        PID:12564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26395.exe
        6⤵
        
        PID:14760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-894.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35280.exe
        6⤵
        
        PID:436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55264.exe
        7⤵
        
        PID:3556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30776.exe
        8⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6886.exe
        9⤵
        
        PID:13156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3530.exe
        9⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10622.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40479.exe
        8⤵
        
        PID:14472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5238.exe
        7⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50938.exe
        7⤵
        
        PID:14324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31165.exe
        7⤵
        
        PID:19248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64755.exe
        6⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34860.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19440.exe
        8⤵
        
        PID:12360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23950.exe
        8⤵
        
        PID:14960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
        7⤵
        
        PID:11800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52090.exe
        7⤵
        
        PID:13660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43982.exe
        7⤵
        
        PID:828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43286.exe
        6⤵
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23463.exe
        6⤵
        
        PID:15484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4453.exe
        5⤵
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55264.exe
        6⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43604.exe
        7⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17136.exe
        8⤵
        
        PID:10664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23943.exe
        8⤵
        
        PID:3892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24078.exe
        7⤵
        
        PID:11868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7223.exe
        7⤵
        
        PID:14984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30126.exe
        6⤵
        
        PID:8964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25857.exe
        6⤵
        
        PID:13388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19540.exe
        6⤵
        
        PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18818.exe
        5⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10163.exe
        6⤵
        
        PID:8372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
        6⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8499.exe
        6⤵
        
        PID:19392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7621.exe
        5⤵
        
        PID:7296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12179.exe
        5⤵
        
        PID:15416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1906.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24460.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57428.exe
        6⤵
        
        PID:5512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12799.exe
        7⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
        8⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34078.exe
        8⤵
        
        PID:14064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe
        8⤵
        
        PID:2248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13222.exe
        7⤵
        
        PID:10916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4299.exe
        7⤵
        
        PID:19264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
        6⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19824.exe
        7⤵
        
        PID:11280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32424.exe
        7⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56491.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64688.exe
        6⤵
        
        PID:16840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16566.exe
        5⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26780.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59696.exe
        7⤵
        
        PID:9348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        7⤵
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16478.exe
        6⤵
        
        PID:10324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24288.exe
        6⤵
        
        PID:15588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22953.exe
        5⤵
        
        PID:8100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56855.exe
        6⤵
        
        PID:13632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15590.exe
        6⤵
        
        PID:14964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31235.exe
        5⤵
        
        PID:11444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
        5⤵
        
        PID:14288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38750.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8227.exe
        5⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26780.exe
        6⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45148.exe
        7⤵
        
        PID:11244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34138.exe
        7⤵
        
        PID:19212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26434.exe
        6⤵
        
        PID:9840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28803.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:19140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21138.exe
        5⤵
        
        PID:8940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46410.exe
        5⤵
        
        PID:12652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        5⤵
        
        PID:1084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
      4⤵
      PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63536.exe
        5⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63212.exe
        6⤵
        
        PID:10228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62620.exe
        6⤵
        
        PID:17096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46663.exe
        5⤵
        
        PID:10212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        5⤵
        
        PID:15816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60994.exe
      4⤵
      PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38826.exe
        5⤵
        
        PID:12820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28034.exe
        5⤵
        
        PID:14820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30538.exe
      4⤵
      PID:11428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5707.exe
      4⤵
      PID:14000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32833.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32833.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1159.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8123.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57428.exe
        6⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12799.exe
        7⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41824.exe
        8⤵
        
        PID:9056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61432.exe
        9⤵
        
        PID:12460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12850.exe
        9⤵
        
        PID:16096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40087.exe
        8⤵
        
        PID:12012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36202.exe
        8⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65103.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57311.exe
        7⤵
        
        PID:14672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15202.exe
        7⤵
        
        PID:14648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
        6⤵
        
        PID:7668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11582.exe
        6⤵
        
        PID:11924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        6⤵
        
        PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36986.exe
        5⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55368.exe
        6⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5023.exe
        7⤵
        
        PID:13304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21594.exe
        7⤵
        
        PID:16828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26434.exe
        6⤵
        
        PID:9852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61237.exe
        6⤵
        
        PID:15740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47458.exe
        5⤵
        
        PID:8164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41972.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20342.exe
        6⤵
        
        PID:14980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37930.exe
        6⤵
        
        PID:16896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55739.exe
        5⤵
        
        PID:11436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25849.exe
        5⤵
        
        PID:13496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41050.exe
        5⤵
        
        PID:16052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33182.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32767.exe
        5⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22120.exe
        6⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28620.exe
        7⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49799.exe
        7⤵
        
        PID:15460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46471.exe
        6⤵
        
        PID:10448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        6⤵
        
        PID:3324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18293.exe
        5⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3487.exe
        6⤵
        
        PID:12832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28034.exe
        6⤵
        
        PID:15044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18790.exe
        5⤵
        
        PID:11640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29933.exe
        5⤵
        
        PID:13728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33003.exe
        5⤵
        
        PID:19204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50722.exe
      4⤵
      PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3427.exe
        5⤵
        
        PID:7992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27992.exe
        6⤵
        
        PID:11308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13679.exe
        7⤵
        
        PID:13612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34519.exe
        7⤵
        
        PID:19288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25095.exe
        6⤵
        
        PID:4584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59194.exe
        5⤵
        
        PID:12948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        5⤵
        
        PID:14676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1382.exe
      4⤵
      PID:7880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47727.exe
        5⤵
        
        PID:12428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51585.exe
        5⤵
        
        PID:19256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3493.exe
      4⤵
      PID:12292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25944.exe
      4⤵
      PID:4244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14730.exe
      4⤵
      PID:17364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58263.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58263.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60147.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
        5⤵
        
        PID:6740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-415.exe
        6⤵
        
        PID:10776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53684.exe
        6⤵
        
        PID:16084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        5⤵
        
        PID:9636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        5⤵
        
        PID:14108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        5⤵
        
        PID:8064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58174.exe
      4⤵
      PID:7284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50760.exe
        5⤵
        
        PID:2160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51294.exe
        5⤵
        
        PID:5600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12402.exe
      4⤵
      PID:10828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26395.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35949.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35949.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11159.exe
      4⤵
      PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13302.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12335.exe
        6⤵
        
        PID:14024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3398.exe
        6⤵
        
        PID:16028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25369.exe
        5⤵
        
        PID:11404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        5⤵
        
        PID:3212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49614.exe
      4⤵
      PID:9624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56144.exe
      4⤵
      PID:7344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48298.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48298.exe
    3⤵
    PID:5576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56691.exe
      4⤵
      PID:7452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58211.exe
        5⤵
        
        PID:18392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40554.exe
      4⤵
      PID:11296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54167.exe
      4⤵
      PID:13760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36733.exe
      4⤵
      PID:15612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14871.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14871.exe
    3⤵
    PID:7348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-939.exe
      4⤵
      PID:12072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21594.exe
      4⤵
      PID:16796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16753.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16753.exe
    3⤵
    PID:10788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25307.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25307.exe
    3⤵
    PID:15580
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50515.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50515.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43868.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43868.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63660.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50360.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24460.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32924.exe
        7⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
        8⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29572.exe
        9⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47727.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:12960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16934.exe
        10⤵
        
        PID:16108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51463.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34845.exe
        9⤵
        
        PID:14416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12491.exe
        9⤵
        
        PID:18732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16094.exe
        8⤵
        
        PID:9936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        8⤵
        
        PID:14128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64211.exe
        8⤵
        
        PID:15196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
        7⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6611.exe
        8⤵
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44431.exe
        9⤵
        
        PID:15756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31165.exe
        8⤵
        
        PID:19020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65330.exe
        7⤵
        
        PID:12232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7342.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        7⤵
        
        PID:7776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16566.exe
        6⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12799.exe
        7⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
        8⤵
        
        PID:9372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28373.exe
        8⤵
        
        PID:1016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
        7⤵
        
        PID:11196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
        7⤵
        
        PID:14020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13058.exe
        6⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13051.exe
        7⤵
        
        PID:10688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45515.exe
        7⤵
        
        PID:15492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55818.exe
        6⤵
        
        PID:12280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
        6⤵
        
        PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25014.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23220.exe
        6⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52607.exe
        7⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58308.exe
        8⤵
        
        PID:12112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
        8⤵
        
        PID:14948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45907.exe
        8⤵
        
        PID:16992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48722.exe
        7⤵
        
        PID:10468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33650.exe
        7⤵
        
        PID:16700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
        6⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25444.exe
        7⤵
        
        PID:12212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25678.exe
        7⤵
        
        PID:16968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3030.exe
        6⤵
        
        PID:10484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        6⤵
        
        PID:14476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34385.exe
        5⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47200.exe
        6⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2135.exe
        7⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
        7⤵
        
        PID:548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-778.exe
        6⤵
        
        PID:11008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        6⤵
        
        PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53323.exe
        5⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11655.exe
        6⤵
        
        PID:12868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23950.exe
        6⤵
        
        PID:2576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22569.exe
        5⤵
        
        PID:11416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62960.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46831.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45072.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48492.exe
        6⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
        7⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14011.exe
        8⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34077.exe
        8⤵
        
        PID:15004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19195.exe
        8⤵
        
        PID:17352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55783.exe
        7⤵
        
        PID:9680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        7⤵
        
        PID:14244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36966.exe
        7⤵
        
        PID:15936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40354.exe
        6⤵
        
        PID:7244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29113.exe
        6⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29071.exe
        6⤵
        
        PID:12268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-594.exe
        6⤵
        
        PID:16764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65191.exe
        5⤵
        
        PID:5208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37304.exe
        6⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
        7⤵
        
        PID:11032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45899.exe
        7⤵
        
        PID:16876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46087.exe
        6⤵
        
        PID:10816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38442.exe
        6⤵
        
        PID:14152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42161.exe
        6⤵
        
        PID:15676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-806.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63026.exe
        5⤵
        
        PID:12260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1507.exe
        5⤵
        
        PID:15764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18329.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57428.exe
        5⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12799.exe
        6⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
        7⤵
        
        PID:9400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34078.exe
        7⤵
        
        PID:13536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
        6⤵
        
        PID:11212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
        6⤵
        
        PID:14588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
        5⤵
        
        PID:7676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28184.exe
        6⤵
        
        PID:12052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29186.exe
        6⤵
        
        PID:15988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22626.exe
        5⤵
        
        PID:12544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        5⤵
        
        PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40251.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7703.exe
        5⤵
        
        PID:7864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51336.exe
        6⤵
        
        PID:9452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34078.exe
        6⤵
        
        PID:14176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28565.exe
        6⤵
        
        PID:14800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57511.exe
        5⤵
        
        PID:10308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52850.exe
        5⤵
        
        PID:15172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24288.exe
        5⤵
        
        PID:15604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9245.exe
      4⤵
      PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64940.exe
        5⤵
        
        PID:11424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51585.exe
        5⤵
        
        PID:19296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52495.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18343.exe
      4⤵
      PID:14560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2762.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2762.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21772.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53240.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32156.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19660.exe
        7⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62392.exe
        8⤵
        
        PID:13124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44847.exe
        8⤵
        
        PID:14912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35730.exe
        8⤵
        
        PID:17344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6582.exe
        7⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        7⤵
        
        PID:14196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
        7⤵
        
        PID:1180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44439.exe
        6⤵
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54224.exe
        7⤵
        
        PID:12160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
        7⤵
        
        PID:14940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19010.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40554.exe
        6⤵
        
        PID:10760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49794.exe
        6⤵
        
        PID:16732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36410.exe
        5⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
        6⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1995.exe
        7⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
        7⤵
        
        PID:12644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44307.exe
        7⤵
        
        PID:14164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
        7⤵
        
        PID:13872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49971.exe
        6⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64276.exe
        7⤵
        
        PID:13816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26558.exe
        7⤵
        
        PID:3948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50938.exe
        6⤵
        
        PID:14292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28034.exe
        6⤵
        
        PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17141.exe
        5⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2135.exe
        6⤵
        
        PID:9468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41009.exe
        6⤵
        
        PID:4344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20378.exe
        5⤵
        
        PID:10968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62960.exe
        5⤵
        
        PID:2380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4594.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57428.exe
        5⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12799.exe
        6⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26064.exe
        7⤵
        
        PID:9032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36733.exe
        7⤵
        
        PID:2012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
        6⤵
        
        PID:11188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58211.exe
        6⤵
        
        PID:17556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
        5⤵
        
        PID:7580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44520.exe
        6⤵
        
        PID:10464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10451.exe
        6⤵
        
        PID:17668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14322.exe
        5⤵
        
        PID:11860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58211.exe
        5⤵
        
        PID:18400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39814.exe
      4⤵
      PID:5980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
        5⤵
        
        PID:7392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47727.exe
        6⤵
        
        PID:12912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23758.exe
        6⤵
        
        PID:1196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37509.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28798.exe
        5⤵
        
        PID:16072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23007.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55044.exe
        5⤵
        
        PID:9904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40479.exe
        5⤵
        
        PID:4336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37753.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24155.exe
      4⤵
      PID:16716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19725.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19725.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45072.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22452.exe
        5⤵
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11491.exe
        6⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
        7⤵
        
        PID:9300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14426.exe
        7⤵
        
        PID:14208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe
        7⤵
        
        PID:14524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2690.exe
        6⤵
        
        PID:9600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        6⤵
        
        PID:14260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58211.exe
        6⤵
        
        PID:17572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
        5⤵
        
        PID:7588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11655.exe
        6⤵
        
        PID:12860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2475.exe
        6⤵
        
        PID:17488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11582.exe
        5⤵
        
        PID:11940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
        5⤵
        
        PID:14168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65191.exe
      4⤵
      PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
        5⤵
        
        PID:6716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58168.exe
        6⤵
        
        PID:10320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40479.exe
        6⤵
        
        PID:764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43530.exe
        5⤵
        
        PID:9576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        5⤵
        
        PID:14148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33003.exe
        5⤵
        
        PID:19180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17142.exe
      4⤵
      PID:7692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11307.exe
        5⤵
        
        PID:4912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64370.exe
      4⤵
      PID:11904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26395.exe
      4⤵
      PID:15000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7858.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7858.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23412.exe
      4⤵
      PID:5300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62000.exe
        5⤵
        
        PID:7124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-415.exe
        6⤵
        
        PID:10768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47940.exe
        7⤵
        
        PID:13752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44847.exe
        7⤵
        
        PID:14960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25678.exe
        7⤵
        
        PID:17020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42630.exe
        6⤵
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30293.exe
        6⤵
        
        PID:16856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9138.exe
        5⤵
        
        PID:10900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38442.exe
        5⤵
        
        PID:14060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53261.exe
        5⤵
        
        PID:4700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
      4⤵
      PID:7816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65132.exe
        5⤵
        
        PID:11344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41631.exe
        6⤵
        
        PID:15524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16742.exe
        5⤵
        
        PID:16244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56491.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
      4⤵
      PID:8056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31585.exe
    3⤵
    PID:5792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3109.exe
      4⤵
      PID:7268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4447.exe
        5⤵
        
        PID:12352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10451.exe
        5⤵
        
        PID:17632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6154.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28798.exe
      4⤵
      PID:16064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63343.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63343.exe
    3⤵
    PID:7312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21360.exe
      4⤵
      PID:13252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37499.exe
      4⤵
      PID:14980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12542.exe
      4⤵
      PID:18876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
    3⤵
    PID:10908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39424.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39424.exe
    3⤵
    PID:4368
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62242.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62242.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49135.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54584.exe
        5⤵
        
        PID:2508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34844.exe
        6⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30776.exe
        7⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
        7⤵
        
        PID:11756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52090.exe
        7⤵
        
        PID:13496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        7⤵
        
        PID:3244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17490.exe
        6⤵
        
        PID:7984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50938.exe
        6⤵
        
        PID:14300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31165.exe
        6⤵
        
        PID:19368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50111.exe
        5⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41824.exe
        6⤵
        
        PID:9084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24182.exe
        6⤵
        
        PID:13556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41431.exe
        6⤵
        
        PID:16232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47762.exe
        5⤵
        
        PID:10580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36202.exe
      4⤵
      PID:3360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45103.exe
        5⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13043.exe
        6⤵
        
        PID:9108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44603.exe
        6⤵
        
        PID:13488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55669.exe
        6⤵
        
        PID:19108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24785.exe
        5⤵
        
        PID:9388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53679.exe
        5⤵
        
        PID:14020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
        5⤵
        
        PID:18360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18818.exe
      4⤵
      PID:6160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30776.exe
        5⤵
        
        PID:8264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62392.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21594.exe
        6⤵
        
        PID:16864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10622.exe
        5⤵
        
        PID:12576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40479.exe
        5⤵
        
        PID:1896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24149.exe
      4⤵
      PID:8208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31602.exe
      4⤵
      PID:14252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62412.exe
      4⤵
      PID:17412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38662.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38662.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24844.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63868.exe
        5⤵
        
        PID:4564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7407.exe
        6⤵
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7371.exe
        7⤵
        
        PID:10600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11307.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39446.exe
        6⤵
        
        PID:9644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        6⤵
        
        PID:14056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19286.exe
        6⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
        5⤵
        
        PID:7408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56855.exe
        6⤵
        
        PID:13648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41631.exe
        6⤵
        
        PID:14768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27326.exe
        5⤵
        
        PID:13324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60796.exe
        5⤵
        
        PID:16816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19306.exe
      4⤵
      PID:1576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19660.exe
        5⤵
        
        PID:6816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
        6⤵
        
        PID:9420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38442.exe
        6⤵
        
        PID:13612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24719.exe
        6⤵
        
        PID:19380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27002.exe
        5⤵
        
        PID:9788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        5⤵
        
        PID:13760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33003.exe
        5⤵
        
        PID:19188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59946.exe
      4⤵
      PID:8492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28605.exe
        5⤵
        
        PID:1248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58307.exe
      4⤵
      PID:12632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9867.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9867.exe
      4⤵
      PID:15716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63638.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63638.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35088.exe
      4⤵
      PID:1052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30760.exe
        5⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38944.exe
        6⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9150.exe
        7⤵
        
        PID:16936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
        6⤵
        
        PID:12964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        6⤵
        
        PID:13828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51958.exe
        6⤵
        
        PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54631.exe
        5⤵
        
        PID:9100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58338.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34138.exe
        5⤵
        
        PID:19120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64755.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64755.exe
      4⤵
      PID:6168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33656.exe
        5⤵
        
        PID:9020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24182.exe
        5⤵
        
        PID:13504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33263.exe
        5⤵
        
        PID:15500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41314.exe
      4⤵
      PID:9732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26395.exe
      4⤵
      PID:14944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55243.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55243.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11491.exe
      4⤵
      PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54224.exe
        5⤵
        
        PID:12172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22554.exe
        5⤵
        
        PID:17080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6345.exe
      4⤵
      PID:11016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20630.exe
      4⤵
      PID:15540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14341.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14341.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50760.exe
      4⤵
      PID:8752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63547.exe
      4⤵
      PID:17496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56187.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56187.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12335.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60767.exe
      4⤵
      PID:1176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6999.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6999.exe
    3⤵
    PID:16668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14194.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14194.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13603.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13603.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60832.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34164.exe
        5⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41284.exe
        6⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51284.exe
        7⤵
        
        PID:3480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61868.exe
        8⤵
        
        PID:10944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27517.exe
        8⤵
        
        PID:17648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26434.exe
        7⤵
        
        PID:9868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58497.exe
        7⤵
        
        PID:15404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18861.exe
        6⤵
        
        PID:9956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65464.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39674.exe
        5⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38508.exe
        6⤵
        
        PID:8736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe
        6⤵
        
        PID:15080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1485.exe
        5⤵
        
        PID:8880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55075.exe
        5⤵
        
        PID:12368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        5⤵
        
        PID:15436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34718.exe
      4⤵
      PID:1200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-910.exe
        5⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6079.exe
        6⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47727.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64983.exe
        7⤵
        
        PID:15124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
        6⤵
        
        PID:12368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60066.exe
        6⤵
        
        PID:14284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48066.exe
        6⤵
        
        PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44630.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
        5⤵
        
        PID:16008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12953.exe
      4⤵
      PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38508.exe
        5⤵
        
        PID:8744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38215.exe
        5⤵
        
        PID:1348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24288.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47179.exe
      4⤵
      PID:9316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56247.exe
      4⤵
      PID:13564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30595.exe
      4⤵
      PID:4576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15886.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15886.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23028.exe
      4⤵
      PID:4372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47096.exe
        5⤵
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14579.exe
        6⤵
        
        PID:9432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53261.exe
        6⤵
        
        PID:14880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29934.exe
        5⤵
        
        PID:9144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15295.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50111.exe
      4⤵
      PID:7096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26064.exe
        5⤵
        
        PID:8472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38354.exe
        5⤵
        
        PID:13612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        5⤵
        
        PID:15824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14069.exe
      4⤵
      PID:9612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33249.exe
      4⤵
      PID:14240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
      4⤵
      PID:14532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
    3⤵
    PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63624.exe
      4⤵
      PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10163.exe
        5⤵
        
        PID:8392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38826.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19674.exe
        6⤵
        
        PID:1964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
        5⤵
        
        PID:13040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43982.exe
        5⤵
        
        PID:408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45974.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31631.exe
      4⤵
      PID:16044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53375.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53375.exe
    3⤵
    PID:6964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51336.exe
      4⤵
      PID:9724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe
      4⤵
      PID:4240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9925.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9925.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:9256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47.exe
      4⤵
      PID:15292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8075.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21604.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21604.exe
    3⤵
    PID:19080
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16925.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16925.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24460.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24460.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43832.exe
      4⤵
      PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29328.exe
        5⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2135.exe
        6⤵
        
        PID:9488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65513.exe
        6⤵
        
        PID:15092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6582.exe
        5⤵
        
        PID:9760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        5⤵
        
        PID:14220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
        5⤵
        
        PID:7484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
      4⤵
      PID:7768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44027.exe
        5⤵
        
        PID:11716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11109.exe
        5⤵
        
        PID:15312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23950.exe
        5⤵
        
        PID:15572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7290.exe
      4⤵
      PID:14048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19478.exe
      4⤵
      PID:14536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16566.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16566.exe
    3⤵
    PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49364.exe
      4⤵
      PID:7108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62244.exe
        5⤵
        
        PID:9048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50908.exe
        6⤵
        
        PID:10004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12942.exe
        6⤵
        
        PID:14444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19010.exe
        6⤵
        
        PID:14804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24182.exe
        5⤵
        
        PID:13772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36202.exe
        5⤵
        
        PID:15628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44683.exe
      4⤵
      PID:9996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
      4⤵
      PID:13848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51958.exe
      4⤵
      PID:5076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45730.exe
    3⤵
    PID:7488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54852.exe
      4⤵
      PID:11024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34077.exe
        5⤵
        
        PID:15040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5059.exe
        5⤵
        
        PID:16780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54411.exe
      4⤵
      PID:14176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29371.exe
      4⤵
      PID:17032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50503.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50503.exe
    3⤵
    PID:10676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3427.exe
    3⤵
    PID:16980
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27582.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27582.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19520.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19520.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45664.exe
      4⤵
      PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29764.exe
        5⤵
        
        PID:9268
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6932 -s 660
        5⤵
        Program crash
        
        PID:1840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35170.exe
      4⤵
      PID:9872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
      4⤵
      PID:13992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43982.exe
      4⤵
      PID:4704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11277.exe
    3⤵
    PID:7696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20504.exe
      4⤵
      PID:14004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22474.exe
      4⤵
      PID:14940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64483.exe
    3⤵
    PID:10648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62222.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62222.exe
    3⤵
    PID:13832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31730.exe
    3⤵
    PID:14968
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35432.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35432.exe
  2⤵
  PID:5336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23168.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23168.exe
    3⤵
    PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34860.exe
      4⤵
      PID:8384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62392.exe
        5⤵
        
        PID:13068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35730.exe
        5⤵
        
        PID:17336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63907.exe
      4⤵
      PID:2636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44307.exe
      4⤵
      PID:14136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52918.exe
      4⤵
      PID:15364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29550.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29550.exe
    3⤵
    PID:7964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50296.exe
      4⤵
      PID:740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50938.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50938.exe
    3⤵
    PID:14308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7422.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7422.exe
    3⤵
    PID:1472
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16309.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16309.exe
  2⤵
  PID:5128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21788.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21788.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:9068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37202.exe
    3⤵
    PID:14264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6758.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6758.exe
    3⤵
    PID:5608
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54362.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54362.exe
  2⤵
  PID:10340
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61559.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61559.exe
  2⤵
  PID:2920

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1159.exe

Filesize
468KB

MD5
6a36ba420cb1bf9b875aeb8248419992

SHA1
d6793e70ae475c66a4f67db37bed367539f8eb0d

SHA256
a184143b4855ba6eed3bed7b8b64820826dc36057d0aacf581761f6d23861bcb

SHA512
baf197d13ff5d9838bec906b8ae7d6c3395bb3f34aad2371267531b74adf1a4eb24f138d2b3baae036c099259c5393c453d7904b58308f9ed996a400513dc073

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13603.exe

Filesize
468KB

MD5
182653358ad8082b90ae1d5536a835c2

SHA1
5c7d22422af74546ebaed4bb3f25e2a8bbcfdd12

SHA256
9b5512484a702229be5c289b6b0e90b14ff9239e47b166ffbb598aecac8073c7

SHA512
59d26d590c749fa277fa4779fe15da0ae8e41a182c4f0579c74630cbb60afa01bd9b9a364a4aebaaab907691f65f4f66a401a2688ef89f9624841736657eb7d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14194.exe

Filesize
468KB

MD5
5f1a5d948796d098c5d26e5181d56cf0

SHA1
7d1bcd1a2d090b901030310aa35b18b170b6d278

SHA256
272aa76c789feedbde0a0a31a3dd7654b8b60843d694bce6682d2d7d35485d16

SHA512
f8a969abc661a6e0b82addb88de1c0915e05c1f9e500b537da267dd1507a97f472081e6f01762e19c7f7308ccdfe9d3afbe984f524dc57a3dcd031303a368688

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16925.exe

Filesize
468KB

MD5
ca02c81c74f8f031dcc96b45536be378

SHA1
b8510cfb3fc9456b4552a44fe3a18712f1a39ff1

SHA256
6dd7ed2e6dcda03ccf4e133103ea039788526f67725b49aab8a6036fcb71d2bf

SHA512
a467ea730e8d122b8d4c0d1784219271fc2d884bda5d768c8b24a6e8553a0f0b95207c4297a3c1df2849bb5f2407577dbf5f4b1d9c430eed1cb0ccbe45a4ab29

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18973.exe

Filesize
468KB

MD5
60c58ebcee1a0a1d87a6d3f9c1458c92

SHA1
21860795e4351bb0b79ebee5101f277e88cf5de5

SHA256
5e9d71fd0d9a1d7945d8369caf02169cbc008dc6658eaa5d805cfecc13199bc8

SHA512
6b7587fd6b7089ce4fcd9f68308ac2608465a7f6ea5499717cf2a19ad9d2009f9e15cbd45ab690084d603c8a6a06df377560d6c988b11a7c0fd7d04dff2e1e6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1906.exe

Filesize
468KB

MD5
ec33eba24a6d541465ad12e68e7e5736

SHA1
4c51608828320e11ec79400c8ae3255b50442a78

SHA256
6eae483c0410dfbb0a9aae459ef29957a20e3d59036b448b6c33a3fdd2cb03dc

SHA512
15a6e656910579ca36bed14379e7a8c7770b592df485662dbfb03be86d20b72a276c83adab90fa24c1ce0616f2323f6416ea1357611f721f9bcb2607894598e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19725.exe

Filesize
468KB

MD5
cffd3e90b20176a8afc3078fc0cf7be4

SHA1
7f1fe3232fc3cbe1b82acb2e6b70a8598722bd36

SHA256
6f0e52f3a87e3ee7ac18bea7db2816d83794558a08447a15ebe09824827cff7d

SHA512
dcc8e165d688cf97e008c3a9ed29cf33778a5e7db508e89f31d549840adda41d4d3cd3cd70823ab8faa745367ef04319511ce0814d1cff39a9f260ecee3ca73a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20812.exe

Filesize
468KB

MD5
a7760b0e94f97b60231b20680d314997

SHA1
831c0e094ef4c02a546ac47f4f4b3136e87b1e1c

SHA256
44a8cd47022094e88db3c90032d22ea82edae900827d7aefa38cb8be55669401

SHA512
0b330b6628a3f89eb862f9cea8bdeab2acf7438db5ac8a4257f2f38da1e66e5bdbb15d95f92a9a3552328fd6ef5c233025567f622616024326148356348afb73

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21772.exe

Filesize
468KB

MD5
355b51ecdbe2c7ccfa31be157a9e2880

SHA1
0dd63b5a27d73106f55460149ebcdffee34c4a41

SHA256
8e9372d42bac3ecc369e85b60273f32354b33d786c381fadc32f09bf58b6d207

SHA512
a5a3b19b34d783e33d96350e1735ad7c6b0cde237c5b20ed33ce4a9e338a5bd0a6c8d3a8dba5f1be2076073c70142cf09fa288c78f9bb19d7292b794e1e9bc30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2503.exe

Filesize
468KB

MD5
f026f25de53b247fc10a48c2bd7ccb53

SHA1
65d82d3a81ffe784014cabeca5eb09544e18e1f6

SHA256
c5d8d49277b1ee43f860ee2048d34740a75100a798aa05859f756a91470032e5

SHA512
29685f8d4bb52685edf4c9e8b679f51ac5485dd019a82694bee9c26233ceb8ba63d10b552c049f4ef4f1cc6a87d3f8d1823989f05783f71a9c9d4dc778966cf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26712.exe

Filesize
468KB

MD5
6fe8df21c77b1f3b71104f5769dc8a4d

SHA1
71912c78d8172e1c5fd3ee8d8d59c81389a34841

SHA256
2281d5a8dabef35c9be47b03f81695d66d42c5c776907da1cc7f95a82fb7f43a

SHA512
ac4c97c2d4ced734f60c05f2b770e81103c9b44814cb4382d04f455920d523dc8f7b2a487230cb230c10d3e0e086b5d8a63ffeea1ce8d95319c691b1eaa0a47b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26816.exe

Filesize
468KB

MD5
945f8ee3581dac9bb886913af57088b7

SHA1
e586d37cbf8206aa185353b71b375b04a79542ff

SHA256
803fcc97f7938d35770d867379246fea52ddc44bb5e14ce4a793a4a6528d879b

SHA512
bb3f804dcf213d8be73fcde7fbcb6c31d6b99c99b2b2ee8f15c861088fbf26e41cca9e11e8ebcba5f73020196fa463674581341d35f95c3703452f046e9924e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2762.exe

Filesize
468KB

MD5
8394634d55e109d6da8b724b0cce3d2e

SHA1
cc90cc130ad44713b0f1d39080253502f7800345

SHA256
1ffc51ca2e228430b210a667dbceea67662e31e274fa83871fa889f1e3b0c9ee

SHA512
20a280f8afa7a853941c8e99e1406dc52ca435ea362e7588f9393668e23cda470962b7c4f7675fab8f0802916f3928ac7b00d6b390494390e827cf73f7499b89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30988.exe

Filesize
468KB

MD5
a3c2b7ce7cb540861258cc8c97f15887

SHA1
690fa9c029dd118ae3a30e2e613a2d11fdb337e9

SHA256
ace376796577c7b5c825b1d720c9b11df62552dcebe0b68cd60363e7aeb22f72

SHA512
b1e00898afa62c6d011df6dc0f3361354e530999239c131c04dfe40e47d905091e99f04f4a7226eaa49fe903d2edb460813995a1adafcbbf2daaf92dde33cb48

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32833.exe

Filesize
468KB

MD5
4f6d1bf9a150ec45199130027c61da16

SHA1
131c0b4e556a431bf3f732d34c53a7a18b41e36d

SHA256
79620cd81347e733237671b741094a7989e9e87f905a58075c40101b0e037985

SHA512
3389c4887e5966dba2b8769d8ed4babf4f6746f3b33319c80c24912be43284f9549fc14c02e676f2299bcb7520a8d7ce99371b0c38d6fe755d2d89b7215f310a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38662.exe

Filesize
468KB

MD5
f73c36fb2cf3074b891addc2bb0560ee

SHA1
f9986bac2f9965538e59b77e0eb3d34112e9458a

SHA256
85183f3836da84447c4577fd4a375eb5fb2f51ee920da3718d1e308497ead6d0

SHA512
2a4403650b763e93480a6aa5f47330bc6927c58bc810a3a799290b65359b1a8d263810cffb4473bf2c3155aea523e1c7de4e97d4d402dd8390594b7a9a93b0b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39710.exe

Filesize
468KB

MD5
ac9ed4c908732de70b7b92d3b9b21030

SHA1
d3291c2c340ad69f8d6bf522b04ba5a79edece8b

SHA256
74d648bba207c52b892ef3ae2db0297e32ce0bbc86d0ef865f7afa5e3b720a7a

SHA512
657a81e8253a2a6bd82256813a5424253a52d6a987b846f7820d7610872158d1d01cb84dcf51f0c0fe116f153f96fb773ec4aa8d81af5abce044d259fad53e90

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40338.exe

Filesize
468KB

MD5
50b577f7aa309bc7c6eabdcc8249800f

SHA1
1c0fe1873360641bb2cd7ef08428f439aa51df77

SHA256
dbed3d19d1f948b06c25b690b07d32679dac01f2e34b263d1a83ff2be9b798a4

SHA512
5f6f9e4ff55f7ca8ae7d830bc86bf45b712c5eb358846a8529e000c4b71e31ac04d810c72e0852b7552ec0fbf712b37c5be7dbcd97e606de343a439b33ec70e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43572.exe

Filesize
468KB

MD5
8a7181fe30616e66f5243f28e855b50d

SHA1
09ee1b952a28a76407925e1061c9d8770d6ea004

SHA256
2fc6dbbcd99d445fba9fa6ee05c05d9d3ae57f7dbe9e1a6473111cca4cd6fd2d

SHA512
2637d6b3a2d5535c4ac81eb277e7b8dbeff4d243b71c8e1b1f4e6a55a98e97ffb88fc5bb77a2642ea562bc2c8658b6ea8f3e10ed25ae1ea11e80e73d87badf96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43868.exe

Filesize
468KB

MD5
73543e6b7564c2363d472dd814c8f7f4

SHA1
4b275e52bab5db7ab219ac69e6691151691bd293

SHA256
9ad53910a0e0be86a63a93d27a01b4ae9edd74c9ad2192c1ea04fd28a88dadfa

SHA512
585801044c4da2dc85b7445daf094b629714c61fd07cbdf826f073f980d78d23cb7c0f7ab82dd69c460db19cffb84255d6d3e27d0357e04094dc5b3b952570ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45944.exe

Filesize
468KB

MD5
69678ff4511f469aeaeb9338c9eda787

SHA1
894340adb6ac6044b77136c3ab4e123ba52b5c1b

SHA256
da3667f032f517302a173b028c52c3a4902fd4ca3ec3b25a69bd00c705103d49

SHA512
4ad4e905e65929262462687db2b8a984e82bc7f8bfb2eee1580760eb4b298f601b2f4c32946d73d06104d5d4bd66a94b52dcfddc71fd60f953aeb2d221fb4a2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46831.exe

Filesize
468KB

MD5
33aa2baeb40f3349ec2c516db1a1e2b1

SHA1
8f2a24b965846236336af33a1ef530c14e519152

SHA256
8cb32ed6f232a716cdf89f828f72ddb1c28328d50564489b683634e86f5fe9af

SHA512
7fd05adff259b6d5a3544c259d09df448eb06a737310ffa6b2fa18be0d6876b3568845e55692123fed7c034b5cbfde4e3c2c24b80de09d171dea6fd44f79e06f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50360.exe

Filesize
468KB

MD5
24e2e449fdbef509326e3489d066d793

SHA1
f5cba8e0c4b62d980dae1a3750ff226bd34ddd4a

SHA256
6a65e6f5d6b8581525254ef4b89bcca929c800aacafac240c6314f2c8d6ea414

SHA512
51d6d2d219b05c2b695a0e728a87ea0d1c320159972cb1952efad9113a07d6ac8de043e102f9fd28eb9fc13de1d54f280951d3559f44b25848e78c191e1f130a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50515.exe

Filesize
468KB

MD5
af072c9161466ee8fb18772b7de8d2c5

SHA1
1d94904434084b6c8489f4ad23d79af444b2fd81

SHA256
3e9522046d2a264dde7f08126e3ab574119b10e5a7cd5b0bee57755b6f2dd947

SHA512
6c2c0ddffc85474b5529447f453ce487ce56998d32d99d1bb4f9e1b76eadcfb7e6d3716338fed83ce510ba7774995295eaed3d4d3187d9149053c43d2df8647e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57760.exe

Filesize
468KB

MD5
c0954a8a6f2a8ea35807c4e93739e0e6

SHA1
ff256af282a19d1cd1c7b697509f54c568a2c9cf

SHA256
d97be52a39360dae47f794910ba140d12d48353e512a3406e7fc3f7bad2e8347

SHA512
2563263e63101ff3aea965e8f66c1973aa1dfa6e08c0f40bf4188ed6fa4f35344fe9f77087eebc29a3c653a759a37c4b7fba3ad81bd8247938fd8ba3fe80ad1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58128.exe

Filesize
468KB

MD5
6ea8896144a277a26da01a1ca0a409fc

SHA1
68f54ca4d7dc55f8547091734ca3fafc95d5259d

SHA256
c6a8089cf34aa17cee091d72196d4f1e576c14111467c6272156a6b8f15fda9a

SHA512
cbeb3cbb3b94a1c976f9613cecb83d2920d4c7d43b5cffc4cef18a9e15019790fedcdb2d5eaee7309e89dcb25f70da1e944f84fd5849097b8586c81cd7047fdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58263.exe

Filesize
468KB

MD5
6c7ffa705404da3d7c587410129da88d

SHA1
739ab74968ea7ac6f875379fb69a8b3716380ba7

SHA256
e91d831b9aeb2e23d52bea353c3b98b33832c86f4d4809cc8bb457d1ed48dbd0

SHA512
371301a258a347b0c4cdb981468960c69f2430a4697a493339c7fc189b3e2518ba30fea05174fdde17bb0b4fa9c902db0f590fb853c9a1b70fdd743a44daa6ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exe

Filesize
468KB

MD5
a8952e1e31a74ba264564fab24edab39

SHA1
4df7a68139f62f3f05b5b7bbb256bea382d3bc90

SHA256
64ad112549beceddcf5d15d12938b89bb231767e14b44427db50eb9b592e9d5b

SHA512
793349cdf9771d62d8df55d4a481cbf2c72d22f11032c5f914a79f3ee5ac4ca06c615ed6fe79267526bfbca0ed67d4d743fb83207e0ef8b3140fec21e1347ea5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62242.exe

Filesize
468KB

MD5
c4340cd3470ee549ff14c9f867f5de51

SHA1
089619c26a2512a3880d5d6c757f39635d938190

SHA256
453bd9181214ad16f90ac318b3142f1fc1f0fae3706d6458fbfd31bb46fafe41

SHA512
001a09ad25bda1813f7bcf3f5a409bd8e87845fcdc54614ec57fe23f4cdc2d2e1999a68e435a54587c23d4d4e4ed0c745a8d7ed4c5dce6914053d28ae8f6c0ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6321.exe

Filesize
468KB

MD5
d47d1d34da4eb25453cb30627c0d9376

SHA1
f909678a28de8f621d33e5debee7b7ae1595664c

SHA256
f7fff1906bbf6d8f269a38c9aa814825a4f2e987984c63bd278871a6fbe0590c

SHA512
cadc7075becad47bc6f4812c7b20715cf07046dc9c61f3552c0968a900a260fe1ba3b67894d999eb05a7530c038a81e9109d861b8301fafad3edd9e50ffe6b17

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63660.exe

Filesize
468KB

MD5
acd6876ae58942b30e84b2e80cb6c268

SHA1
b219e6da71bd99c2d5159a83b4474ed20aa2c24a

SHA256
17dd333596cf09f43e9026b689f56dd13cb76f7072708d7f8b4184d366a8f32a

SHA512
4730d76958d8c16adf26d1042d7a699a4a3fd1dc8eba6606e389943dafc67b2245142789660a50058b455ab82a78eeed8ae0c036595b2ccf1a9461e57b38a60a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64511.exe

Filesize
468KB

MD5
5d508ac16725df89ea12d249899d41ef

SHA1
b9aa721446f3c54666d75c28e96301809e62c6bc

SHA256
b99843e65fcea60adb128ee93aac10aa6742e4e8adc9061623e6c6b64c5977a2

SHA512
831c33e5f83451358220cb7621fcda18ece5bdb9112124be169907cbe6882bd1c53e13fff7c500929c29cb7806e714b3e34e538eb39e34657c72cc56ce79657e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-946.exe

Filesize
468KB

MD5
fa0d510bcf2e614eacfce3520b897eea

SHA1
57a7fd6f9fada24949655243eccdc1da607619a8

SHA256
68f304cbb0a932860450db08f2dd960401666d51e5b7d4333af3c65394addc81

SHA512
1b686f54b39b12c226db9a09372ffd06b238c5d377463fafb1f0882a231be15bd4fd1bed878886794a290ad8a8cc7b47f9ea663ef1d404bdcb58607a6f108156

Download Submit
memory/216-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/380-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/436-463-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/444-254-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/512-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/528-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/620-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/632-76-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/664-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/744-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/800-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/824-421-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/848-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/864-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/916-127-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1044-363-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1052-469-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1056-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1072-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1132-417-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1140-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1200-423-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1212-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1264-226-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1276-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1440-99-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1488-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1576-491-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1592-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1596-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1856-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1928-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1988-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2016-44-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2132-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2172-187-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2296-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2364-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2420-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2428-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2456-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2508-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2608-504-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2656-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2844-90-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2856-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2860-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2872-517-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3036-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3208-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3216-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3236-175-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3300-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3360-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3576-263-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3876-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3976-289-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3996-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4020-220-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4024-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4068-95-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4108-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4272-190-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4280-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4288-189-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4312-253-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4324-467-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4364-139-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4388-523-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4396-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4444-33-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4484-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4528-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4564-468-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4572-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4608-271-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4668-130-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4800-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4860-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4956-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4960-522-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4968-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4984-174-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5008-276-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5012-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5088-281-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5116-419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5208-518-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5216-519-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5240-520-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5268-521-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5300-537-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5328-534-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5336-535-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5420-538-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5484-555-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14212-2865-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14240-2521-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14744-2746-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14940-2777-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15040-2776-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads