ef788c77e3bd83b04b834761fcf010b5e786dca4ba23e89f5ab4bbde0e5c2418

Analysis

max time kernel
119s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03-10-2024 14:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef788c77e3bd83b04b834761fcf010b5e786dca4ba23e89f5ab4bbde0e5c2418N.exe
Size

468KB
MD5

670aa5d1d59f31dcb5b79964d998df00
SHA1

003e4e2b41fac77f1a71c7ceadaad12eaa38e1c1
SHA256

ef788c77e3bd83b04b834761fcf010b5e786dca4ba23e89f5ab4bbde0e5c2418
SHA512

6366987707cc59d5eab6a98e92eca4b9a77a5d6d8dc5ec0a4bd078af60acbbb65ffcadf172baf62df8abc68d4b6693231e805917c5e119e5ee7a8c57db5bfedc
SSDEEP

3072:p8nCogIdIU57tbY6Pzcj4f//sChC7IagBRHQOV1MaUHLpO4yQRle:p8CoAc7tVP4j4fi/bLaUrw4yQ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3168	Unicorn-37203.exe
1408	Unicorn-18859.exe
3164	Unicorn-60446.exe
4616	Unicorn-9102.exe
216	Unicorn-30675.exe
236	Unicorn-10809.exe
4968	Unicorn-20460.exe
3264	Unicorn-270.exe
4124	Unicorn-4525.exe
4060	Unicorn-36643.exe
4380	Unicorn-57063.exe
440	Unicorn-33113.exe
116	Unicorn-52979.exe
1000	Unicorn-11681.exe
3676	Unicorn-1732.exe
4344	Unicorn-60711.exe
4188	Unicorn-56627.exe
1132	Unicorn-62749.exe
2636	Unicorn-35692.exe
3588	Unicorn-22310.exe
4368	Unicorn-16179.exe
3008	Unicorn-56051.exe
4008	Unicorn-15018.exe
3872	Unicorn-10934.exe
4056	Unicorn-2766.exe
2088	Unicorn-2501.exe
3124	Unicorn-35116.exe
4288	Unicorn-14640.exe
3776	Unicorn-3705.exe
4988	Unicorn-42537.exe
4700	Unicorn-7456.exe
860	Unicorn-47027.exe
4472	Unicorn-59279.exe
2292	Unicorn-35735.exe
2328	Unicorn-7701.exe
1252	Unicorn-43638.exe
1140	Unicorn-2870.exe
1832	Unicorn-48542.exe
1532	Unicorn-13460.exe
452	Unicorn-35927.exe
2040	Unicorn-48179.exe
1592	Unicorn-3062.exe
3352	Unicorn-3062.exe
5096	Unicorn-19015.exe
2012	Unicorn-10846.exe
3052	Unicorn-33304.exe
832	Unicorn-31267.exe
4476	Unicorn-27183.exe
4244	Unicorn-19015.exe
3852	Unicorn-48158.exe
3368	Unicorn-2486.exe
2460	Unicorn-55194.exe
4672	Unicorn-14857.exe
5116	Unicorn-56710.exe
2180	Unicorn-2108.exe
4256	Unicorn-15677.exe
3136	Unicorn-29412.exe
1308	Unicorn-39989.exe
3556	Unicorn-64878.exe
1660	Unicorn-12766.exe
5036	Unicorn-33187.exe
3504	Unicorn-22972.exe
1856	Unicorn-53342.exe
2424	Unicorn-54375.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
9084	6444	WerFault.exe	253
16336	15496	WerFault.exe	783

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38219.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53254.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56710.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16113.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59694.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17953.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32604.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36519.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49030.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9000.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-149.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64878.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50155.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59770.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-149.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3665.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44394.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52922.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50758.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30360.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11142.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5829.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11689.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42318.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27723.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	1936	dwm.exe
Token: SeChangeNotifyPrivilege	1936	dwm.exe
Token: 33	1936	dwm.exe
Token: SeIncBasePriorityPrivilege	1936	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3340	ef788c77e3bd83b04b834761fcf010b5e786dca4ba23e89f5ab4bbde0e5c2418N.exe
3168	Unicorn-37203.exe
1408	Unicorn-18859.exe
3164	Unicorn-60446.exe
4616	Unicorn-9102.exe
216	Unicorn-30675.exe
236	Unicorn-10809.exe
4968	Unicorn-20460.exe
3264	Unicorn-270.exe
4124	Unicorn-4525.exe
4380	Unicorn-57063.exe
440	Unicorn-33113.exe
3676	Unicorn-1732.exe
1000	Unicorn-11681.exe
116	Unicorn-52979.exe
4060	Unicorn-36643.exe
4344	Unicorn-60711.exe
4188	Unicorn-56627.exe
1132	Unicorn-62749.exe
2636	Unicorn-35692.exe
4008	Unicorn-15018.exe
4368	Unicorn-16179.exe
4056	Unicorn-2766.exe
3588	Unicorn-22310.exe
3008	Unicorn-56051.exe
2088	Unicorn-2501.exe
3124	Unicorn-35116.exe
3776	Unicorn-3705.exe
4288	Unicorn-14640.exe
3872	Unicorn-10934.exe
4988	Unicorn-42537.exe
4700	Unicorn-7456.exe
860	Unicorn-47027.exe
4472	Unicorn-59279.exe
2292	Unicorn-35735.exe
2328	Unicorn-7701.exe
1252	Unicorn-43638.exe
1832	Unicorn-48542.exe
1140	Unicorn-2870.exe
1532	Unicorn-13460.exe
452	Unicorn-35927.exe
2040	Unicorn-48179.exe
3352	Unicorn-3062.exe
1592	Unicorn-3062.exe
5096	Unicorn-19015.exe
4476	Unicorn-27183.exe
4672	Unicorn-14857.exe
2012	Unicorn-10846.exe
832	Unicorn-31267.exe
4244	Unicorn-19015.exe
2460	Unicorn-55194.exe
2180	Unicorn-2108.exe
3052	Unicorn-33304.exe
3852	Unicorn-48158.exe
3368	Unicorn-2486.exe
1308	Unicorn-39989.exe
3556	Unicorn-64878.exe
3136	Unicorn-29412.exe
4256	Unicorn-15677.exe
5116	Unicorn-56710.exe
5036	Unicorn-33187.exe
1660	Unicorn-12766.exe
1856	Unicorn-53342.exe
3504	Unicorn-22972.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 3168	3340	ef788c77e3bd83b04b834761fcf010b5e786dca4ba23e89f5ab4bbde0e5c2418N.exe	82
PID 3340 wrote to memory of 3168	3340	ef788c77e3bd83b04b834761fcf010b5e786dca4ba23e89f5ab4bbde0e5c2418N.exe	82
PID 3340 wrote to memory of 3168	3340	ef788c77e3bd83b04b834761fcf010b5e786dca4ba23e89f5ab4bbde0e5c2418N.exe	82
PID 3168 wrote to memory of 1408	3168	Unicorn-37203.exe	86
PID 3168 wrote to memory of 1408	3168	Unicorn-37203.exe	86
PID 3168 wrote to memory of 1408	3168	Unicorn-37203.exe	86
PID 3340 wrote to memory of 3164	3340	ef788c77e3bd83b04b834761fcf010b5e786dca4ba23e89f5ab4bbde0e5c2418N.exe	87
PID 3340 wrote to memory of 3164	3340	ef788c77e3bd83b04b834761fcf010b5e786dca4ba23e89f5ab4bbde0e5c2418N.exe	87
PID 3340 wrote to memory of 3164	3340	ef788c77e3bd83b04b834761fcf010b5e786dca4ba23e89f5ab4bbde0e5c2418N.exe	87
PID 1408 wrote to memory of 4616	1408	Unicorn-18859.exe	90
PID 1408 wrote to memory of 4616	1408	Unicorn-18859.exe	90
PID 1408 wrote to memory of 4616	1408	Unicorn-18859.exe	90
PID 3164 wrote to memory of 216	3164	Unicorn-60446.exe	91
PID 3164 wrote to memory of 216	3164	Unicorn-60446.exe	91
PID 3164 wrote to memory of 216	3164	Unicorn-60446.exe	91
PID 3168 wrote to memory of 236	3168	Unicorn-37203.exe	92
PID 3168 wrote to memory of 236	3168	Unicorn-37203.exe	92
PID 3168 wrote to memory of 236	3168	Unicorn-37203.exe	92
PID 3340 wrote to memory of 4968	3340	ef788c77e3bd83b04b834761fcf010b5e786dca4ba23e89f5ab4bbde0e5c2418N.exe	93
PID 3340 wrote to memory of 4968	3340	ef788c77e3bd83b04b834761fcf010b5e786dca4ba23e89f5ab4bbde0e5c2418N.exe	93
PID 3340 wrote to memory of 4968	3340	ef788c77e3bd83b04b834761fcf010b5e786dca4ba23e89f5ab4bbde0e5c2418N.exe	93
PID 4616 wrote to memory of 3264	4616	Unicorn-9102.exe	96
PID 4616 wrote to memory of 3264	4616	Unicorn-9102.exe	96
PID 4616 wrote to memory of 3264	4616	Unicorn-9102.exe	96
PID 1408 wrote to memory of 4124	1408	Unicorn-18859.exe	97
PID 1408 wrote to memory of 4124	1408	Unicorn-18859.exe	97
PID 1408 wrote to memory of 4124	1408	Unicorn-18859.exe	97
PID 216 wrote to memory of 4060	216	Unicorn-30675.exe	98
PID 216 wrote to memory of 4060	216	Unicorn-30675.exe	98
PID 216 wrote to memory of 4060	216	Unicorn-30675.exe	98
PID 4968 wrote to memory of 4380	4968	Unicorn-20460.exe	99
PID 4968 wrote to memory of 4380	4968	Unicorn-20460.exe	99
PID 4968 wrote to memory of 4380	4968	Unicorn-20460.exe	99
PID 3164 wrote to memory of 440	3164	Unicorn-60446.exe	100
PID 3164 wrote to memory of 440	3164	Unicorn-60446.exe	100
PID 3164 wrote to memory of 440	3164	Unicorn-60446.exe	100
PID 236 wrote to memory of 116	236	Unicorn-10809.exe	101
PID 236 wrote to memory of 116	236	Unicorn-10809.exe	101
PID 236 wrote to memory of 116	236	Unicorn-10809.exe	101
PID 3340 wrote to memory of 1000	3340	ef788c77e3bd83b04b834761fcf010b5e786dca4ba23e89f5ab4bbde0e5c2418N.exe	102
PID 3340 wrote to memory of 1000	3340	ef788c77e3bd83b04b834761fcf010b5e786dca4ba23e89f5ab4bbde0e5c2418N.exe	102
PID 3340 wrote to memory of 1000	3340	ef788c77e3bd83b04b834761fcf010b5e786dca4ba23e89f5ab4bbde0e5c2418N.exe	102
PID 3168 wrote to memory of 3676	3168	Unicorn-37203.exe	103
PID 3168 wrote to memory of 3676	3168	Unicorn-37203.exe	103
PID 3168 wrote to memory of 3676	3168	Unicorn-37203.exe	103
PID 3264 wrote to memory of 4344	3264	Unicorn-270.exe	104
PID 3264 wrote to memory of 4344	3264	Unicorn-270.exe	104
PID 3264 wrote to memory of 4344	3264	Unicorn-270.exe	104
PID 440 wrote to memory of 4188	440	Unicorn-33113.exe	105
PID 440 wrote to memory of 4188	440	Unicorn-33113.exe	105
PID 440 wrote to memory of 4188	440	Unicorn-33113.exe	105
PID 3164 wrote to memory of 1132	3164	Unicorn-60446.exe	106
PID 3164 wrote to memory of 1132	3164	Unicorn-60446.exe	106
PID 3164 wrote to memory of 1132	3164	Unicorn-60446.exe	106
PID 4616 wrote to memory of 2636	4616	Unicorn-9102.exe	107
PID 4616 wrote to memory of 2636	4616	Unicorn-9102.exe	107
PID 4616 wrote to memory of 2636	4616	Unicorn-9102.exe	107
PID 1408 wrote to memory of 4368	1408	Unicorn-18859.exe	108
PID 1408 wrote to memory of 4368	1408	Unicorn-18859.exe	108
PID 1408 wrote to memory of 4368	1408	Unicorn-18859.exe	108
PID 4124 wrote to memory of 3588	4124	Unicorn-4525.exe	109
PID 4124 wrote to memory of 3588	4124	Unicorn-4525.exe	109
PID 4124 wrote to memory of 3588	4124	Unicorn-4525.exe	109
PID 4380 wrote to memory of 3008	4380	Unicorn-57063.exe	110

C:\Users\Admin\AppData\Local\Temp\ef788c77e3bd83b04b834761fcf010b5e786dca4ba23e89f5ab4bbde0e5c2418N.exe
"C:\Users\Admin\AppData\Local\Temp\ef788c77e3bd83b04b834761fcf010b5e786dca4ba23e89f5ab4bbde0e5c2418N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37203.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37203.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18859.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18859.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-270.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60711.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35735.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22471.exe
        8⤵
        
        PID:3416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44775.exe
        9⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50639.exe
        10⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5465.exe
        10⤵
        
        PID:11052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe
        10⤵
        
        PID:15572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34997.exe
        10⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7613.exe
        9⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32282.exe
        9⤵
        
        PID:11972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55329.exe
        9⤵
        
        PID:16256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61991.exe
        9⤵
        
        PID:15312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8765.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30411.exe
        9⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4396.exe
        9⤵
        
        PID:11412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe
        9⤵
        
        PID:14752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56954.exe
        9⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4436.exe
        8⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17665.exe
        8⤵
        
        PID:11864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32604.exe
        8⤵
        
        PID:15720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41186.exe
        8⤵
        
        PID:18332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57093.exe
        7⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30411.exe
        8⤵
        
        PID:8180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4396.exe
        8⤵
        
        PID:11360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe
        8⤵
        
        PID:15180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44894.exe
        8⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57494.exe
        7⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63437.exe
        7⤵
        
        PID:12140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53594.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9627.exe
        7⤵
        
        PID:17992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48542.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38807.exe
        7⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53135.exe
        8⤵
        
        PID:3376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30411.exe
        9⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4396.exe
        9⤵
        
        PID:11404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe
        9⤵
        
        PID:15588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12989.exe
        9⤵
        
        PID:17704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23373.exe
        8⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11800.exe
        8⤵
        
        PID:11804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37186.exe
        8⤵
        
        PID:15596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5641.exe
        7⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30411.exe
        8⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4396.exe
        8⤵
        
        PID:11380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe
        8⤵
        
        PID:15496
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15496 -s 436
        9⤵
        Program crash
        
        PID:16336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23705.exe
        8⤵
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53637.exe
        7⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20295.exe
        8⤵
        
        PID:12324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43610.exe
        8⤵
        
        PID:1328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17665.exe
        7⤵
        
        PID:12000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40197.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52863.exe
        7⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-627.exe
        6⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62211.exe
        7⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45183.exe
        8⤵
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48286.exe
        8⤵
        
        PID:16048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47694.exe
        8⤵
        
        PID:15800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40389.exe
        7⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48950.exe
        7⤵
        
        PID:14156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10493.exe
        7⤵
        
        PID:1748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1884.exe
        6⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30.exe
        7⤵
        
        PID:16176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44675.exe
        7⤵
        
        PID:2824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4776.exe
        6⤵
        
        PID:9492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39509.exe
        6⤵
        
        PID:13996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35528.exe
        6⤵
        
        PID:2388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35692.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35927.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24996.exe
        7⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37126.exe
        8⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4012.exe
        8⤵
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58373.exe
        8⤵
        
        PID:14224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57835.exe
        8⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64318.exe
        7⤵
        
        PID:8264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe
        7⤵
        
        PID:12304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6939.exe
        7⤵
        
        PID:16672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37442.exe
        7⤵
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        6⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22871.exe
        7⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53151.exe
        8⤵
        
        PID:9772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
        8⤵
        
        PID:15140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13337.exe
        7⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43085.exe
        7⤵
        
        PID:14144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64275.exe
        7⤵
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8956.exe
        6⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49073.exe
        6⤵
        
        PID:9088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-846.exe
        6⤵
        
        PID:16192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3665.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33304.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51635.exe
        6⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18595.exe
        7⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13337.exe
        7⤵
        
        PID:9320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2052.exe
        7⤵
        
        PID:14228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58210.exe
        7⤵
        
        PID:8444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46342.exe
        6⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe
        7⤵
        
        PID:16208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16044.exe
        7⤵
        
        PID:17148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50155.exe
        7⤵
        
        PID:9044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
        6⤵
        
        PID:10460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46193.exe
        6⤵
        
        PID:16340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4537.exe
        6⤵
        
        PID:9560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64738.exe
        5⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11557.exe
        6⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28263.exe
        7⤵
        
        PID:11224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23257.exe
        7⤵
        
        PID:15016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65182.exe
        7⤵
        
        PID:18028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16269.exe
        6⤵
        
        PID:9132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16276.exe
        6⤵
        
        PID:12100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-149.exe
        6⤵
        
        PID:17276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16113.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9280.exe
        5⤵
        
        PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7737.exe
        5⤵
        
        PID:7128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65319.exe
        5⤵
        
        PID:14276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19041.exe
        5⤵
        
        PID:5348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4525.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22310.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27183.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17702.exe
        7⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16519.exe
        8⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36519.exe
        9⤵
        
        PID:9784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe
        9⤵
        
        PID:13560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50155.exe
        9⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39290.exe
        8⤵
        
        PID:11180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34192.exe
        8⤵
        
        PID:14984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7554.exe
        8⤵
        
        PID:17760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13996.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14726.exe
        8⤵
        
        PID:15100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14306.exe
        8⤵
        
        PID:17924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25811.exe
        7⤵
        
        PID:10168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65094.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55610.exe
        7⤵
        
        PID:16760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        6⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27723.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57811.exe
        8⤵
        
        PID:11012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44638.exe
        8⤵
        
        PID:12876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5893.exe
        8⤵
        
        PID:7920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2009.exe
        7⤵
        
        PID:9652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2052.exe
        7⤵
        
        PID:14200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20118.exe
        7⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60077.exe
        6⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33395.exe
        7⤵
        
        PID:9960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61062.exe
        7⤵
        
        PID:13688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58410.exe
        7⤵
        
        PID:17148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37204.exe
        6⤵
        
        PID:10492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3049.exe
        6⤵
        
        PID:312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33364.exe
        6⤵
        
        PID:17732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56710.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47935.exe
        6⤵
        
        PID:1984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11282.exe
        7⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7598.exe
        8⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26416.exe
        8⤵
        
        PID:9988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63994.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43742.exe
        8⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42745.exe
        7⤵
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26224.exe
        7⤵
        
        PID:11744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13148.exe
        7⤵
        
        PID:13924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20005.exe
        7⤵
        
        PID:17944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46970.exe
        6⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43639.exe
        7⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39593.exe
        7⤵
        
        PID:15004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43610.exe
        7⤵
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26195.exe
        6⤵
        
        PID:9932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15125.exe
        6⤵
        
        PID:13664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10493.exe
        6⤵
        
        PID:16336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54789.exe
        5⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1189.exe
        6⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39555.exe
        7⤵
        
        PID:436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
        7⤵
        
        PID:15132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17953.exe
        7⤵
        
        PID:7480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17805.exe
        6⤵
        
        PID:10012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26556.exe
        6⤵
        
        PID:13940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50426.exe
        6⤵
        
        PID:7324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-405.exe
        5⤵
        
        PID:7968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39555.exe
        6⤵
        
        PID:11208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19173.exe
        6⤵
        
        PID:14948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46542.exe
        6⤵
        
        PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13520.exe
        5⤵
        
        PID:10692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49946.exe
        5⤵
        
        PID:14788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33556.exe
        5⤵
        
        PID:18304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16179.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16179.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31267.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3550.exe
        6⤵
        
        PID:3944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62019.exe
        7⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36519.exe
        8⤵
        
        PID:9680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11093.exe
        8⤵
        
        PID:13424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52805.exe
        8⤵
        
        PID:16920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54126.exe
        8⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3825.exe
        7⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9971.exe
        7⤵
        
        PID:13044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34493.exe
        7⤵
        
        PID:16908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21157.exe
        7⤵
        
        PID:17660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21976.exe
        6⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55211.exe
        7⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9941.exe
        7⤵
        
        PID:12628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30272.exe
        7⤵
        
        PID:16548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41490.exe
        7⤵
        
        PID:8604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3773.exe
        6⤵
        
        PID:9260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7747.exe
        6⤵
        
        PID:12732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10444.exe
        6⤵
        
        PID:17160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58060.exe
        6⤵
        
        PID:18364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27928.exe
        5⤵
        
        PID:5780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
        6⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35043.exe
        7⤵
        
        PID:13484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6277.exe
        7⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4396.exe
        6⤵
        
        PID:11372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17724.exe
        6⤵
        
        PID:15108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52407.exe
        6⤵
        
        PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60509.exe
        5⤵
        
        PID:8612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63437.exe
        5⤵
        
        PID:12148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53594.exe
        5⤵
        
        PID:15792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57484.exe
        5⤵
        
        PID:1656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14857.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10410.exe
        5⤵
        
        PID:1152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47847.exe
        6⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1822.exe
        7⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4396.exe
        7⤵
        
        PID:11388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe
        7⤵
        
        PID:15148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33409.exe
        7⤵
        
        PID:17528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-945.exe
        6⤵
        
        PID:8576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-700.exe
        6⤵
        
        PID:12164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13257.exe
        6⤵
        
        PID:15784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40618.exe
        6⤵
        
        PID:17696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12844.exe
        5⤵
        
        PID:6760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-722.exe
        6⤵
        
        PID:9808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61062.exe
        6⤵
        
        PID:13656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50155.exe
        6⤵
        
        PID:8936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26195.exe
        5⤵
        
        PID:9924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15125.exe
        5⤵
        
        PID:13672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26829.exe
        5⤵
        
        PID:5396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63857.exe
      4⤵
      PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8734.exe
        5⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30899.exe
        6⤵
        
        PID:8456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9557.exe
        6⤵
        
        PID:13004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28627.exe
        6⤵
        
        PID:16880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17570.exe
        6⤵
        
        PID:17652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64894.exe
        5⤵
        
        PID:8408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32612.exe
        5⤵
        
        PID:11288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24954.exe
        5⤵
        
        PID:17828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1873.exe
      4⤵
      PID:7444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
        5⤵
        
        PID:11748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55110.exe
        5⤵
        
        PID:15892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19873.exe
        5⤵
        
        PID:7312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13173.exe
      4⤵
      PID:10508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15392.exe
      4⤵
      PID:14592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59206.exe
      4⤵
      PID:18392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10809.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10809.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52979.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2766.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48179.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17702.exe
        7⤵
        
        PID:1164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7582.exe
        8⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57759.exe
        9⤵
        
        PID:8568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52502.exe
        9⤵
        
        PID:12180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35946.exe
        9⤵
        
        PID:16392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9097.exe
        9⤵
        
        PID:18040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62974.exe
        8⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38285.exe
        8⤵
        
        PID:11724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58950.exe
        8⤵
        
        PID:16292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51438.exe
        7⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42383.exe
        8⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12873.exe
        8⤵
        
        PID:12416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-376.exe
        8⤵
        
        PID:15700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13486.exe
        8⤵
        
        PID:17444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14244.exe
        7⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-953.exe
        7⤵
        
        PID:12892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32324.exe
        7⤵
        
        PID:17176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59495.exe
        7⤵
        
        PID:1488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36098.exe
        6⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60198.exe
        7⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36357.exe
        7⤵
        
        PID:12208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27812.exe
        7⤵
        
        PID:15832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33907.exe
        7⤵
        
        PID:17900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38689.exe
        6⤵
        
        PID:4536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24761.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44339.exe
        6⤵
        
        PID:16624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40229.exe
        6⤵
        
        PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48158.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16934.exe
        6⤵
        
        PID:4360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57219.exe
        7⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30411.exe
        8⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5465.exe
        8⤵
        
        PID:11432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5664.exe
        8⤵
        
        PID:15392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36071.exe
        8⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35625.exe
        7⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25920.exe
        7⤵
        
        PID:13232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57206.exe
        7⤵
        
        PID:4176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53592.exe
        7⤵
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50758.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42663.exe
        7⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63026.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe
        7⤵
        
        PID:15424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64930.exe
        7⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45277.exe
        6⤵
        
        PID:7384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17665.exe
        6⤵
        
        PID:11852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32604.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45270.exe
        6⤵
        
        PID:18352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58873.exe
        5⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31511.exe
        6⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34879.exe
        7⤵
        
        PID:4564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21225.exe
        7⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30360.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49475.exe
        7⤵
        
        PID:1188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13197.exe
        6⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21373.exe
        6⤵
        
        PID:12548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31556.exe
        6⤵
        
        PID:16516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52671.exe
        6⤵
        
        PID:18408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32445.exe
        5⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51319.exe
        6⤵
        
        PID:8812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9557.exe
        6⤵
        
        PID:13032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58669.exe
        6⤵
        
        PID:16836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25739.exe
        6⤵
        
        PID:17476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23395.exe
        5⤵
        
        PID:9940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55462.exe
        5⤵
        
        PID:13648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20343.exe
        5⤵
        
        PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3705.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3705.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19015.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        6⤵
        
        PID:1808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18595.exe
        7⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37509.exe
        7⤵
        
        PID:11156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42858.exe
        7⤵
        
        PID:14976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12989.exe
        7⤵
        
        PID:7836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46342.exe
        6⤵
        
        PID:7988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45870.exe
        6⤵
        
        PID:11220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52065.exe
        6⤵
        
        PID:15304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3854.exe
        6⤵
        
        PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7997.exe
        5⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6534.exe
        6⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12837.exe
        7⤵
        
        PID:14640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39002.exe
        7⤵
        
        PID:18060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12076.exe
        6⤵
        
        PID:8924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34340.exe
        6⤵
        
        PID:12656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43663.exe
        6⤵
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60077.exe
        5⤵
        
        PID:8004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50663.exe
        6⤵
        
        PID:14588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42126.exe
        6⤵
        
        PID:7436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46690.exe
        5⤵
        
        PID:10760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-944.exe
        5⤵
        
        PID:14816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36910.exe
        5⤵
        
        PID:18296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29412.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34421.exe
        5⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49923.exe
        6⤵
        
        PID:10092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20989.exe
        6⤵
        
        PID:13952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50155.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42310.exe
        5⤵
        
        PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55713.exe
        5⤵
        
        PID:12132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20236.exe
        5⤵
        
        PID:15956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25196.exe
        5⤵
        
        PID:16900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64546.exe
      4⤵
      PID:652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50426.exe
        5⤵
        
        PID:7940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16320.exe
        5⤵
        
        PID:10720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9609.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12989.exe
        5⤵
        
        PID:17612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57277.exe
      4⤵
      PID:7980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29231.exe
        5⤵
        
        PID:12784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53102.exe
        5⤵
        
        PID:16996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11705.exe
        5⤵
        
        PID:17672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62522.exe
      4⤵
      PID:10700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1474.exe
      4⤵
      PID:14796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57141.exe
      4⤵
      PID:18316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15018.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3062.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64271.exe
        6⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23343.exe
        7⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31859.exe
        8⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61773.exe
        8⤵
        
        PID:13072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6906.exe
        8⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43793.exe
        7⤵
        
        PID:10056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43714.exe
        7⤵
        
        PID:13712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24954.exe
        7⤵
        
        PID:8740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21976.exe
        6⤵
        
        PID:7872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59679.exe
        7⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29785.exe
        7⤵
        
        PID:12828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54777.exe
        7⤵
        
        PID:16576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39579.exe
        7⤵
        
        PID:3284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48698.exe
        6⤵
        
        PID:9304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29428.exe
        6⤵
        
        PID:12372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32125.exe
        6⤵
        
        PID:17240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53784.exe
        6⤵
        
        PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52922.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33047.exe
        6⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36294.exe
        7⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51359.exe
        7⤵
        
        PID:8644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8101.exe
        6⤵
        
        PID:9144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
        6⤵
        
        PID:13248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15333.exe
        6⤵
        
        PID:17316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18661.exe
        6⤵
        
        PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49989.exe
        5⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48655.exe
        6⤵
        
        PID:16652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42318.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32938.exe
        5⤵
        
        PID:9440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60129.exe
        5⤵
        
        PID:13328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14378.exe
        5⤵
        
        PID:4372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64878.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10410.exe
        5⤵
        
        PID:640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65335.exe
        6⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27479.exe
        7⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53351.exe
        8⤵
        
        PID:2848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59661.exe
        8⤵
        
        PID:15880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60330.exe
        8⤵
        
        PID:18244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63602.exe
        7⤵
        
        PID:11824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39105.exe
        7⤵
        
        PID:15732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12334.exe
        7⤵
        
        PID:17428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42745.exe
        6⤵
        
        PID:8988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26224.exe
        6⤵
        
        PID:11832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46890.exe
        6⤵
        
        PID:16320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24089.exe
        6⤵
        
        PID:17952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35485.exe
        5⤵
        
        PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25811.exe
        5⤵
        
        PID:10204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65094.exe
        5⤵
        
        PID:14020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59694.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25624.exe
      4⤵
      PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33623.exe
        5⤵
        
        PID:6344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15525.exe
        6⤵
        
        PID:11508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23781.exe
        6⤵
        
        PID:15968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35634.exe
        6⤵
        
        PID:6080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3825.exe
        5⤵
        
        PID:8892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23292.exe
        5⤵
        
        PID:13024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34493.exe
        5⤵
        
        PID:16892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17073.exe
        5⤵
        
        PID:17640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6269.exe
      4⤵
      PID:7144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1603.exe
        5⤵
        
        PID:9436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23011.exe
      4⤵
      PID:10176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39893.exe
      4⤵
      PID:14076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31444.exe
      4⤵
      PID:2384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2501.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2501.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19015.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6902.exe
        5⤵
        
        PID:2136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61251.exe
        6⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36823.exe
        7⤵
        
        PID:12464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52178.exe
        7⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47694.exe
        7⤵
        
        PID:3208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27753.exe
        6⤵
        
        PID:8556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3064.exe
        6⤵
        
        PID:12720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52474.exe
        6⤵
        
        PID:16616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33601.exe
        6⤵
        
        PID:17880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31401.exe
        5⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29003.exe
        6⤵
        
        PID:17208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10414.exe
        6⤵
        
        PID:17836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25811.exe
        5⤵
        
        PID:10212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51965.exe
        5⤵
        
        PID:14212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55610.exe
        5⤵
        
        PID:3388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11889.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11889.exe
      4⤵
      PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60779.exe
        5⤵
        
        PID:7928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9002.exe
        6⤵
        
        PID:12520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-201.exe
        6⤵
        
        PID:16484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9209.exe
        6⤵
        
        PID:9428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61682.exe
        5⤵
        
        PID:10136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exe
        5⤵
        
        PID:15172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28095.exe
        5⤵
        
        PID:8072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28172.exe
      4⤵
      PID:7752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25066.exe
      4⤵
      PID:11476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2864.exe
      4⤵
      PID:15380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-538.exe
      4⤵
      PID:17596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2108.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63695.exe
      4⤵
      PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16519.exe
        5⤵
        
        PID:1096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36519.exe
        6⤵
        
        PID:9764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe
        6⤵
        
        PID:13592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1041.exe
        6⤵
        
        PID:14132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27753.exe
        5⤵
        
        PID:8608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3064.exe
        5⤵
        
        PID:12712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52474.exe
        5⤵
        
        PID:16632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12413.exe
        5⤵
        
        PID:16528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52206.exe
      4⤵
      PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16595.exe
        5⤵
        
        PID:11448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56121.exe
        5⤵
        
        PID:16596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41490.exe
        5⤵
        
        PID:17864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27072.exe
      4⤵
      PID:9288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7917.exe
      4⤵
      PID:14264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24954.exe
      4⤵
      PID:8932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39537.exe
    3⤵
    PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29155.exe
      4⤵
      PID:6580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37479.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61062.exe
        5⤵
        
        PID:13680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50155.exe
        5⤵
        
        PID:8724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64894.exe
      4⤵
      PID:7700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32612.exe
      4⤵
      PID:12128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-149.exe
      4⤵
      PID:17260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17073.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18938.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18938.exe
    3⤵
    PID:7388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8234.exe
      4⤵
      PID:12244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48286.exe
      4⤵
      PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60330.exe
      4⤵
      PID:18236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57179.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57179.exe
    3⤵
    PID:10524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14717.exe
    3⤵
    PID:14516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60475.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60475.exe
    3⤵
    PID:17584
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60446.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60446.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36643.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10934.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3062.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6902.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16519.exe
        8⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64230.exe
        9⤵
        
        PID:9728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50155.exe
        9⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31837.exe
        8⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10355.exe
        8⤵
        
        PID:12648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52474.exe
        8⤵
        
        PID:16732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21157.exe
        8⤵
        
        PID:17624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13996.exe
        7⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29039.exe
        8⤵
        
        PID:11688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40117.exe
        8⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26889.exe
        8⤵
        
        PID:17744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25811.exe
        7⤵
        
        PID:10192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51965.exe
        7⤵
        
        PID:14300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10493.exe
        7⤵
        
        PID:17008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44946.exe
        6⤵
        
        PID:3772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38631.exe
        7⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13337.exe
        7⤵
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43085.exe
        7⤵
        
        PID:14136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39579.exe
        7⤵
        
        PID:4248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13040.exe
        6⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60840.exe
        7⤵
        
        PID:7596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21308.exe
        6⤵
        
        PID:10560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36392.exe
        6⤵
        
        PID:14548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43926.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39989.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39191.exe
        6⤵
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43846.exe
        7⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49591.exe
        8⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65198.exe
        8⤵
        
        PID:11896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65529.exe
        8⤵
        
        PID:16348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15074.exe
        8⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27753.exe
        7⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43521.exe
        7⤵
        
        PID:12820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60642.exe
        7⤵
        
        PID:16760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30913.exe
        7⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27317.exe
        6⤵
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25811.exe
        6⤵
        
        PID:10220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65094.exe
        6⤵
        
        PID:14036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6409.exe
        6⤵
        
        PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13756.exe
        5⤵
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51909.exe
        6⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53351.exe
        7⤵
        
        PID:12032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23781.exe
        7⤵
        
        PID:16084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59754.exe
        7⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12429.exe
        6⤵
        
        PID:11036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55573.exe
        6⤵
        
        PID:12368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64155.exe
        6⤵
        
        PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26114.exe
        5⤵
        
        PID:6276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3190.exe
        6⤵
        
        PID:12228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38965.exe
        6⤵
        
        PID:15540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6469.exe
        6⤵
        
        PID:7768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24272.exe
        5⤵
        
        PID:6188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43593.exe
        5⤵
        
        PID:13340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11023.exe
        5⤵
        
        PID:1404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7456.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33187.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35299.exe
        6⤵
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36939.exe
        7⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8750.exe
        8⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8405.exe
        8⤵
        
        PID:3628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41025.exe
        8⤵
        
        PID:14560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36455.exe
        8⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27753.exe
        7⤵
        
        PID:8584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31652.exe
        7⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6241.exe
        7⤵
        
        PID:15556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21349.exe
        7⤵
        
        PID:17780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13996.exe
        6⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10530.exe
        7⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51026.exe
        7⤵
        
        PID:16060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43610.exe
        7⤵
        
        PID:16188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6460.exe
        6⤵
        
        PID:10124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65094.exe
        6⤵
        
        PID:14064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24954.exe
        6⤵
        
        PID:9008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        5⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59435.exe
        6⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58307.exe
        7⤵
        
        PID:14924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6138.exe
        7⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17805.exe
        6⤵
        
        PID:10032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37849.exe
        6⤵
        
        PID:13720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27327.exe
        6⤵
        
        PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29378.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12702.exe
        6⤵
        
        PID:12160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40117.exe
        6⤵
        
        PID:4092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7237.exe
        6⤵
        
        PID:18340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14947.exe
        5⤵
        
        PID:10140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17548.exe
        5⤵
        
        PID:14656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4199.exe
        5⤵
        
        PID:18376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53342.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39238.exe
        5⤵
        
        PID:2968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5522.exe
        6⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29991.exe
        7⤵
        
        PID:10164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41321.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19105.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9165.exe
        6⤵
        
        PID:11188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
        6⤵
        
        PID:14364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25931.exe
        6⤵
        
        PID:17848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14437.exe
        5⤵
        
        PID:7760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15116.exe
        5⤵
        
        PID:11464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11529.exe
        5⤵
        
        PID:14044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33409.exe
        5⤵
        
        PID:17800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23016.exe
      4⤵
      PID:5612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30411.exe
        5⤵
        
        PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4396.exe
        5⤵
        
        PID:11308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58566.exe
        5⤵
        
        PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25241.exe
        5⤵
        
        PID:17812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4945.exe
      4⤵
      PID:8016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15861.exe
      4⤵
      PID:11280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59460.exe
      4⤵
      PID:15300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11158.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56627.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47027.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54375.exe
        6⤵
        Executes dropped EXE
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7250.exe
        7⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4842.exe
        8⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37479.exe
        9⤵
        
        PID:9884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61062.exe
        9⤵
        
        PID:13696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21461.exe
        9⤵
        
        PID:1504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3825.exe
        8⤵
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9971.exe
        8⤵
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34493.exe
        8⤵
        
        PID:16872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
        8⤵
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40337.exe
        7⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16595.exe
        8⤵
        
        PID:11172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19697.exe
        8⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19873.exe
        8⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31156.exe
        7⤵
        
        PID:8820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65094.exe
        7⤵
        
        PID:14056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15537.exe
        7⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49030.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17199.exe
        7⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4012.exe
        7⤵
        
        PID:10028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36884.exe
        7⤵
        
        PID:14500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41499.exe
        7⤵
        
        PID:7456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24280.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23997.exe
        6⤵
        
        PID:11332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33365.exe
        6⤵
        
        PID:4928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41340.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10197.exe
        5⤵
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        6⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27334.exe
        7⤵
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35781.exe
        7⤵
        
        PID:11512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3500.exe
        7⤵
        
        PID:15960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21078.exe
        7⤵
        
        PID:17416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6461.exe
        6⤵
        
        PID:8160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18131.exe
        6⤵
        
        PID:11316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10268.exe
        6⤵
        
        PID:14536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33409.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46237.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17583.exe
        6⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39555.exe
        7⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
        7⤵
        
        PID:15188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55862.exe
        7⤵
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28433.exe
        6⤵
        
        PID:10680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21424.exe
        6⤵
        
        PID:13960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53559.exe
        6⤵
        
        PID:9336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2517.exe
        5⤵
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12126.exe
        6⤵
        
        PID:12348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        6⤵
        
        PID:16264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36210.exe
        6⤵
        
        PID:17792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15331.exe
        5⤵
        
        PID:11300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50605.exe
        5⤵
        
        PID:14632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4391.exe
        5⤵
        
        PID:5708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7701.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33166.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39555.exe
        6⤵
        
        PID:10100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
        6⤵
        
        PID:15196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23508.exe
        7⤵
        
        PID:5048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26505.exe
        6⤵
        
        PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14760.exe
        5⤵
        
        PID:8848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3957.exe
        5⤵
        
        PID:12996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26358.exe
        5⤵
        
        PID:16820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34609.exe
        5⤵
        
        PID:5028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58681.exe
      4⤵
      PID:3248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33623.exe
        5⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48771.exe
        6⤵
        
        PID:9816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe
        6⤵
        
        PID:13624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1041.exe
        6⤵
        
        PID:14116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3825.exe
        5⤵
        
        PID:8884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9971.exe
        5⤵
        
        PID:13052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34493.exe
        5⤵
        
        PID:16900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14577.exe
        5⤵
        
        PID:4584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2761.exe
      4⤵
      PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2277.exe
        5⤵
        
        PID:16960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5178.exe
        5⤵
        
        PID:7140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24272.exe
      4⤵
      PID:9232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64271.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64271.exe
      4⤵
      PID:13272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57525.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62749.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62749.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59279.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30063.exe
        5⤵
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19695.exe
        6⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24879.exe
        7⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39555.exe
        8⤵
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
        8⤵
        
        PID:15160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46542.exe
        8⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43981.exe
        7⤵
        
        PID:7900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48950.exe
        7⤵
        
        PID:14172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24954.exe
        7⤵
        
        PID:8760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44614.exe
        6⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27072.exe
        6⤵
        
        PID:9160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19424.exe
        7⤵
        
        PID:1804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48950.exe
        6⤵
        
        PID:14164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11453.exe
        6⤵
        
        PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20249.exe
        5⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60779.exe
        6⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56851.exe
        7⤵
        
        PID:10772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7689.exe
        7⤵
        
        PID:14316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51970.exe
        7⤵
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27089.exe
        6⤵
        
        PID:10748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3744.exe
        6⤵
        
        PID:14768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1234.exe
        6⤵
        
        PID:17560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64244.exe
        5⤵
        
        PID:7112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9765.exe
        6⤵
        
        PID:14556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22474.exe
        6⤵
        
        PID:17548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23997.exe
        5⤵
        
        PID:11344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1603.exe
        5⤵
        
        PID:14604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37486.exe
        5⤵
        
        PID:18016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18941.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18941.exe
      4⤵
      PID:1948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44967.exe
        5⤵
        
        PID:2364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37318.exe
        6⤵
        
        PID:7788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4396.exe
        6⤵
        
        PID:11396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4403.exe
        6⤵
        
        PID:14624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29055.exe
        6⤵
        
        PID:16920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2953.exe
        5⤵
        
        PID:7424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11689.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40764.exe
        5⤵
        
        PID:3268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19376.exe
      4⤵
      PID:5264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11142.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35929.exe
        5⤵
        
        PID:12596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40222.exe
        5⤵
        
        PID:16556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24954.exe
        5⤵
        
        PID:17772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59502.exe
      4⤵
      PID:7640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9000.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
      4⤵
      PID:15564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42020.exe
      4⤵
      PID:8600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43638.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43638.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30639.exe
      4⤵
      PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40883.exe
        5⤵
        
        PID:1392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31785.exe
        6⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24343.exe
        7⤵
        
        PID:17336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7726.exe
        7⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15443.exe
        6⤵
        
        PID:10516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49718.exe
        6⤵
        
        PID:14492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50035.exe
        6⤵
        
        PID:9520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47821.exe
        5⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52163.exe
        6⤵
        
        PID:16976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19978.exe
        6⤵
        
        PID:3612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7576.exe
        5⤵
        
        PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7917.exe
        5⤵
        
        PID:14240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34997.exe
        5⤵
        
        PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33269.exe
      4⤵
      PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30411.exe
        5⤵
        
        PID:8076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5465.exe
        5⤵
        
        PID:11424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5664.exe
        5⤵
        
        PID:15400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57643.exe
        5⤵
        
        PID:5324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64820.exe
      4⤵
      PID:7188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17665.exe
      4⤵
      PID:11796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32604.exe
      4⤵
      PID:15628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37486.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:18068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55341.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55341.exe
    3⤵
    PID:2016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28195.exe
      4⤵
      PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33395.exe
        5⤵
        
        PID:9904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61062.exe
        5⤵
        
        PID:13744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17377.exe
        5⤵
        
        PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55958.exe
      4⤵
      PID:6256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15508.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40222.exe
      4⤵
      PID:16524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6409.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58282.exe
    3⤵
    PID:6364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12266.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58079.exe
      4⤵
      PID:5972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24802.exe
    3⤵
    PID:9256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39128.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39128.exe
    3⤵
    PID:13348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16830.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16830.exe
    3⤵
    PID:1920
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20460.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20460.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57063.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57063.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56051.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2486.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23047.exe
        6⤵
        
        PID:516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33623.exe
        7⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36519.exe
        8⤵
        
        PID:9744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe
        8⤵
        
        PID:13600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17377.exe
        8⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3825.exe
        7⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23292.exe
        7⤵
        
        PID:13012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34493.exe
        7⤵
        
        PID:16864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40810.exe
        7⤵
        
        PID:1732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48122.exe
        6⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57103.exe
        7⤵
        
        PID:14904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41742.exe
        7⤵
        
        PID:17976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25811.exe
        6⤵
        
        PID:10228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65094.exe
        6⤵
        
        PID:14088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11645.exe
        6⤵
        
        PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41053.exe
        5⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4458.exe
        6⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-722.exe
        7⤵
        
        PID:9852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe
        7⤵
        
        PID:13568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50155.exe
        7⤵
        
        PID:8752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56726.exe
        6⤵
        
        PID:7712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32612.exe
        6⤵
        
        PID:3976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26829.exe
        6⤵
        
        PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24716.exe
        5⤵
        
        PID:7008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37406.exe
        5⤵
        
        PID:10020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23756.exe
        5⤵
        
        PID:13928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60647.exe
        5⤵
        
        PID:5956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15677.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34421.exe
        5⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30411.exe
        6⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37067.exe
        7⤵
        
        PID:15680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46019.exe
        7⤵
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5465.exe
        6⤵
        
        PID:11440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5664.exe
        6⤵
        
        PID:15372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
        6⤵
        
        PID:17284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34140.exe
        5⤵
        
        PID:8200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17665.exe
        5⤵
        
        PID:11840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32604.exe
        5⤵
        
        PID:15576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57907.exe
        5⤵
        
        PID:17716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58873.exe
      4⤵
      PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35869.exe
        5⤵
        
        PID:7292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2176.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-309.exe
        5⤵
        
        PID:15848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20919.exe
        5⤵
        
        PID:6840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64406.exe
      4⤵
      PID:6976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12944.exe
      4⤵
      PID:5316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48253.exe
      4⤵
      PID:14288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56140.exe
      4⤵
      PID:15904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35116.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35116.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2870.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8957.exe
        5⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4842.exe
        6⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37399.exe
        7⤵
        
        PID:12772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41041.exe
        7⤵
        
        PID:16584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63262.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7909.exe
        6⤵
        
        PID:8980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64133.exe
        6⤵
        
        PID:13112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34493.exe
        6⤵
        
        PID:16812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53254.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61556.exe
        5⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61327.exe
        6⤵
        
        PID:12576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20621.exe
        6⤵
        
        PID:16504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43610.exe
        6⤵
        
        PID:3972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13441.exe
        5⤵
        
        PID:9624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64789.exe
        5⤵
        
        PID:14184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2126.exe
        5⤵
        
        PID:864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56274.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56274.exe
      4⤵
      PID:264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-758.exe
        5⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48771.exe
        6⤵
        
        PID:9832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe
        6⤵
        
        PID:13584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62494.exe
        6⤵
        
        PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3825.exe
        5⤵
        
        PID:8876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9971.exe
        5⤵
        
        PID:13080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34493.exe
        5⤵
        
        PID:16856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40810.exe
        5⤵
        
        PID:14220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60212.exe
      4⤵
      PID:6472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12126.exe
        5⤵
        
        PID:12332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44394.exe
        5⤵
        
        PID:16272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43610.exe
        5⤵
        
        PID:14260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32938.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64789.exe
      4⤵
      PID:14332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52479.exe
      4⤵
      PID:5948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13460.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13460.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24996.exe
      4⤵
      PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58615.exe
        5⤵
        
        PID:7072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32709.exe
        5⤵
        
        PID:10476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49437.exe
        5⤵
        
        PID:15320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41499.exe
        5⤵
        
        PID:1952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27946.exe
      4⤵
      PID:8244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7081.exe
      4⤵
      PID:12296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55859.exe
      4⤵
      PID:16328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
      4⤵
      PID:4128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63622.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63622.exe
    3⤵
    PID:4888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37131.exe
      4⤵
      PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36519.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe
        5⤵
        
        PID:13608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50155.exe
        5⤵
        
        PID:9096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43981.exe
      4⤵
      PID:9124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
      4⤵
      PID:13264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15333.exe
      4⤵
      PID:16940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63778.exe
      4⤵
      PID:3380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22684.exe
    3⤵
    PID:6776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11821.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11821.exe
    3⤵
    PID:10084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60659.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60659.exe
    3⤵
    PID:13320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5829.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5829.exe
    3⤵
    PID:5540
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11681.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11681.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42537.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12766.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19887.exe
        5⤵
        
        PID:4100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64287.exe
        6⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        7⤵
        
        PID:12104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59770.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30119.exe
        7⤵
        
        PID:20040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1708.exe
        6⤵
        
        PID:10500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39193.exe
        6⤵
        
        PID:14564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49475.exe
        6⤵
        
        PID:14832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16985.exe
        5⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38219.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6138.exe
        6⤵
        
        PID:17604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9880.exe
        5⤵
        
        PID:11192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42858.exe
        5⤵
        
        PID:14960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27405.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24141.exe
      4⤵
      PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37323.exe
        5⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7850.exe
        6⤵
        
        PID:12448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52178.exe
        6⤵
        
        PID:15864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64030.exe
        6⤵
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64894.exe
        5⤵
        
        PID:8240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32612.exe
        5⤵
        
        PID:12196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-149.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33890.exe
        5⤵
        
        PID:6268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21208.exe
      4⤵
      PID:7396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64230.exe
        5⤵
        
        PID:9644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11093.exe
        5⤵
        
        PID:13432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52805.exe
        5⤵
        
        PID:17332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57067.exe
        5⤵
        
        PID:5860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49073.exe
      4⤵
      PID:4596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36342.exe
      4⤵
      PID:16168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45465.exe
      4⤵
      PID:17912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22972.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64811.exe
      4⤵
      PID:1232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29451.exe
        5⤵
        
        PID:7404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25907.exe
        6⤵
        
        PID:11216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8649.exe
        6⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56054.exe
        6⤵
        
        PID:15412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9165.exe
        5⤵
        
        PID:11056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58373.exe
        5⤵
        
        PID:13440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24971.exe
        5⤵
        
        PID:7652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14437.exe
      4⤵
      PID:7740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19200.exe
      4⤵
      PID:11452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11529.exe
      4⤵
      PID:1492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3669.exe
      4⤵
      PID:18400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19429.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19429.exe
    3⤵
    PID:5652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28963.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6444
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6444 -s 488
        5⤵
        Program crash
        
        PID:9084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16269.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
      4⤵
      PID:13256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15333.exe
      4⤵
      PID:16932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49170.exe
      4⤵
      PID:8208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22684.exe
    3⤵
    PID:6860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7737.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7737.exe
    3⤵
    PID:9452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65319.exe
    3⤵
    PID:14252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5829.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5829.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5536
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14640.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14640.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10846.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10846.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34421.exe
      4⤵
      PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42575.exe
        5⤵
        
        PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44778.exe
        5⤵
        
        PID:12136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39572.exe
        5⤵
        
        PID:15780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5318.exe
        5⤵
        
        PID:17456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35948.exe
      4⤵
      PID:9324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16977.exe
      4⤵
      PID:12340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49191.exe
      4⤵
      PID:17232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59113.exe
      4⤵
      PID:3968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
    3⤵
    PID:5452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34547.exe
      4⤵
      PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39555.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
        5⤵
        
        PID:15124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59754.exe
        5⤵
        
        PID:5884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17421.exe
      4⤵
      PID:7108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59229.exe
      4⤵
      PID:14048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19158.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27214.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27214.exe
    3⤵
    PID:6272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9045.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9045.exe
    3⤵
    PID:13276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52740.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52740.exe
    3⤵
    PID:17008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34126.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34126.exe
    3⤵
    PID:13404
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55194.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55194.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10602.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10602.exe
    3⤵
    PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37323.exe
      4⤵
      PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe
        5⤵
        
        PID:8720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29785.exe
        5⤵
        
        PID:12840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54777.exe
        5⤵
        
        PID:16780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50426.exe
        5⤵
        
        PID:3720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64894.exe
      4⤵
      PID:7048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32612.exe
      4⤵
      PID:11792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-149.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12989.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12989.exe
      4⤵
      PID:17464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7473.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7473.exe
    3⤵
    PID:7376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57738.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57738.exe
    3⤵
    PID:9016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40765.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40765.exe
    3⤵
    PID:16136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25196.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25196.exe
    3⤵
    PID:3360
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56603.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56603.exe
  2⤵
  PID:5160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8542.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8542.exe
    3⤵
    PID:6480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44687.exe
      4⤵
      PID:9776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe
      4⤵
      PID:13616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50155.exe
      4⤵
      PID:17932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8101.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8101.exe
    3⤵
    PID:9152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3640.exe
    3⤵
    PID:13240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15333.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15333.exe
    3⤵
    PID:16924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44510.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44510.exe
    3⤵
    PID:18080
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30272.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30272.exe
  2⤵
  PID:6868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39555.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39555.exe
    3⤵
    PID:2892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
    3⤵
    PID:15112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26697.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26697.exe
    3⤵
    PID:6680
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63474.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63474.exe
  2⤵
  PID:9240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37993.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37993.exe
  2⤵
  PID:12660
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27119.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27119.exe
  2⤵
  PID:5320

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 6444 -ip 6444
1⤵
PID:7108

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10809.exe

Filesize
468KB

MD5
0320a50699e705568d5fa3ca9b06ca5c

SHA1
36c683a26cfbf1de4d0900ff3a4cd941790ae8fe

SHA256
2d3f8b9d17d88b42c8951909504d4363c206e4624db9654cf2ed4f4350795701

SHA512
b8ccb1e44ea403862edff1a57145e3a7f5d56783e86d18a6022d7ac2112b8a4858fad3b3a1d8d72260963419d4b79f776201d749af7261424fcd044c89e57a80

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10934.exe

Filesize
468KB

MD5
4254c03c6f8dc3e4de59a7ade9fa80a1

SHA1
e7463a54a564d2c542ceaef2a49164958e8b96bd

SHA256
f5303b4871782e98c0584f1164382f30de7f8e1458ee81fcc4f675f957f5bf66

SHA512
400cef85aa448fd88b01e157e1784e61a98390a136988a6309181276b0b4fc3f62eacf5f97cdbafc563e8b37859c6477d09ac01b5136ee19f2816f5abe2135cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11681.exe

Filesize
468KB

MD5
be0032b5468c63b4ba68cab7bf6e0573

SHA1
059af3cd20eb7662a809941f10e2fb662d55bc9a

SHA256
981937c30d64fa0037201b995afd53b22f9da526ca520d706c1ad43c122495d2

SHA512
c288855ce434de4a215c7be7279512ebb0667563518bdce7d348c23db421e3bed46c5fcfd605a801905e7be332666eda757df554ab326a0cf590d16c9dec4f0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11800.exe

Filesize
468KB

MD5
3c66c54621123c2a5e8985cc7b349b5b

SHA1
f572e17eea44af8988288f4dd192376f87512751

SHA256
35423d6c43ebcb8e398174fefb79e5cfbbeb5a99926633aa6c0cb6777a69d427

SHA512
fab5506b3b2b3d526e71e9ca31bc132562ba126b7428f9fecd6e74482a917fb72c232bcb0c9ddca92b673156224df29a8e6f7ace5aafc344dc5c71ed1b254e65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14640.exe

Filesize
468KB

MD5
25bc6fb0b5aa65e986b62bc6986f7bd9

SHA1
420b3fd31e1f17bf20d58cd7e5e3b9e119e3aa50

SHA256
45300c78c66315fdabf5511b7a3ef1ca623d893fcaf6b5f48dd2e31387cd050f

SHA512
12f0e785ecba4b1df7a1210ee447e1395765e5b36560ffe88e20821fd51845e9f42538a92e95512245912bd5575521229716bb1af64248addb8b5f18f010e42f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15018.exe

Filesize
468KB

MD5
f8be03bd370471ed23d8e8fd7439dca9

SHA1
575aa9bb7f20c1eb11343cc5569f3a93f4538224

SHA256
f8609baffe9f20002de7fe3b3970f51ce996a9273c1a91420e04026cf081e37e

SHA512
708fa80bad86c6ee1b6949d34e9b59efed23eea1255c7277ab77c07b3894044849835ca9386a2cf111e9d1c806c3d4a39b184bc4fbaede4f6ad8f460e594dc48

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16179.exe

Filesize
468KB

MD5
2892b655d6f9eefb704b701bab077c54

SHA1
0eca4d0dad919c3b7c8078b12d28bbaa48322d4e

SHA256
45136bd8a5706471078525e18c9f4ea534938171805d1812e3373f4c6428e49d

SHA512
44a67ab92c08fe24722c2d9e374422d093381df2098934deeadaa9779426a7c8caa50b1a5aeab92aef8ad5c93c134a9f500c76937b4456433002251f208d3065

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1732.exe

Filesize
468KB

MD5
0b2baa6c3890e98776fd647564aca0d6

SHA1
d2e1f15e4380dc83f0e58bc9dcd73b2be9845114

SHA256
29b4d65c3272a318977850817b5adbc16f8ac6df4f592aab3fe9b687bf2fd140

SHA512
620d44c21e1914170b80b8a248482f0c3b5d178b191857bac2ece5a103f5197810e2917e1f7c515f03f620b3197b8619e346ee438292c65d9b25e76e5ad959e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18859.exe

Filesize
468KB

MD5
9bc383ec2bcd5883215b82146b7153b0

SHA1
6886ff2c6e0b1819b8cf98becc5ced967829f020

SHA256
0f524eb4c0dbddabb581764f3d8003530fa1673486dc331874f8b0a86c7e24bb

SHA512
d8bfa3ca6827bbd15f010a52fb158bd7bc5543ccf1e98c1e6fa7341963a80498ae835012e9185021b936480507dff14e60f3845ff0f70816ba4a4654b1f4d5aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20460.exe

Filesize
468KB

MD5
0bdcee9feb0ab98911ca8af883dac20b

SHA1
a7f8cd8a684c253d72585f97a806f6632bc992a3

SHA256
6e1e6475eb585a58d9c230377befc46f2a0a22910c4e744c3973062959fc718c

SHA512
3e1f55b2c640ab787b4a5f2de344518587ef0c9b332115f92f6ab73ebba9705445f9b21c05eb296e1f2a5d6ec238b850a5a3de2bf9807ab2014f31e9a3ba57ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22310.exe

Filesize
468KB

MD5
c1686aa82890ddcddad2b2737363cf3f

SHA1
1b620cebd041fdf3b010d0012c1cb2bd1c156907

SHA256
7a69a294cf58719413407107a91be31301fa9fb1f38c930a04e481e15a7b402f

SHA512
c3529eef292f9d750c349adc1c3412f8cdd1455226f3152b38162d7551b6fae25bd278e5b475f81ae1b87a36375b5048bf10f68743090b943c95dea4538ed773

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2501.exe

Filesize
468KB

MD5
954e1daff396365d310e2097e992ab45

SHA1
35a54987de66a85e885f39cc11281e88c16d9055

SHA256
96e39f5164744e2985606270f85c0653fc038cda6a55ec0a87f19e66fd396033

SHA512
60648c693cbb3d45165e13254c5425f8664b868a80d9c5f14aa776a748c428caa675dea65fbbaeaf9c9f9173f1da26ab0f415700166b67f8a5d947f574609c12

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-270.exe

Filesize
468KB

MD5
1cb910e2768e1f179f259858999148cb

SHA1
54865e4b79c6addfe441696a198adb3bec6c38a4

SHA256
2c4286befccb7fb8bde81b3fce4d6cbb29965f5e22c1073afd63f40e2336be45

SHA512
72cf7a27e63ead89ad7c606f7475515275e04a31c899de8fe0930b265c3ae52fd75f5b2940731e8bc1915b9ff420875b85d6eb62754bf6716d8aed6b1ae41133

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2766.exe

Filesize
468KB

MD5
9b7bd29c519e27c71df56bc943e740ce

SHA1
a2dc0e3755cb6f2c87515238ca7f0e2c3633c9f3

SHA256
5a6a9ef803b4173f3eda417b03e93c26cee31c25f0a5ea1286e66e421891c624

SHA512
09d22144e0b1220eff362b33596510ddf6d5443d36c2eb143e60469ca4435a09fd88e5d26eaf680176b01cab4e53e0fe97fa3939633bbab68542960478d206f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30675.exe

Filesize
468KB

MD5
36b84cdb049439fd683af1768b7395c6

SHA1
27faa06862d70769c6821919216c7a3ecc2a23d6

SHA256
a14e7943ed6970beaf1c11ef26778c8f6f0e95f605ce43ffb46966fca44bf095

SHA512
65c5d1b4ff28a12760645799b1bfe486331e0bfeb0455e6fb1fc65dbe09aa2daff46b7f8d0b26df4e863e7d89a3463f0f5e38bf3ccd4785555167797f175d6b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe

Filesize
468KB

MD5
45507551debc6add656f4d1a485f374c

SHA1
712aeb76654fa45b7ddf176b0c8657f25431d498

SHA256
64ca0c3dff0b298bfe6cc190bed83eb6e49d1a49eea0566e4432c1885a685b77

SHA512
5b5488907b410a3bda2fa406b304b3918b96b0525b20953fdb5158495268b16bd72d6dea29e40ae9bc90ffaa7941953e923de8030f60f934582d99a9145ec197

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35116.exe

Filesize
468KB

MD5
c9d3a470521e98089eb43c831a93112a

SHA1
3ec57bdc694e0ae8b2b80f8b2a346dbf4f3efcd7

SHA256
3ffd1351d7219fa41d0f1f245687508c3154e6262df25fef651e16811a82ec18

SHA512
c5e6c4cf5a8ec48d55a7a6ed4fa24f79aeb6ae297c2ef3e935a95bfdc5154f3e5f8c0414a9b0cf05415a7206dbfe503bddae038294f58a9c0fda1ef6d2e66e00

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35692.exe

Filesize
468KB

MD5
00e314788490cb2b5f7cce9607c071e4

SHA1
62cbc2b8a443a37bcf7b350136a44e96f84a5f62

SHA256
cdc25c676d5f3b2fbb29d30b93f2a98fea07b4542732db1efc490c5ba39e31d2

SHA512
286b4d8667cbb8cc32d44d6962e4694f78c442385a901b02a62a71ef93df1e030c37580b2a274eec7758c20e693b2a27483a649ddb094f313a12bd845e66b7b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36643.exe

Filesize
468KB

MD5
d1061b59494cb93c8fab5c8a58ef3875

SHA1
240277fe8123e77697bb8027e3d2bcc51564a652

SHA256
4e80dc4ea65d6b4a8ae0bd1ac7ed43792ba52376ade1c83cdd9d3f297b44148a

SHA512
53c6d43b3083adeba4eb58511e9ea65c87eb6fdcad0cfc5f6dba9731c425af1bd4b9abb5a757da9e1477fef011741e30dd1e0f4b63f862537e0e7a897fd35135

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3705.exe

Filesize
468KB

MD5
777d7ea7abfdbf579ab4a842d7f611dc

SHA1
72d63461141aa526b439aca250869707f2777e19

SHA256
f2e86e147b1be342c648b085536bd466089784726ec1eb2a51c760ac3ac562aa

SHA512
67b3f9249743f3b4a901668c76db6fa935cbb479f544af7c94982fae10d3e7d9f71d244eb59b8129ec431f62971b82f88c424ab32c0374fb31e80ddd8287beda

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37203.exe

Filesize
468KB

MD5
d894ef594cd5d6735e511cee32e64e61

SHA1
5657722ceb2b1a28c52ebd1ac7bf2f14bbc647a7

SHA256
8ecbb343f9635af6969c59ac0966b4255cb35fe172a9f1ba23f4705f922a4dd0

SHA512
5a95165156fa57deecad9260a7de7bf70fb98c130b61f2dd695de86e11bb51be8e8298a810c0d65a99d62da54e9c0688dbbf389cf4fa99a14b97e31a72452c7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42537.exe

Filesize
468KB

MD5
36403eb8696d43b5868876d0d1815aa4

SHA1
c6abbff401838dd96a8294ecb2605761b1403cde

SHA256
8da77988be994760919b47bd48650129ce6483be07c588c18bbe6737e266a76a

SHA512
31d2cf0cf9433472ba69024550b6dd28b38397dcf3b2f7e0246f0c404f8d9ad14c5ba69bfd6940eb111058da90d668d4827d1b245bb3ff5ad86cab0859eb5a30

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43846.exe

Filesize
468KB

MD5
eeaeefd7c256303df0711efd808a14c3

SHA1
df5a442803345855b6b69bd276057dc9083b4876

SHA256
9a23079b842dd0710c167eb86ebb12dc4421fbf1d87788ea67a915d7dcb83cfd

SHA512
f5ebf56c2607525dc4576a149b26760c79c42551632d516cca2f16a655743408559b9fe67b23480f8b87f375c14e3ad9f9dbfc75b376f303797940a354ee5870

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4525.exe

Filesize
468KB

MD5
0c907a716f94d642c3d9acaa19c96e85

SHA1
c9e681d2fee3d1b60041c2a0e534b562b22841e5

SHA256
a3d8806eb9c5944ed67beab4c739ec544bc9be5ef166046166c84c1882c0ab5a

SHA512
6fbf3bc6cf0b58d240189cb647fe44f67af2dcd6f448a3bdfd91c3e4422ef2b093fc074d8e4dcd7f060467cd2e6a0d6de80a4a95b5d228592404a617dacb4cbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47027.exe

Filesize
468KB

MD5
c5d68b3260ff386f1770ea9db6121885

SHA1
d986b4c7bd88ad4e4796b35ed4e111b9d9b83c92

SHA256
a483e49b2e89276b09f52cb3da976548d6d38fc78f8054480761adbfe294ebdc

SHA512
08c9dc70ee139afafedae2094cf01dc8461242f3f804b05ba6d76e3a136c9009f67c9508759117d3dd7baccddcf52a4a55c9dc1cc8bc7de2cd4340ee9cd8ab5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52979.exe

Filesize
468KB

MD5
b77db7d84f7081bfbd5a4eb414208f63

SHA1
49915b3a9fd0cbdab3de5a80399f351d6df9310d

SHA256
bc83aa478fd165f2b0db1a34d0cab724910cb1fe7909ff20dceccc62677a2cd4

SHA512
4d7bb5bbd774d4e90523695adec5fb71f2daf9bfd2640104beca42b455d1a551890880c4cfd5cdc713808c978eaacf73ecbac90bbc5ad79e07e2b038d309f3ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56051.exe

Filesize
468KB

MD5
3178e9e9184bd5bb5762353be156cedf

SHA1
06be118e919751fef60be8c69771fc400f882cda

SHA256
3707a70b316c139011e936c7bbd016a6a2d9ec49c04b2998a4cecb95413bf38e

SHA512
b324e81d5eb468c1888b1ddbc502df0e340a4a80eac58b930f13daa8d43931555fd16eb3e92698aafa3771313d46e7497b50a9fc936826c3cdd5929e863d7ebf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56627.exe

Filesize
468KB

MD5
a78551a39fe9f7f70f72e7ca0c114903

SHA1
dacf80fe67e0f4279c85691a189ff60ad05f53f4

SHA256
1ee0daab419bafce9ac58df511085530e048a8af6b2c96cd9b7eb18d2d736ac4

SHA512
ec4ff77a14f1f50c31406b3407f844b096c3f6ed396a50187c03cc55ffc2e906e92fb84ac17d0143b3d074fc606b555eab212c87de0abcbfd57ee57c9b743986

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57063.exe

Filesize
468KB

MD5
b645b0bc57b88dfb254d3969aedbd5d5

SHA1
98333aba5f869b26489638a43b2a8738dc3ed810

SHA256
63a6d0c41a454e91eed01ee66450e766b12333a2e74bbaf1bf7aab88187560fd

SHA512
5c904df97314ba062c4355339ac0c0a5f6eae5783e6c07915c20d614729e123e01aa55af56a3e4fd29d072e245cf0f81261f7c0b1854392e425993dbbcf6f7f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59661.exe

Filesize
468KB

MD5
fe2aa36bd55d7bce89fb368019b39535

SHA1
3675e00f576f9c1694426921cb6f7bde9d18c5e9

SHA256
fd82b0d43cc264d8100d8a70a20dd4bcbd529e6a9368bbadfdcebae13dab286a

SHA512
81cf34f02be775b2ee20d3617a7c7b78880115bc1a487e8f96ad8672368beffef47f1fe1e77b048bcacb5aebeb48f10179ca12f470583399572bbf6ed8aaeb2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60446.exe

Filesize
468KB

MD5
c2a653f76cf197e5de09b49635155f32

SHA1
bd6f259bd983b4d8335bc925d00cba35d79815fb

SHA256
2eef5a48ac878c38f8fcb36bff564c44a82e350a5f395670fa56d16dd7af7ae0

SHA512
ae5dff9ab454bb4b9818c7dd7e62743208f2038c4506e3bf76730200e503a72ae80c9a2f541f6a73e5e4e2ca3c6afefc509c5190281bf4c0281c7e850c72b7ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60711.exe

Filesize
468KB

MD5
416652fd33c0958d94d9c4b42aab8182

SHA1
877c745b7ddd320f38db2e520d1b1ff02d723c08

SHA256
681e068688f9f5382a2588aee0c86e61ec5d3dff6d2832794efa6705683c1cf4

SHA512
3f96bb66158f8d76294ece3f6934a16105b2bf2de9a10ee33e37b86c352a792493737bb9d9c9c5bfcc2e9acb5712c6628aa7bcbfa0db2126cb3a30724fd2b303

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62749.exe

Filesize
468KB

MD5
da9b91f70a8263323ac1bd063c3b938b

SHA1
71b237d6e00d53d2fb1a675285c79ee6fa88d51c

SHA256
a7a493d7f23e9e132382bb7ca25917f5bbaf18c7c6110c0888cd5106e8b0bc99

SHA512
082917d4e687ac81c8b7c3616fab5c04f1dd06bbe3be900192bc0c17be1150bd7db8cefd9205674e474c9c448633ccd74edde4a6d1112a836bdcaf7dbe4dfd28

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7456.exe

Filesize
468KB

MD5
401fee07fb086a1cfd70f105fdbb163e

SHA1
4676c098be3b80eba4771cfd4e772fe35f043668

SHA256
42a3e5281f575c38e7bb702b7cb76f8435b94513170f34956b146c2e021ea03e

SHA512
482dd205ac85d5c752f73da57ceef9744baadf2025603db1e0e7505520249fa296c69e73825c835fe930ea0558da090f4f247e7dac529b5587b0d49dac3a593c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9102.exe

Filesize
468KB

MD5
b6fc93390eefa226ee80d1885b813977

SHA1
caf741d5d30e317861920d3b1dd01e825e46f201

SHA256
ec7c3862fc5229ab355792a5d3e56c14891243b7c8d57a6dd9c3adff8c86ead5

SHA512
88c5381b46017c2b2b7a25def48365a646a9bd9a37ac7d976b3ada2c7f03d7f6bef3768ffba2f0053e575ad1d6521d685d8acf4e53a9f59db0f07a6ebe4975b8

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads