f39545f8bbeb26108f78f0bd55a37407633cce638cdfbc1410a2a4c32da67e9a

Analysis

max time kernel
119s
max time network
105s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 01:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f39545f8bbeb26108f78f0bd55a37407633cce638cdfbc1410a2a4c32da67e9aN.exe
Size

468KB
MD5

b4fba489064e2144cca583a3c67d3ee0
SHA1

daa492d9c4263f7e8ffcca96da00b8db10ebacfd
SHA256

f39545f8bbeb26108f78f0bd55a37407633cce638cdfbc1410a2a4c32da67e9a
SHA512

06df8cd31049c2b9d1792d2bd83d652028fd0626f19f5c3dde9c07c37932d7fff8c26cddffb5b6fef55ba88770c934d87f842568a13d8fa0046fb21d88439759
SSDEEP

3072:dbXIogF+P88U2oYVPzivff8/MC7AZ4pxhdHeZVXW7S0NIuJTZuYR:dbYodRU2jPevffFE0y7SsrJTZ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
552	Unicorn-30381.exe
4860	Unicorn-45005.exe
4300	Unicorn-8310.exe
2812	Unicorn-7535.exe
3792	Unicorn-5459.exe
1836	Unicorn-40976.exe
4768	Unicorn-19194.exe
4572	Unicorn-64173.exe
2148	Unicorn-12787.exe
5116	Unicorn-24026.exe
1340	Unicorn-45424.exe
3224	Unicorn-30660.exe
1972	Unicorn-30925.exe
4700	Unicorn-30925.exe
4376	Unicorn-11059.exe
4900	Unicorn-46029.exe
3868	Unicorn-9334.exe
3416	Unicorn-59952.exe
5032	Unicorn-53630.exe
2184	Unicorn-64368.exe
1916	Unicorn-64321.exe
2236	Unicorn-15084.exe
1152	Unicorn-39403.exe
2516	Unicorn-48333.exe
4308	Unicorn-37808.exe
2996	Unicorn-37808.exe
5012	Unicorn-51544.exe
4892	Unicorn-57674.exe
1832	Unicorn-37808.exe
1312	Unicorn-58349.exe
4640	Unicorn-21462.exe
4844	Unicorn-59309.exe
1040	Unicorn-20698.exe
3468	Unicorn-63917.exe
5008	Unicorn-46631.exe
4324	Unicorn-46896.exe
1392	Unicorn-26838.exe
1160	Unicorn-44400.exe
1416	Unicorn-27056.exe
708	Unicorn-29901.exe
1852	Unicorn-60462.exe
3004	Unicorn-17814.exe
2120	Unicorn-17814.exe
4508	Unicorn-39984.exe
2080	Unicorn-39792.exe
4736	Unicorn-5427.exe
1788	Unicorn-45462.exe
1048	Unicorn-55277.exe
4240	Unicorn-17050.exe
3204	Unicorn-6159.exe
4260	Unicorn-41659.exe
4404	Unicorn-15500.exe
4924	Unicorn-64016.exe
5100	Unicorn-33098.exe
4624	Unicorn-31079.exe
2564	Unicorn-25213.exe
2892	Unicorn-11478.exe
4304	Unicorn-28464.exe
632	Unicorn-8624.exe
1628	Unicorn-28490.exe
4980	Unicorn-11660.exe
3188	Unicorn-19370.exe
1320	Unicorn-19370.exe
2952	Unicorn-3858.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
13092	12424	WerFault.exe	618
15188	12924	WerFault.exe	625
13908	9996	WerFault.exe	475

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50707.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46274.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8310.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19370.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37709.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31193.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57700.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55345.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41849.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50538.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35143.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51054.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1149.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45985.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57953.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43224.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1545.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45171.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32746.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15604.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28375.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6793.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3079.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42721.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6354.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26639.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38993.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30858.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	4220	dwm.exe
Token: SeChangeNotifyPrivilege	4220	dwm.exe
Token: 33	4220	dwm.exe
Token: SeIncBasePriorityPrivilege	4220	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3660	f39545f8bbeb26108f78f0bd55a37407633cce638cdfbc1410a2a4c32da67e9aN.exe
552	Unicorn-30381.exe
4300	Unicorn-8310.exe
4860	Unicorn-45005.exe
2812	Unicorn-7535.exe
3792	Unicorn-5459.exe
4768	Unicorn-19194.exe
1836	Unicorn-40976.exe
4572	Unicorn-64173.exe
2148	Unicorn-12787.exe
5116	Unicorn-24026.exe
1340	Unicorn-45424.exe
4700	Unicorn-30925.exe
4376	Unicorn-11059.exe
1972	Unicorn-30925.exe
3224	Unicorn-30660.exe
4900	Unicorn-46029.exe
3868	Unicorn-9334.exe
5032	Unicorn-53630.exe
3416	Unicorn-59952.exe
2184	Unicorn-64368.exe
1916	Unicorn-64321.exe
1152	Unicorn-39403.exe
2236	Unicorn-15084.exe
4308	Unicorn-37808.exe
2996	Unicorn-37808.exe
5012	Unicorn-51544.exe
1832	Unicorn-37808.exe
4892	Unicorn-57674.exe
2516	Unicorn-48333.exe
1312	Unicorn-58349.exe
4640	Unicorn-21462.exe
4844	Unicorn-59309.exe
1040	Unicorn-20698.exe
3468	Unicorn-63917.exe
5008	Unicorn-46631.exe
1160	Unicorn-44400.exe
4324	Unicorn-46896.exe
1392	Unicorn-26838.exe
1416	Unicorn-27056.exe
3004	Unicorn-17814.exe
708	Unicorn-29901.exe
1852	Unicorn-60462.exe
2120	Unicorn-17814.exe
4508	Unicorn-39984.exe
2080	Unicorn-39792.exe
4736	Unicorn-5427.exe
1048	Unicorn-55277.exe
4240	Unicorn-17050.exe
1788	Unicorn-45462.exe
3204	Unicorn-6159.exe
4260	Unicorn-41659.exe
5100	Unicorn-33098.exe
2892	Unicorn-11478.exe
4404	Unicorn-15500.exe
4624	Unicorn-31079.exe
2564	Unicorn-25213.exe
4924	Unicorn-64016.exe
4304	Unicorn-28464.exe
632	Unicorn-8624.exe
1628	Unicorn-28490.exe
4980	Unicorn-11660.exe
3188	Unicorn-19370.exe
1320	Unicorn-19370.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 552	3660	f39545f8bbeb26108f78f0bd55a37407633cce638cdfbc1410a2a4c32da67e9aN.exe	82
PID 3660 wrote to memory of 552	3660	f39545f8bbeb26108f78f0bd55a37407633cce638cdfbc1410a2a4c32da67e9aN.exe	82
PID 3660 wrote to memory of 552	3660	f39545f8bbeb26108f78f0bd55a37407633cce638cdfbc1410a2a4c32da67e9aN.exe	82
PID 552 wrote to memory of 4860	552	Unicorn-30381.exe	83
PID 552 wrote to memory of 4860	552	Unicorn-30381.exe	83
PID 552 wrote to memory of 4860	552	Unicorn-30381.exe	83
PID 3660 wrote to memory of 4300	3660	f39545f8bbeb26108f78f0bd55a37407633cce638cdfbc1410a2a4c32da67e9aN.exe	84
PID 3660 wrote to memory of 4300	3660	f39545f8bbeb26108f78f0bd55a37407633cce638cdfbc1410a2a4c32da67e9aN.exe	84
PID 3660 wrote to memory of 4300	3660	f39545f8bbeb26108f78f0bd55a37407633cce638cdfbc1410a2a4c32da67e9aN.exe	84
PID 4860 wrote to memory of 2812	4860	Unicorn-45005.exe	85
PID 4860 wrote to memory of 2812	4860	Unicorn-45005.exe	85
PID 4860 wrote to memory of 2812	4860	Unicorn-45005.exe	85
PID 552 wrote to memory of 3792	552	Unicorn-30381.exe	86
PID 552 wrote to memory of 3792	552	Unicorn-30381.exe	86
PID 552 wrote to memory of 3792	552	Unicorn-30381.exe	86
PID 4300 wrote to memory of 1836	4300	Unicorn-8310.exe	87
PID 4300 wrote to memory of 1836	4300	Unicorn-8310.exe	87
PID 4300 wrote to memory of 1836	4300	Unicorn-8310.exe	87
PID 3660 wrote to memory of 4768	3660	f39545f8bbeb26108f78f0bd55a37407633cce638cdfbc1410a2a4c32da67e9aN.exe	88
PID 3660 wrote to memory of 4768	3660	f39545f8bbeb26108f78f0bd55a37407633cce638cdfbc1410a2a4c32da67e9aN.exe	88
PID 3660 wrote to memory of 4768	3660	f39545f8bbeb26108f78f0bd55a37407633cce638cdfbc1410a2a4c32da67e9aN.exe	88
PID 2812 wrote to memory of 4572	2812	Unicorn-7535.exe	89
PID 2812 wrote to memory of 4572	2812	Unicorn-7535.exe	89
PID 2812 wrote to memory of 4572	2812	Unicorn-7535.exe	89
PID 4860 wrote to memory of 2148	4860	Unicorn-45005.exe	90
PID 4860 wrote to memory of 2148	4860	Unicorn-45005.exe	90
PID 4860 wrote to memory of 2148	4860	Unicorn-45005.exe	90
PID 552 wrote to memory of 5116	552	Unicorn-30381.exe	91
PID 552 wrote to memory of 5116	552	Unicorn-30381.exe	91
PID 552 wrote to memory of 5116	552	Unicorn-30381.exe	91
PID 3792 wrote to memory of 1340	3792	Unicorn-5459.exe	92
PID 3792 wrote to memory of 1340	3792	Unicorn-5459.exe	92
PID 3792 wrote to memory of 1340	3792	Unicorn-5459.exe	92
PID 3660 wrote to memory of 3224	3660	f39545f8bbeb26108f78f0bd55a37407633cce638cdfbc1410a2a4c32da67e9aN.exe	93
PID 3660 wrote to memory of 3224	3660	f39545f8bbeb26108f78f0bd55a37407633cce638cdfbc1410a2a4c32da67e9aN.exe	93
PID 3660 wrote to memory of 3224	3660	f39545f8bbeb26108f78f0bd55a37407633cce638cdfbc1410a2a4c32da67e9aN.exe	93
PID 1836 wrote to memory of 4700	1836	Unicorn-40976.exe	94
PID 1836 wrote to memory of 4700	1836	Unicorn-40976.exe	94
PID 1836 wrote to memory of 4700	1836	Unicorn-40976.exe	94
PID 4768 wrote to memory of 1972	4768	Unicorn-19194.exe	95
PID 4768 wrote to memory of 1972	4768	Unicorn-19194.exe	95
PID 4768 wrote to memory of 1972	4768	Unicorn-19194.exe	95
PID 4300 wrote to memory of 4376	4300	Unicorn-8310.exe	96
PID 4300 wrote to memory of 4376	4300	Unicorn-8310.exe	96
PID 4300 wrote to memory of 4376	4300	Unicorn-8310.exe	96
PID 4572 wrote to memory of 4900	4572	Unicorn-64173.exe	101
PID 4572 wrote to memory of 4900	4572	Unicorn-64173.exe	101
PID 4572 wrote to memory of 4900	4572	Unicorn-64173.exe	101
PID 2812 wrote to memory of 3868	2812	Unicorn-7535.exe	102
PID 2812 wrote to memory of 3868	2812	Unicorn-7535.exe	102
PID 2812 wrote to memory of 3868	2812	Unicorn-7535.exe	102
PID 2148 wrote to memory of 3416	2148	Unicorn-12787.exe	103
PID 2148 wrote to memory of 3416	2148	Unicorn-12787.exe	103
PID 2148 wrote to memory of 3416	2148	Unicorn-12787.exe	103
PID 4860 wrote to memory of 5032	4860	Unicorn-45005.exe	104
PID 4860 wrote to memory of 5032	4860	Unicorn-45005.exe	104
PID 4860 wrote to memory of 5032	4860	Unicorn-45005.exe	104
PID 5116 wrote to memory of 2184	5116	Unicorn-24026.exe	105
PID 5116 wrote to memory of 2184	5116	Unicorn-24026.exe	105
PID 5116 wrote to memory of 2184	5116	Unicorn-24026.exe	105
PID 552 wrote to memory of 1916	552	Unicorn-30381.exe	106
PID 552 wrote to memory of 1916	552	Unicorn-30381.exe	106
PID 552 wrote to memory of 1916	552	Unicorn-30381.exe	106
PID 3224 wrote to memory of 2236	3224	Unicorn-30660.exe	107

C:\Users\Admin\AppData\Local\Temp\Unicorn-35704.exe
C:\Users\Admin\AppData\Local\Temp\Unicorn-35704.exe
1⤵
PID:12152

C:\Users\Admin\AppData\Local\Temp\f39545f8bbeb26108f78f0bd55a37407633cce638cdfbc1410a2a4c32da67e9aN.exe
"C:\Users\Admin\AppData\Local\Temp\f39545f8bbeb26108f78f0bd55a37407633cce638cdfbc1410a2a4c32da67e9aN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30381.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30381.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45005.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45005.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7535.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64173.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46029.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58349.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28464.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2281.exe
        9⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45171.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:5304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-688.exe
        11⤵
        
        PID:1240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45155.exe
        11⤵
        
        PID:9576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49745.exe
        10⤵
        
        PID:11608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38873.exe
        9⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43033.exe
        10⤵
        
        PID:14996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1456.exe
        10⤵
        
        PID:14680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1088.exe
        9⤵
        
        PID:11692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47953.exe
        8⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45171.exe
        9⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8233.exe
        10⤵
        
        PID:13544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31639.exe
        10⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12855.exe
        9⤵
        
        PID:12488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45155.exe
        9⤵
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52609.exe
        8⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58837.exe
        9⤵
        
        PID:1572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26497.exe
        8⤵
        
        PID:11624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10412.exe
        8⤵
        
        PID:15528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8624.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19251.exe
        8⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
        9⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
        10⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17952.exe
        11⤵
        
        PID:16328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58074.exe
        10⤵
        
        PID:12220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52074.exe
        9⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33088.exe
        9⤵
        
        PID:16336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4848.exe
        8⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1545.exe
        9⤵
        
        PID:9672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35489.exe
        8⤵
        
        PID:9860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64032.exe
        8⤵
        
        PID:9100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41144.exe
        7⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33555.exe
        8⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52737.exe
        9⤵
        
        PID:15560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15040.exe
        8⤵
        
        PID:13300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46463.exe
        8⤵
        
        PID:14732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25679.exe
        8⤵
        
        PID:15544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34209.exe
        7⤵
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21171.exe
        8⤵
        
        PID:12924
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12924 -s 472
        9⤵
        Program crash
        
        PID:15188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16462.exe
        8⤵
        
        PID:15244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63304.exe
        7⤵
        
        PID:11688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27575.exe
        7⤵
        
        PID:8060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21462.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47953.exe
        7⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43795.exe
        8⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39850.exe
        9⤵
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61585.exe
        9⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1552.exe
        8⤵
        
        PID:9772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe
        8⤵
        
        PID:13260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53057.exe
        7⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3346.exe
        8⤵
        
        PID:10992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57594.exe
        9⤵
        
        PID:11308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45155.exe
        8⤵
        
        PID:10592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33092.exe
        7⤵
        
        PID:10448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45139.exe
        7⤵
        
        PID:14832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61923.exe
        7⤵
        
        PID:11280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30784.exe
        6⤵
        
        PID:2312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9074.exe
        7⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30858.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14112.exe
        9⤵
        
        PID:10312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31063.exe
        10⤵
        
        PID:3728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44020.exe
        9⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14297.exe
        8⤵
        
        PID:9932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28083.exe
        9⤵
        
        PID:12812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22295.exe
        8⤵
        
        PID:12088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45155.exe
        8⤵
        
        PID:10676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39321.exe
        7⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29619.exe
        8⤵
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15648.exe
        8⤵
        
        PID:11016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31808.exe
        7⤵
        
        PID:10852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-319.exe
        7⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27575.exe
        7⤵
        
        PID:8056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1129.exe
        6⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1545.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9812.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57256.exe
        6⤵
        
        PID:8568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21849.exe
        6⤵
        
        PID:13744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35200.exe
        6⤵
        
        PID:15764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9334.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59309.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28490.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38026.exe
        8⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
        9⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55434.exe
        10⤵
        
        PID:9604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10096.exe
        10⤵
        
        PID:11920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3488.exe
        10⤵
        
        PID:13868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53489.exe
        10⤵
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16180.exe
        10⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28464.exe
        9⤵
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19638.exe
        10⤵
        
        PID:14408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38970.exe
        9⤵
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46353.exe
        8⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1545.exe
        9⤵
        
        PID:10252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35489.exe
        8⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35143.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:14164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40855.exe
        9⤵
        
        PID:16296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35200.exe
        8⤵
        
        PID:15848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56500.exe
        7⤵
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59441.exe
        8⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28134.exe
        9⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11959.exe
        8⤵
        
        PID:10332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40939.exe
        8⤵
        
        PID:15040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24122.exe
        8⤵
        
        PID:13764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5335.exe
        7⤵
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8457.exe
        7⤵
        
        PID:9972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46819.exe
        7⤵
        
        PID:15444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17049.exe
        6⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11570.exe
        7⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62954.exe
        8⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
        9⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29296.exe
        9⤵
        
        PID:11712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14618.exe
        9⤵
        
        PID:15576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60104.exe
        8⤵
        
        PID:12252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2754.exe
        8⤵
        
        PID:14944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34833.exe
        8⤵
        
        PID:14780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39321.exe
        7⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38058.exe
        8⤵
        
        PID:10452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51054.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21751.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10772.exe
        7⤵
        
        PID:3668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24864.exe
        6⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
        7⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56753.exe
        8⤵
        
        PID:3988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64888.exe
        8⤵
        
        PID:9516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4304.exe
        7⤵
        
        PID:15292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29264.exe
        6⤵
        
        PID:10064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4496.exe
        6⤵
        
        PID:13492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20698.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19370.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19251.exe
        7⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
        8⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55091.exe
        9⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61331.exe
        10⤵
        
        PID:12976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64753.exe
        10⤵
        
        PID:13348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29722.exe
        10⤵
        
        PID:11304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        9⤵
        
        PID:12416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17184.exe
        9⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36336.exe
        8⤵
        
        PID:9548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2752.exe
        8⤵
        
        PID:14328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61767.exe
        8⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46353.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52595.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-345.exe
        8⤵
        
        PID:12464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62977.exe
        8⤵
        
        PID:14688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64696.exe
        8⤵
        
        PID:15640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54596.exe
        7⤵
        
        PID:10356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48355.exe
        7⤵
        
        PID:8428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27408.exe
        6⤵
        
        PID:5272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56746.exe
        7⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23347.exe
        8⤵
        
        PID:12044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33220.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60378.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17760.exe
        7⤵
        
        PID:7396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32183.exe
        6⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37726.exe
        7⤵
        
        PID:14996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1738.exe
        7⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29722.exe
        7⤵
        
        PID:9372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51850.exe
        6⤵
        
        PID:14192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55855.exe
        6⤵
        
        PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58378.exe
        5⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61747.exe
        6⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45363.exe
        7⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21747.exe
        8⤵
        
        PID:13796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16224.exe
        8⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13801.exe
        7⤵
        
        PID:13664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15747.exe
        7⤵
        
        PID:15492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9107.exe
        6⤵
        
        PID:8244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53496.exe
        6⤵
        
        PID:12228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57288.exe
        5⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2834.exe
        6⤵
        
        PID:9404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10412.exe
        6⤵
        
        PID:15368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52081.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15604.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52771.exe
        5⤵
        
        PID:15084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47859.exe
        5⤵
        
        PID:15840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59952.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46896.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46609.exe
        7⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12425.exe
        8⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15017.exe
        9⤵
        
        PID:11316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2685.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8016.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54895.exe
        8⤵
        
        PID:10740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54168.exe
        7⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3474.exe
        8⤵
        
        PID:12716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22121.exe
        7⤵
        
        PID:11764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50298.exe
        6⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35603.exe
        7⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59530.exe
        8⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22256.exe
        8⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44714.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27174.exe
        8⤵
        
        PID:10244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63009.exe
        7⤵
        
        PID:9492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17998.exe
        8⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8617.exe
        7⤵
        
        PID:14284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9623.exe
        6⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51178.exe
        7⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45843.exe
        8⤵
        
        PID:12016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43793.exe
        7⤵
        
        PID:12072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15555.exe
        7⤵
        
        PID:15536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-384.exe
        6⤵
        
        PID:8508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38385.exe
        6⤵
        
        PID:13736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26639.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26838.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3858.exe
        6⤵
        Executes dropped EXE
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25738.exe
        7⤵
        
        PID:224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29081.exe
        8⤵
        
        PID:8348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-567.exe
        8⤵
        
        PID:12872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        8⤵
        
        PID:4992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10412.exe
        8⤵
        
        PID:15452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14608.exe
        7⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63582.exe
        7⤵
        
        PID:13484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20256.exe
        7⤵
        
        PID:15700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33145.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14866.exe
        7⤵
        
        PID:10704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23734.exe
        7⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54371.exe
        7⤵
        
        PID:15168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42200.exe
        6⤵
        
        PID:1568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60231.exe
        6⤵
        
        PID:12148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37392.exe
        6⤵
        
        PID:13868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58927.exe
        6⤵
        
        PID:15708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6135.exe
        5⤵
        
        PID:2436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62541.exe
        6⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34538.exe
        7⤵
        
        PID:7388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60373.exe
        8⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2713.exe
        7⤵
        
        PID:11732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50193.exe
        7⤵
        
        PID:15096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36953.exe
        7⤵
        
        PID:14368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15456.exe
        7⤵
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54001.exe
        6⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23347.exe
        7⤵
        
        PID:11868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50241.exe
        7⤵
        
        PID:10608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8029.exe
        6⤵
        
        PID:13244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-416.exe
        5⤵
        
        PID:6972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21994.exe
        6⤵
        
        PID:9412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3474.exe
        7⤵
        
        PID:12724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33438.exe
        7⤵
        
        PID:9592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36810.exe
        6⤵
        
        PID:14760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21071.exe
        6⤵
        
        PID:11076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3079.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17053.exe
        5⤵
        
        PID:6500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53630.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63917.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11660.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39443.exe
        7⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16915.exe
        8⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54163.exe
        9⤵
        
        PID:14904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49620.exe
        9⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49745.exe
        8⤵
        
        PID:11616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12483.exe
        8⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30544.exe
        7⤵
        
        PID:8360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18903.exe
        7⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11907.exe
        7⤵
        
        PID:8612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51729.exe
        6⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32019.exe
        7⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48367.exe
        8⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40321.exe
        6⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64696.exe
        7⤵
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47050.exe
        6⤵
        
        PID:13716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44387.exe
        6⤵
        
        PID:8940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16857.exe
        5⤵
        
        PID:4880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32531.exe
        6⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32019.exe
        7⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3049.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59258.exe
        6⤵
        
        PID:8424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-567.exe
        6⤵
        
        PID:11776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37086.exe
        6⤵
        
        PID:15508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28375.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15122.exe
        6⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19443.exe
        7⤵
        
        PID:13360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49847.exe
        6⤵
        
        PID:12592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37162.exe
        5⤵
        
        PID:10028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12583.exe
        5⤵
        
        PID:7352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46631.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46609.exe
        5⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15154.exe
        6⤵
        
        PID:7144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6793.exe
        7⤵
        
        PID:8840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64120.exe
        8⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53905.exe
        7⤵
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15412.exe
        7⤵
        
        PID:12376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62872.exe
        6⤵
        
        PID:10268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10554.exe
        6⤵
        
        PID:8472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51329.exe
        5⤵
        
        PID:7764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13391.exe
        6⤵
        
        PID:13096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63752.exe
        5⤵
        
        PID:11856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64032.exe
        5⤵
        
        PID:1984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59697.exe
      4⤵
      PID:3536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39443.exe
        5⤵
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17488.exe
        6⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16154.exe
        7⤵
        
        PID:16352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45985.exe
        6⤵
        
        PID:14168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26777.exe
        5⤵
        
        PID:8556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48305.exe
        6⤵
        
        PID:12500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42721.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47664.exe
      4⤵
      PID:6512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53898.exe
        5⤵
        
        PID:9864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        5⤵
        
        PID:13408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39930.exe
      4⤵
      PID:8520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35993.exe
      4⤵
      PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13631.exe
      4⤵
      PID:9392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5459.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5459.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45424.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17814.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3090.exe
        6⤵
        
        PID:3396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47274.exe
        7⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28586.exe
        8⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43033.exe
        9⤵
        
        PID:15004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61191.exe
        9⤵
        
        PID:15736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe
        8⤵
        
        PID:11972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53082.exe
        8⤵
        
        PID:3164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61767.exe
        8⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23056.exe
        7⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54864.exe
        8⤵
        
        PID:13872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-567.exe
        7⤵
        
        PID:12808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5804.exe
        7⤵
        
        PID:1624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43280.exe
        6⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32746.exe
        7⤵
        
        PID:4352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35489.exe
        6⤵
        
        PID:10196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52413.exe
        6⤵
        
        PID:15392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43224.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43795.exe
        6⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22954.exe
        7⤵
        
        PID:9624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31831.exe
        8⤵
        
        PID:9384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41356.exe
        7⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57873.exe
        6⤵
        
        PID:10096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe
        6⤵
        
        PID:15120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58922.exe
        5⤵
        
        PID:7720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10217.exe
        6⤵
        
        PID:10880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39201.exe
        7⤵
        
        PID:13380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63928.exe
        7⤵
        
        PID:8988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47937.exe
        6⤵
        
        PID:7692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65329.exe
        5⤵
        
        PID:10036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7607.exe
        6⤵
        
        PID:6580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51368.exe
        5⤵
        
        PID:9804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31360.exe
        5⤵
        
        PID:15404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37808.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55277.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46282.exe
        6⤵
        
        PID:3880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56371.exe
        7⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32019.exe
        8⤵
        
        PID:3500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64888.exe
        9⤵
        
        PID:9348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45556.exe
        8⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21888.exe
        7⤵
        
        PID:10212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29697.exe
        7⤵
        
        PID:14300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11715.exe
        7⤵
        
        PID:8876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46145.exe
        6⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28659.exe
        7⤵
        
        PID:13180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32907.exe
        7⤵
        
        PID:14424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17824.exe
        6⤵
        
        PID:10388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62856.exe
        6⤵
        
        PID:14932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2754.exe
        6⤵
        
        PID:14908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22000.exe
        5⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50707.exe
        6⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
        7⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55777.exe
        7⤵
        
        PID:13164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26598.exe
        7⤵
        
        PID:8636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52074.exe
        6⤵
        
        PID:10524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53802.exe
        7⤵
        
        PID:14576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49341.exe
        6⤵
        
        PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24037.exe
        5⤵
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51338.exe
        6⤵
        
        PID:10848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62131.exe
        7⤵
        
        PID:14912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16224.exe
        7⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15497.exe
        6⤵
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19369.exe
        6⤵
        
        PID:6844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50538.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9996
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9996 -s 492
        6⤵
        Program crash
        
        PID:13908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35392.exe
        5⤵
        
        PID:15620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17050.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46282.exe
        5⤵
        
        PID:3840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61773.exe
        6⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60874.exe
        7⤵
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10217.exe
        8⤵
        
        PID:11216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47937.exe
        8⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe
        7⤵
        
        PID:11940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41932.exe
        8⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55345.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-567.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34058.exe
        5⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42402.exe
        6⤵
        
        PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35376.exe
        5⤵
        
        PID:12092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
        5⤵
        
        PID:9840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23620.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23620.exe
      4⤵
      PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12368.exe
        5⤵
        
        PID:6348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27187.exe
        6⤵
        
        PID:11504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-381.exe
        6⤵
        
        PID:8864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23168.exe
        5⤵
        
        PID:11372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2535.exe
      4⤵
      PID:7844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2416.exe
      4⤵
      PID:11184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32592.exe
      4⤵
      PID:15692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64368.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44400.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19370.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19251.exe
        7⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1257.exe
        8⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24042.exe
        9⤵
        
        PID:10896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27315.exe
        8⤵
        
        PID:10820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18390.exe
        8⤵
        
        PID:13092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10988.exe
        8⤵
        
        PID:15812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57137.exe
        7⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10409.exe
        8⤵
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2592.exe
        7⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15886.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12858.exe
        7⤵
        
        PID:15772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54746.exe
        6⤵
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15154.exe
        7⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52787.exe
        8⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28083.exe
        9⤵
        
        PID:12748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30753.exe
        9⤵
        
        PID:3568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20980.exe
        9⤵
        
        PID:15788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56001.exe
        8⤵
        
        PID:14880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43329.exe
        7⤵
        
        PID:9964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11348.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5335.exe
        6⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        7⤵
        
        PID:11472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1149.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13674.exe
        6⤵
        
        PID:11896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        5⤵
        
        PID:4732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46867.exe
        6⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10441.exe
        7⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65114.exe
        7⤵
        
        PID:12424
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12424 -s 464
        8⤵
        Program crash
        
        PID:13092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64888.exe
        7⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14297.exe
        6⤵
        
        PID:9940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe
        6⤵
        
        PID:14308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41656.exe
        5⤵
        
        PID:7868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11177.exe
        6⤵
        
        PID:7272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53575.exe
        6⤵
        
        PID:14356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33767.exe
        5⤵
        
        PID:11836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24816.exe
        5⤵
        
        PID:15152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47613.exe
        5⤵
        
        PID:8660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27056.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37709.exe
        5⤵
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56179.exe
        6⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
        7⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16948.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8250.exe
        7⤵
        
        PID:16256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32064.exe
        6⤵
        
        PID:10072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29697.exe
        6⤵
        
        PID:14248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26999.exe
        6⤵
        
        PID:7864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65496.exe
        5⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28659.exe
        6⤵
        
        PID:12040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48577.exe
        5⤵
        
        PID:11380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64273.exe
        5⤵
        
        PID:14748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9018.exe
        5⤵
        
        PID:7200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43018.exe
      4⤵
      PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65450.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20458.exe
        6⤵
        
        PID:9976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23066.exe
        7⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10096.exe
        6⤵
        
        PID:13348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19635.exe
        5⤵
        
        PID:10836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51601.exe
      4⤵
      PID:7972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3474.exe
        5⤵
        
        PID:12732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15386.exe
        5⤵
        
        PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7891.exe
      4⤵
      PID:10656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37726.exe
        5⤵
        
        PID:15060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32689.exe
        5⤵
        
        PID:16368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64740.exe
      4⤵
      PID:15232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64321.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64321.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29901.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37709.exe
        5⤵
        
        PID:4688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8841.exe
        6⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32019.exe
        7⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59096.exe
        7⤵
        
        PID:15568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59258.exe
        6⤵
        
        PID:8476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46753.exe
        6⤵
        
        PID:12496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54682.exe
        5⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6793.exe
        6⤵
        
        PID:8800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21616.exe
        6⤵
        
        PID:12820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-695.exe
        6⤵
        
        PID:6880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47576.exe
        5⤵
        
        PID:9748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29697.exe
        5⤵
        
        PID:11808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5612.exe
        5⤵
        
        PID:8408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41849.exe
      4⤵
      PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46314.exe
        5⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57363.exe
        7⤵
        
        PID:11176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50433.exe
        8⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44561.exe
        6⤵
        
        PID:12204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2268.exe
        6⤵
        
        PID:14360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25257.exe
        6⤵
        
        PID:11200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36761.exe
        5⤵
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32670.exe
        6⤵
        
        PID:15892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-567.exe
        5⤵
        
        PID:12792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1149.exe
        5⤵
        
        PID:6432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60088.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60088.exe
      4⤵
      PID:6988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14866.exe
        5⤵
        
        PID:10712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16372.exe
        6⤵
        
        PID:8796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23734.exe
        5⤵
        
        PID:14428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7936.exe
        5⤵
        
        PID:11708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16953.exe
        5⤵
        
        PID:14392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11744.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11744.exe
      4⤵
      PID:9396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63128.exe
      4⤵
      PID:15628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60462.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60462.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35379.exe
      4⤵
      PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14217.exe
        5⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58739.exe
        6⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48986.exe
        7⤵
        
        PID:14432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6896.exe
        6⤵
        
        PID:11632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38750.exe
        6⤵
        
        PID:15052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52737.exe
        6⤵
        
        PID:15412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50737.exe
        5⤵
        
        PID:8712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50387.exe
        6⤵
        
        PID:11876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58289.exe
        6⤵
        
        PID:532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64696.exe
        6⤵
        
        PID:6984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45985.exe
        5⤵
        
        PID:14156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32452.exe
        5⤵
        
        PID:6436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58818.exe
      4⤵
      PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22506.exe
        5⤵
        
        PID:10868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25783.exe
      4⤵
      PID:10776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17230.exe
        5⤵
        
        PID:16360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33177.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33177.exe
    3⤵
    PID:3608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22393.exe
      4⤵
      PID:6884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27187.exe
        5⤵
        
        PID:11440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16512.exe
      4⤵
      PID:10188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57953.exe
      4⤵
      PID:14764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57818.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57818.exe
    3⤵
    PID:7016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22186.exe
      4⤵
      PID:9304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54554.exe
      4⤵
      PID:14320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47615.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47615.exe
    3⤵
    PID:9400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12634.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12634.exe
    3⤵
    PID:4472
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8310.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8310.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40976.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40976.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30925.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48333.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64016.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30003.exe
        7⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
        8⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50602.exe
        9⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21171.exe
        10⤵
        
        PID:12992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16224.exe
        10⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5168.exe
        9⤵
        
        PID:12328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64634.exe
        8⤵
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23066.exe
        9⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45985.exe
        8⤵
        
        PID:14184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16224.exe
        8⤵
        
        PID:10684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46353.exe
        7⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52595.exe
        8⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60230.exe
        9⤵
        
        PID:4200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52369.exe
        8⤵
        
        PID:12292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37278.exe
        8⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15287.exe
        7⤵
        
        PID:9904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29697.exe
        7⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48705.exe
        7⤵
        
        PID:9336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21808.exe
        6⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43795.exe
        7⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55242.exe
        8⤵
        
        PID:9480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30871.exe
        9⤵
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64112.exe
        8⤵
        
        PID:8680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38521.exe
        7⤵
        
        PID:10132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe
        7⤵
        
        PID:15112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6354.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43370.exe
        6⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21171.exe
        7⤵
        
        PID:12900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48705.exe
        7⤵
        
        PID:8772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13456.exe
        6⤵
        
        PID:11780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2335.exe
        6⤵
        
        PID:15428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11478.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8425.exe
        6⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12850.exe
        7⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32746.exe
        8⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48311.exe
        8⤵
        
        PID:13816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48305.exe
        8⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64888.exe
        8⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16793.exe
        7⤵
        
        PID:9532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2752.exe
        7⤵
        
        PID:14272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50433.exe
        7⤵
        
        PID:6616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37593.exe
        6⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe
        7⤵
        
        PID:11912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32478.exe
        7⤵
        
        PID:3092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2592.exe
        6⤵
        
        PID:11220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25271.exe
        6⤵
        
        PID:16272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33239.exe
        5⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33738.exe
        6⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6793.exe
        7⤵
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42872.exe
        7⤵
        
        PID:14952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56623.exe
        7⤵
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33840.exe
        6⤵
        
        PID:10180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe
        6⤵
        
        PID:13288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28705.exe
        6⤵
        
        PID:15168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16224.exe
        6⤵
        
        PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11200.exe
        5⤵
        
        PID:7816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15164.exe
        5⤵
        
        PID:7788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53584.exe
        6⤵
        
        PID:14524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52015.exe
        6⤵
        
        PID:15684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54778.exe
        5⤵
        
        PID:10092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
        5⤵
        
        PID:10148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37808.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33098.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54803.exe
        6⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11721.exe
        7⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28394.exe
        8⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65194.exe
        9⤵
        
        PID:12004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe
        8⤵
        
        PID:11956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9385.exe
        8⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22864.exe
        7⤵
        
        PID:9084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-567.exe
        7⤵
        
        PID:12864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32394.exe
        7⤵
        
        PID:15172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50842.exe
        6⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14112.exe
        7⤵
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59096.exe
        7⤵
        
        PID:11012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28032.exe
        6⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33561.exe
        7⤵
        
        PID:14604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33483.exe
        7⤵
        
        PID:8264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29697.exe
        6⤵
        
        PID:14264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58591.exe
        5⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14217.exe
        6⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64883.exe
        7⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58069.exe
        8⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24441.exe
        7⤵
        
        PID:12164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61959.exe
        7⤵
        
        PID:8860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26585.exe
        6⤵
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
        7⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41185.exe
        6⤵
        
        PID:13752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31769.exe
        6⤵
        
        PID:14724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7016.exe
        5⤵
        
        PID:404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3602.exe
        6⤵
        
        PID:9520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21263.exe
        6⤵
        
        PID:7320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23658.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32896.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25213.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63736.exe
        5⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
        6⤵
        
        PID:2596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58089.exe
        7⤵
        
        PID:8116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22528.exe
        6⤵
        
        PID:13524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56362.exe
        5⤵
        
        PID:9132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7751.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15517.exe
        5⤵
        
        PID:8980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39105.exe
      4⤵
      PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57715.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23498.exe
        6⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36472.exe
        7⤵
        
        PID:12324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1149.exe
        7⤵
        
        PID:10632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48289.exe
        6⤵
        
        PID:13276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39306.exe
        6⤵
        
        PID:14560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54127.exe
        6⤵
        
        PID:16288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31193.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61191.exe
        6⤵
        
        PID:432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45985.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26406.exe
        5⤵
        
        PID:16280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21237.exe
      4⤵
      PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28749.exe
        5⤵
        
        PID:11520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44880.exe
      4⤵
      PID:9900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61040.exe
      4⤵
      PID:9924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11059.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11059.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17814.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30329.exe
        5⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36266.exe
        6⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28659.exe
        7⤵
        
        PID:12064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52413.exe
        6⤵
        
        PID:9380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11223.exe
        5⤵
        
        PID:8324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21171.exe
        6⤵
        
        PID:12908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12793.exe
        6⤵
        
        PID:15196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40900.exe
        6⤵
        
        PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24769.exe
        5⤵
        
        PID:12304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20800.exe
      4⤵
      PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61773.exe
        5⤵
        
        PID:5996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
        6⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61290.exe
        7⤵
        
        PID:12116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31153.exe
        7⤵
        
        PID:7248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51608.exe
        5⤵
        
        PID:10108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25896.exe
        6⤵
        
        PID:8484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29697.exe
        5⤵
        
        PID:12480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4905.exe
      4⤵
      PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36211.exe
        5⤵
        
        PID:11120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21258.exe
        6⤵
        
        PID:15284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49073.exe
        6⤵
        
        PID:14780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20212.exe
        6⤵
        
        PID:7452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26752.exe
        5⤵
        
        PID:14400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13993.exe
        5⤵
        
        PID:15828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41873.exe
      4⤵
      PID:9800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9911.exe
        5⤵
        
        PID:6396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46600.exe
      4⤵
      PID:8632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51544.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51544.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27376.exe
      4⤵
      PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42474.exe
        5⤵
        
        PID:5340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60874.exe
        6⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42890.exe
        7⤵
        
        PID:12340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33591.exe
        7⤵
        
        PID:15304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17184.exe
        7⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe
        6⤵
        
        PID:11964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19369.exe
        6⤵
        
        PID:6260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55345.exe
        5⤵
        
        PID:9032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9783.exe
        5⤵
        
        PID:13140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4050.exe
        5⤵
        
        PID:6540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44552.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22605.exe
        5⤵
        
        PID:11880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18841.exe
      4⤵
      PID:12108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47176.exe
      4⤵
      PID:7612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31079.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31079.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35664.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35664.exe
      4⤵
      PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35498.exe
        5⤵
        
        PID:7188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65194.exe
        6⤵
        
        PID:11988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65204.exe
        5⤵
        
        PID:11636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51157.exe
        6⤵
        
        PID:9544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27366.exe
        5⤵
        
        PID:7464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43704.exe
      4⤵
      PID:8280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65002.exe
        5⤵
        
        PID:12032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37086.exe
        5⤵
        
        PID:15476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27265.exe
      4⤵
      PID:11812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7148.exe
      4⤵
      PID:8444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30439.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30439.exe
    3⤵
    PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50707.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
        5⤵
        
        PID:7992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23066.exe
        6⤵
        
        PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15616.exe
        5⤵
        
        PID:13388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1257.exe
        5⤵
        
        PID:15192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36761.exe
      4⤵
      PID:9172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29578.exe
      4⤵
      PID:14960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53218.exe
    3⤵
    PID:6152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15257.exe
      4⤵
      PID:9792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe
      4⤵
      PID:12120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34014.exe
      4⤵
      PID:8256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45306.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45306.exe
    3⤵
    PID:9724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8114.exe
      4⤵
      PID:13660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40613.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40613.exe
      4⤵
      PID:16264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31.exe
    3⤵
    PID:12176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9614.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9614.exe
    3⤵
    PID:14864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44813.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44813.exe
    3⤵
    PID:7196
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19194.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19194.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30925.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30925.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57674.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15500.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51169.exe
        6⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14866.exe
        7⤵
        
        PID:10696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2457.exe
        7⤵
        
        PID:14976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19369.exe
        7⤵
        
        PID:5412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51432.exe
        6⤵
        
        PID:11168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62853.exe
        6⤵
        
        PID:7896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19504.exe
        5⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33738.exe
        6⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48973.exe
        7⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65194.exe
        8⤵
        
        PID:11996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30916.exe
        8⤵
        
        PID:9256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56001.exe
        7⤵
        
        PID:14868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13850.exe
        7⤵
        
        PID:8928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33840.exe
        6⤵
        
        PID:9852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25812.exe
        7⤵
        
        PID:15500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe
        6⤵
        
        PID:13232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11689.exe
        6⤵
        
        PID:16248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55361.exe
        5⤵
        
        PID:7888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60422.exe
        6⤵
        
        PID:10208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27617.exe
        5⤵
        
        PID:11240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7362.exe
        5⤵
        
        PID:15244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27767.exe
        5⤵
        
        PID:7968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22144.exe
      4⤵
      PID:836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61773.exe
        5⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43853.exe
        6⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31206.exe
        7⤵
        
        PID:15728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe
        6⤵
        
        PID:11932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11715.exe
        6⤵
        
        PID:9236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38323.exe
        5⤵
        
        PID:9108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43033.exe
        6⤵
        
        PID:14988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1456.exe
        6⤵
        
        PID:12348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2103.exe
        5⤵
        
        PID:13292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46463.exe
        5⤵
        
        PID:9028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54895.exe
        5⤵
        
        PID:6520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12881.exe
      4⤵
      PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51578.exe
        5⤵
        
        PID:9844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24049.exe
        6⤵
        
        PID:7360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe
        5⤵
        
        PID:12700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46274.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25232.exe
      4⤵
      PID:9736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48532.exe
        5⤵
        
        PID:6488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62576.exe
      4⤵
      PID:15872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37808.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37808.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6159.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6159.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26931.exe
        5⤵
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43795.exe
        6⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1545.exe
        7⤵
        
        PID:11236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35143.exe
        8⤵
        
        PID:13156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9018.exe
        7⤵
        
        PID:15584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-983.exe
        6⤵
        
        PID:10396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42593.exe
        6⤵
        
        PID:15288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60632.exe
        6⤵
        
        PID:7316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39321.exe
        5⤵
        
        PID:7696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2592.exe
        5⤵
        
        PID:9832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32599.exe
        6⤵
        
        PID:7640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25463.exe
        5⤵
        
        PID:11080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9945.exe
      4⤵
      PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42474.exe
        5⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41386.exe
        6⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15914.exe
        7⤵
        
        PID:13476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9008.exe
        6⤵
        
        PID:12408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16224.exe
        6⤵
        
        PID:15436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2128.exe
        5⤵
        
        PID:9352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2752.exe
        5⤵
        
        PID:12404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56234.exe
        5⤵
        
        PID:12400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38881.exe
      4⤵
      PID:8020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41930.exe
        5⤵
        
        PID:11796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24426.exe
      4⤵
      PID:10832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57564.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57564.exe
      4⤵
      PID:3212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43723.exe
      4⤵
      PID:5252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41659.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41659.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61715.exe
      4⤵
      PID:5208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29898.exe
        5⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37680.exe
        6⤵
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55007.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23831.exe
        6⤵
        
        PID:13076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36336.exe
        5⤵
        
        PID:9556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54584.exe
        5⤵
        
        PID:13616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37593.exe
      4⤵
      PID:7780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42771.exe
        5⤵
        
        PID:12436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14618.exe
        5⤵
        
        PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57700.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10004.exe
      4⤵
      PID:16376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41409.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41409.exe
    3⤵
    PID:5628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19021.exe
      4⤵
      PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6793.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45155.exe
        6⤵
        
        PID:10636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28902.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62872.exe
      4⤵
      PID:10260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58520.exe
      4⤵
      PID:8924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15783.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15783.exe
    3⤵
    PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37453.exe
      4⤵
      PID:9456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32903.exe
      4⤵
      PID:13408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39820.exe
      4⤵
      PID:6748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14896.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14896.exe
    3⤵
    PID:10428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64880.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64880.exe
    3⤵
    PID:15612
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30660.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30660.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39792.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47050.exe
        5⤵
        
        PID:3376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28691.exe
        6⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
        7⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22634.exe
        8⤵
        
        PID:12760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11312.exe
        7⤵
        
        PID:12180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52074.exe
        6⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64120.exe
        7⤵
        
        PID:6864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64032.exe
        6⤵
        
        PID:1056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43280.exe
        5⤵
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55434.exe
        6⤵
        
        PID:9612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10096.exe
        6⤵
        
        PID:11308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2268.exe
        6⤵
        
        PID:1984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25257.exe
        6⤵
        
        PID:9364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58531.exe
        5⤵
        
        PID:9688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57953.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10988.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41849.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40784.exe
        5⤵
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22762.exe
        6⤵
        
        PID:9640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54895.exe
        6⤵
        
        PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31159.exe
        5⤵
        
        PID:9716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14420.exe
        5⤵
        
        PID:15552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe
      4⤵
      PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32746.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50862.exe
        6⤵
        
        PID:8440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5289.exe
        5⤵
        
        PID:14412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43641.exe
        5⤵
        
        PID:12400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25871.exe
        5⤵
        
        PID:15756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe
      4⤵
      PID:9760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21031.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21031.exe
      4⤵
      PID:12128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52413.exe
      4⤵
      PID:7428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47050.exe
      4⤵
      PID:956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42474.exe
        5⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61642.exe
        6⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41271.exe
        7⤵
        
        PID:15716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11312.exe
        6⤵
        
        PID:12188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10947.exe
        6⤵
        
        PID:8100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36761.exe
        5⤵
        
        PID:9188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47603.exe
        6⤵
        
        PID:9232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34939.exe
        6⤵
        
        PID:8488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-567.exe
        5⤵
        
        PID:12800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7344.exe
        5⤵
        
        PID:12136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25441.exe
        5⤵
        
        PID:8856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6960.exe
      4⤵
      PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40852.exe
        5⤵
        
        PID:7556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46768.exe
      4⤵
      PID:12616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28618.exe
      4⤵
      PID:15648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55585.exe
    3⤵
    PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
      4⤵
      PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28394.exe
        5⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13391.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52218.exe
        6⤵
        
        PID:12500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22785.exe
        5⤵
        
        PID:14388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22864.exe
      4⤵
      PID:9068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10551.exe
      4⤵
      PID:13204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17760.exe
      4⤵
      PID:7624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7235.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22506.exe
      4⤵
      PID:10980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4784.exe
      4⤵
      PID:14268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46691.exe
      4⤵
      PID:11056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27591.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27591.exe
    3⤵
    PID:9528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27850.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27850.exe
    3⤵
    PID:5792
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39403.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39403.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39984.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37709.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17459.exe
        5⤵
        
        PID:6164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe
        6⤵
        
        PID:8388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29578.exe
        6⤵
        
        PID:14944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21145.exe
        6⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27767.exe
        6⤵
        
        PID:7960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9911.exe
        5⤵
        
        PID:10140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29697.exe
        5⤵
        
        PID:13340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10302.exe
      4⤵
      PID:6192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3602.exe
        5⤵
        
        PID:9568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40848.exe
        5⤵
        
        PID:13584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50433.exe
        5⤵
        
        PID:6660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44673.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44673.exe
      4⤵
      PID:10024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26231.exe
      4⤵
      PID:9388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29488.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29488.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15923.exe
      4⤵
      PID:6292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54349.exe
        5⤵
        
        PID:8752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17331.exe
        6⤵
        
        PID:14232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47407.exe
        6⤵
        
        PID:16304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64449.exe
        5⤵
        
        PID:14828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55663.exe
        5⤵
        
        PID:6508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53953.exe
      4⤵
      PID:11192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9584.exe
    3⤵
    PID:8216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21012.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21012.exe
      4⤵
      PID:16312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65370.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65370.exe
    3⤵
    PID:13212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
    3⤵
    PID:10040
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45462.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45462.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28493.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28493.exe
    3⤵
    PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56371.exe
      4⤵
      PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28394.exe
        5⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43033.exe
        6⤵
        
        PID:14980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36747.exe
        6⤵
        
        PID:10756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1945.exe
        5⤵
        
        PID:11948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12483.exe
        5⤵
        
        PID:6448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22864.exe
      4⤵
      PID:9076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-425.exe
        5⤵
        
        PID:12056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30916.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43032.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43032.exe
      4⤵
      PID:13252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54895.exe
      4⤵
      PID:15232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6960.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6960.exe
    3⤵
    PID:4120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62179.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62179.exe
    3⤵
    PID:14816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47805.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47805.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8492
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33466.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33466.exe
  2⤵
  PID:5552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43795.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2834.exe
      4⤵
      PID:9316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8560.exe
      4⤵
      PID:12028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51157.exe
      4⤵
      PID:7404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38521.exe
    3⤵
    PID:7744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55041.exe
    3⤵
    PID:15096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38472.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38472.exe
    3⤵
    PID:14244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21839.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21839.exe
    3⤵
    PID:10552
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29256.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29256.exe
  2⤵
  PID:7684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20275.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20275.exe
    3⤵
    PID:11696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16224.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16224.exe
    3⤵
    PID:15376
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38993.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38993.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:10368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34747.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34747.exe
    3⤵
    PID:7420
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50758.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50758.exe
  2⤵
  PID:15820

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:4220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11059.exe

Filesize
468KB

MD5
9d94c2dba5cd68493d0be4e18daff98b

SHA1
0abe2009b0dafddc074f600038f349d3749965a7

SHA256
21878daa9a5d6443e2f11821f5d92b39e0ba2b1eb301963e33b94515e5394df9

SHA512
e39f1669ff80195b54100ab46b3daf3205b306d8f02ec3bbe7cade74621f6903629988210188cd9d3209f6326e2f99a35d6ea2ec7f97e4a3238d4e3f2fb7de05

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11936.exe

Filesize
468KB

MD5
f40b11f2792f63928a4bebd9bb4c6cbe

SHA1
b9c80bf2ad0debe235a5f8e7c5317ec105238265

SHA256
fa2f0b27bce79466593c313ab00f533ddf0ea1b87c63e2d9d60535199e8f628a

SHA512
47e7523915d89c444a644de9397656879a1875efe066c4cdddbc44c14f6c04c5c93eaac9cbde41ef87a04c6d4a424496b7a33235916fd55326d2b6c2190c2b32

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12787.exe

Filesize
468KB

MD5
5a7194f88af6e33af7d6832d0579f9f1

SHA1
1306ccfbd72ae5f4fc9a93686aa3ff11081361b0

SHA256
b340d938511722dbe8e92448ae455aa68502b54d1f2e86823f39a0fc420576ea

SHA512
1f7e3ab698e184fa39a22ba935fd87aeae24929e4102a5570ab3cd404d90a03ad725870e1866971036fb9d75aad5d66753ca2621812a5f5d967ac54347fa60b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15084.exe

Filesize
468KB

MD5
5dd6ee25e727d03ae34bac18b1f50eda

SHA1
d4e66aa769eac0a509c7f445a6e2f24cf082d0cb

SHA256
2877fad58041fdd99bfa926fe2c4604c70677030527309d1d59e3715a1685182

SHA512
183e77bdf7855fee79df2d201d81f381394cd05e4726d5f536962487b42caf7b070397459155240e964f2d6602f48a81a0df0408b01c92a8fbfd3cf327d8f282

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19194.exe

Filesize
468KB

MD5
676805b276be94550a544bbbf207fad7

SHA1
ce5be2a8f1039ca2a721de9e2b18ef7689a84ac5

SHA256
ee737eee98e67c7a008ae1fa289268050b8c37c520f4387febdd90ea6a73bedf

SHA512
f941b19e909d565e216d7512b04709a3232ee715324938a9f687130e05504095f7b9b2231af56f76ea2de982ece344391e30e3e52875d74d63e13d33879c54f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20698.exe

Filesize
468KB

MD5
43bb538199d783f1abfada299c853646

SHA1
81d56b24e9dcce334fd51de0d1c5d387c200662f

SHA256
fcbfb9e55600c7cf2712607b126c5c1e3102222f86fd482d3b6ddfb88d83b880

SHA512
3d9effa110c60bb15ecb1a821fa0d43fb9f85e1a18198e6d255b1860a080b330f1c2b27c91b1442c0b005521aa7bdc4b822bf87099f6f8b2635f72727bc0b7a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21462.exe

Filesize
468KB

MD5
f25fca3d8b77fe712299caa5d4b22429

SHA1
2c556699ca3682651695202a770d029ece934ceb

SHA256
9a96421dd0d2397a17696e7b7422f0fc846386cb148688937b2d5b20ffa44e6f

SHA512
1d6478b8871a9f4a6572c0d1219098d36c4298ba4d75e28655e354dfede4c560da7edb96db35628eadad2fda1ed73926ca7d82f08c0ffbe301cc777c18b87c66

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24026.exe

Filesize
468KB

MD5
9955307351ac9ebb6cb58f00817e2616

SHA1
947161e20c3a0a5e184dc727ecc27c0fb55db2f2

SHA256
e538e34d88b57281ffe15359d9b4cb8cada21e7a3c6097b2d4d16cd8f9ce4ea7

SHA512
e2a51bf74e6ac8ce52b1b115ce1c3e19eec47843397123777ba04aed5954160885cd74c3f4d1d21ccba5da567d0bc60545d5b7a13707c778c030daa6c1a6570b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30381.exe

Filesize
468KB

MD5
179da8a2cc9e47b1d6744223a64e3cfc

SHA1
724549d5b115a9865a26e0ed1e35e84179a29484

SHA256
b6e34ace087b8bc19393cfd31fe0e89cda6af2770f41af7a7263cf9c0071b3b7

SHA512
f894f0bbbe2b295539bd09de4d6d5748e7605f1e8ae138ee356e39de9510adec8c2cb0072e1ad87da43f0617bcceabf2e37feacac6f26b4610d3e12b1fea10f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30660.exe

Filesize
468KB

MD5
ddc918455f5160812e4429f6c6d889cf

SHA1
b6da6bd3b0e0d8e3bb2ea79a53122b954fc9f65b

SHA256
e48dc9fd57137be7d95fc135533b09910b32f588f5b7145de8e41df015f32783

SHA512
e6e17cda2f96d1c9d4459d22098d3e6ac4f1b8b8489d26224f84aa1bcbf92cf8d7e5a870261d322e388fac3d897b1082fd0fb13bb91b71eff768f7d21aa5ba04

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30925.exe

Filesize
468KB

MD5
0cfe9acbb5d38b264f4ab5ff020032f7

SHA1
aac1e0c9e6a982abd42465369601906c337732d5

SHA256
2a29f3d35193fd1ff397b9ff2d3b7d588562e33717cdc50579cf54c3197dc1d5

SHA512
cc3b999e3190b23356a2c87507d267841ebb06b1daa3fda51b2cd052063c1bbfb61100aa0e602768e0564652a7a2ac9f3462683aa072297a03ddce382d8b6fbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37808.exe

Filesize
468KB

MD5
046c0fed7de1d160e8f8680d6d9e2307

SHA1
406a116431ab4c2b0cd8373d9cb43f751069f984

SHA256
ef6c392ffb2516c3a46d405790ed8d9e2e7826491ae8983a7ebcb69343be6235

SHA512
4677cfe232d530942bc13ef066cb6f9e1f7a71c0b5299348c8005751f32cf716b6349724d69a4b9cf97dcc5ee3dff626040187fe2b36bf18a69eeaee1be1b021

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39403.exe

Filesize
468KB

MD5
de655357896fcb08ccd0f3365ee634d2

SHA1
391075a0a9658bac5eefaf81fa240c96a549eedc

SHA256
dff3137cf2072ffccb14eb6de4d1a676fab6f330a1c8e026a408dce8ab80fb2b

SHA512
fcf4f6e3ef2de59d3640fbad1e0d764d4f2ff10d4e1de2c5bb836b8e5f8bb3f7764c5aa6e63e64275fba6530910d3535bdaa0a8758837b2272d3ef63ac676700

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40976.exe

Filesize
468KB

MD5
65d661ec1db141f422f7fc86ceead144

SHA1
4e54b7814858f6dd03b23ad9695e8bf37a9370bd

SHA256
287880fbee56dbd5bc86f3320b1d91d37efa4dab019c79d6861c3e7df76617ed

SHA512
a9dc6ca5209ee4992922aaaa27fa9302b0d1851b052f29630a084a7426b1868fa4ef0b845d86e62e43095f4c2f0d75b84455b25ed3bbe61fa9bdc2f9cdbc08a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45005.exe

Filesize
468KB

MD5
e8e6411c9c030ab9fa1cce5fcac2ac53

SHA1
f028177445d460a7e3644e4789f8b4400c3586f9

SHA256
b90aeb5853ebcaa9fbb2c1653bb949311dce6a69b742fad50a3be4ee453c07ef

SHA512
69c122919ff07df73797380118342511ad84d3b906b3a6b36a9c8b4a1774b323473c3755c90343c1d64a2782e909e02d3dca86180cc6337d3a4b204dc307ad07

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45424.exe

Filesize
468KB

MD5
bd40027db45a8177e2df37d3ac620daf

SHA1
33b476f939f47d0805618151920558d41ac197ea

SHA256
957f07c5ace02169d31894ce4732eadcce1960ace28bcd24c23e1f3d44f3afea

SHA512
f5e149e766b22df7af2f54d12fff581e4d6b6e400da03cf69c43a3970125091754e8e937d219f440ccf8607f438270bb4f731d0738b6c8e3ced17fdd040c9822

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46029.exe

Filesize
468KB

MD5
fc81e59847cae2fdfe73765bad7c1506

SHA1
25f2e6da78b0985864301d33efa2a7db01ff5b83

SHA256
a57abf5c90059439749e5df010d9ea890cfe7efe8d294e0fb8a5357158d5b88e

SHA512
69d85e6ec66641500211339096265d98dcbc741778bad20876afa78870d816de690a4644aee0394035ebb5b4862a534e7da7edb664664008d9554e0b58e6aad7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48333.exe

Filesize
468KB

MD5
e37a3c56f676e941d56e0f71c281c97b

SHA1
68f223ce2bec345a1d72655eb0dfd132acb1e074

SHA256
b78861ebf28c05ed60c522aa465f3b22f65e63cec7b8c585d50de2387749fcd2

SHA512
fd43a021168253abdb4be7729a8ecd1f37b456dd09ba3cb891a23d89c6f6869057e2d9be13283e9cfe2c77136be823dc7f9c643d67b85a4ab27bfcab5d4e8c7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49642.exe

Filesize
468KB

MD5
35c6465d550f69dd1c1e3c3be6748600

SHA1
e6e82a1a1e69880b1d312d38e441253d0da60749

SHA256
d3044092385dcebcf91b5c90f441ac72ee4051dcffb9f9e7667ce255dadb19b8

SHA512
a3df57b423ac83e03c6f01f3d12ba613db455e53f10d827904b0ff253437711d586d0305b97b90e66a66bf341a7abf24c4fbcf5e346547e9fd318b575854c3e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51544.exe

Filesize
468KB

MD5
e94f7e66054e7d7fe0120c0eb4e752f3

SHA1
95f9baf8e7c098a5dfe5e42bd8a2c9972224f7dc

SHA256
c032c54ea8fa4fedd98c4a0bd09730d21eafae8fd67f43ca45b7c1b4f2edc694

SHA512
15c35d819412ce62537467cfc940bdf7e64ffeb265baec732a92d7e64f35294cf5355355b68660193600a18182fae6f8615846b24a3dcba605a7eace1f2ce800

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53630.exe

Filesize
468KB

MD5
142877d3d8d003da41a2035f7ab2bd37

SHA1
4c33ed0a8d35bd38e5f68deb0da2c4c1a08a5fa5

SHA256
08e1a85b861adcf7e40ab337c74fa17b2fb7c4bdf0ab70ccf953afb0b3fbf97d

SHA512
d64a442fb0984b7d2a5a7fcbfd972273fbb7d274e08fe6697157334e1bd47463fd8c4e99091fbd8b2413dfe2ed6e0bfa4c02ee4e98d8450a1e84476b2e107f58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5459.exe

Filesize
468KB

MD5
e5bd55652fa74e2abcfcb8a14ad3b5c4

SHA1
1d47f16299027b467fdf90b2cb8136a7eed09c2f

SHA256
dd67a29235e5633f032a69d82e1887d4aed76265e602161311877c002eb88c28

SHA512
177655eeb6728e061310adaee06cac8b575383a579ce435688c281994afd862c9dde59f0fda2b4f5495ae7881ba57c9695b02d671e59d2d5aa080bcc21dbe312

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57674.exe

Filesize
468KB

MD5
f55344aed72857b1c72ea9ea48bc8fa0

SHA1
404b71f037a4d2b44232eebe614dd5aef74a1a0f

SHA256
bb06074806f90d1b0d79bd209796ae2fc419ad6dad87280c7fa04a269670cdd4

SHA512
48a65ac6a0f0f86949e77f45203dcd6d69dde180642d3cc0116fab9644f1c3958cab1a70b4eb6fe66aa3619b38a255dbde5190924891742247d207073c81fb22

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58349.exe

Filesize
468KB

MD5
7d1a95a79e961fbefc333d510db57e2c

SHA1
83d8fe25e93422167137737eae2d689602e6aa4f

SHA256
accc763988c158b9ec186ccee9b7b1e6d5d1f97cb27121ae1aa18278a16d06de

SHA512
f22ff6661fdc28b053f620b6e4655375147c2782b7c9039d07ac67ccfe765db1aee7f9978b5ceb9ae13348c993abce4c7fb1b2a3c9865cc7e2c40c13ecd5f53e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59309.exe

Filesize
468KB

MD5
71501506fb75598900384b3ab2c93e8d

SHA1
133cfe203b81f04b44789980792a123427174822

SHA256
fe671b69ce492134142fa5dee5cf98f3aeddfa7a278d3a4d801d34545948b5a4

SHA512
d7b4a8da310642b4be55cc8a4180f29e2eaff9e7e1c9916252590395da7729307468c2f1ae4fd444475da0618206329225782cce83b4aefd47f4b6076e289937

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59952.exe

Filesize
468KB

MD5
7d72157a0aa8a9ce59827918131342ef

SHA1
39032b783ca41e751ac12511625c5972ad827300

SHA256
7b1a1cf5d90a7d41f714018c5307d211950a6b45844600547e6b87345aef550f

SHA512
1a9b52d9d6fb9dafc562ce6ba39ee53fd63f6086109fca1488aa4b5216ae068c95ac0e6c4ee5d571da657d06922a5a817725b0a13cb608273d54ab08ff2c7e7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64173.exe

Filesize
468KB

MD5
619d217e373e0e2c45536a86d4860eac

SHA1
cfbc518b6faf5777a9c59edc28833844a94bbd9b

SHA256
cb264c0e26846d830cb9e737eb3adb04a944a5e3f5795a1cd32ac7bb572c4d70

SHA512
518ff793eca7cb02b3020364860c00b468159787ced088ca2a19da0858044affce8093f6f6b709a30fd5d69525ae050a0332535fa1d7de423eb21875a64e41bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64321.exe

Filesize
468KB

MD5
e7795af010575f237be45667a7256b73

SHA1
db122c41d15ab1f5b5583e73eb33df37534a0dd4

SHA256
4e748c8f5a85a9d65091e76550bb95d147b0aff21081a1f6eb7c355ab646cee8

SHA512
330dffe0793ef490e547f388f6f027190042b31174c847f59342520453c87a46922b13da9e9ac90cf13a80f9fcecddc04f700d330170d61ae3489fe3321e1f1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64368.exe

Filesize
468KB

MD5
18f258d4548a2f0d67eec7daee37e2a0

SHA1
2ff4c81ee8a6ecc9551ce3ca405703ac80293b30

SHA256
64b68a863b8de52e21b9b601e1710d6299f24d5d61314face7c464a81c7cbc29

SHA512
b436b1d3294706123ed9f53df5aea469b492922f1f92bd18dce0316fb03932c7122583b640cdd12f5f6a802d3dd7ac4b9dc16e64deb263bf7026d270e46b2b4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7535.exe

Filesize
468KB

MD5
e5b3443901843ebf54c80e045e925dd7

SHA1
4e9e011af4dc313d3798302596782d1d5df4e1b0

SHA256
26e4dcf8bc728d983c400c29c3bdf3bebdb294fdb250fcf7d6d235c123316d1c

SHA512
b380b91a09e5f6bad1f3bd2841e623ea4fcd18c6c6f3de503740c01996bb13a3672b93c6b694ea5233fc6f14e757f4e232d6a0decdd8e7a1e2252f9a75c7666b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8310.exe

Filesize
468KB

MD5
35b87b4d5df324c6f0fb2de1335aab94

SHA1
feab2d6ec416e8521a737b2b5ba077537999cdb5

SHA256
b94dfb6a62c097a12178bf558c88fd5bc3ba03f50bb155d8bcb9392989791768

SHA512
364c557d5979c3e994326b718946b1cd7bc80a5e0cc93848ef10a53dff2f7429b74a155d5012b90e0105364bf40ee557c265072b9334528127c0d880da5404db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9334.exe

Filesize
468KB

MD5
18d4f3c7c74e8be75ba76e0157968da8

SHA1
517bc2923763d8e9edf0a313792f3965b18211a8

SHA256
d98ccce2a8edec201d66b123adbdfff8cd7680b9a22b7b175fa160c951f79030

SHA512
85cf1951aec953e4e909746054d562178d4e09df98f4e0d6daf50f7ab60f2189e71b3cab5aa974d5b3b31b488402e2e4f3184a1c75481dfd2e697268b3c598a7

Download Submit
memory/632-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/708-261-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/836-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/956-443-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1040-223-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1048-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1152-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1160-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1312-202-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1320-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1340-73-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1392-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1416-260-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1628-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1716-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1760-442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1788-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1836-43-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1852-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1916-145-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1972-95-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2080-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2120-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2148-61-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2184-138-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2236-156-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2260-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2312-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2436-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2516-174-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2564-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2604-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2812-26-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2892-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2952-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2996-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3004-263-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3188-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3204-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3224-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3396-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3416-126-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3468-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3536-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3608-444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3660-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3792-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3868-116-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3880-465-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4156-460-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4240-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4260-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4300-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4304-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4308-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4324-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4376-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4388-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4404-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4460-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4508-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4512-475-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4572-54-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4600-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4624-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4640-210-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4696-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4732-446-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4736-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4768-44-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4844-216-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4860-12-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4880-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4892-191-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4900-109-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4924-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4980-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4992-3895-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5008-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5012-190-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5032-129-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5100-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5116-71-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5196-516-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5208-506-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5220-510-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5348-531-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5372-511-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5388-536-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5404-552-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5480-539-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5492-546-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5544-547-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5552-548-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5584-549-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5672-550-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5724-551-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/11308-2578-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13096-2661-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13452-2973-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14264-3023-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14996-3530-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15096-3700-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15244-3171-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads