6efc5b7a231f3d1940f3556bc19a766ce819086bde30a5f3d3028608080a6730

Analysis

max time kernel
142s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2024, 23:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6efc5b7a231f3d1940f3556bc19a766ce819086bde30a5f3d3028608080a6730.exe
Size

468KB
MD5

39379e143512b9da6f094604bff4be95
SHA1

a5ff333e2cec9833077f45c7e327c01a5e77dd91
SHA256

6efc5b7a231f3d1940f3556bc19a766ce819086bde30a5f3d3028608080a6730
SHA512

58a74c5d9b25b8735dcaef3571751ef53bc5ee9639f1a6a1e8111cfa9cf0280d1338525a587248a83db8925e2f0e2985ce08bd33f7cbea58c29c001d18df8667
SSDEEP

3072:KbQgoD7nI05UtbY+P/tjcf8/VCMvCzupbLKHeGVs0rfs84cE7O/lQ:KbjoY8Ut5P1jcfp+dIrfVxE7O

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
540	Unicorn-3146.exe
4296	Unicorn-20443.exe
3228	Unicorn-577.exe
3392	Unicorn-58543.exe
3116	Unicorn-25770.exe
2896	Unicorn-12035.exe
3748	Unicorn-13187.exe
4848	Unicorn-8932.exe
2524	Unicorn-43935.exe
1812	Unicorn-24069.exe
1992	Unicorn-17293.exe
5016	Unicorn-17027.exe
3784	Unicorn-15246.exe
4976	Unicorn-38829.exe
2352	Unicorn-36783.exe
3532	Unicorn-22301.exe
3556	Unicorn-26385.exe
924	Unicorn-61195.exe
4116	Unicorn-55065.exe
4512	Unicorn-15263.exe
1056	Unicorn-35129.exe
4968	Unicorn-30282.exe
2100	Unicorn-39213.exe
4668	Unicorn-39213.exe
1924	Unicorn-27515.exe
1144	Unicorn-47116.exe
3664	Unicorn-29675.exe
464	Unicorn-48896.exe
1608	Unicorn-3224.exe
1532	Unicorn-7043.exe
4556	Unicorn-7592.exe
4936	Unicorn-21891.exe
4004	Unicorn-21891.exe
1936	Unicorn-57448.exe
2044	Unicorn-51034.exe
4368	Unicorn-56509.exe
3156	Unicorn-44812.exe
4392	Unicorn-29867.exe
3724	Unicorn-11584.exe
640	Unicorn-40265.exe
1560	Unicorn-26529.exe
3904	Unicorn-50479.exe
620	Unicorn-54563.exe
2848	Unicorn-42865.exe
3128	Unicorn-31818.exe
1852	Unicorn-10022.exe
2632	Unicorn-10022.exe
4268	Unicorn-48917.exe
936	Unicorn-18191.exe
380	Unicorn-2409.exe
3412	Unicorn-16144.exe
5004	Unicorn-35703.exe
3092	Unicorn-64988.exe
4880	Unicorn-15237.exe
1596	Unicorn-22467.exe
2776	Unicorn-26551.exe
1272	Unicorn-6685.exe
3716	Unicorn-60791.exe
4916	Unicorn-63591.exe
2284	Unicorn-39571.exe
2028	Unicorn-55907.exe
4324	Unicorn-55642.exe
2536	Unicorn-33349.exe
3508	Unicorn-37241.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
9900	5484	WerFault.exe	242
15896	14864	Process not Found	1124

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46671.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50623.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50151.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20987.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22460.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34328.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10350.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59253.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20889.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28217.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7962.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4267.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17827.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29582.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28404.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43275.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23920.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46879.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12243.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57106.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27515.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55336.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51661.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58833.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53053.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35508.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23353.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63328.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17048	dwm.exe
Token: SeChangeNotifyPrivilege	17048	dwm.exe
Token: 33	17048	dwm.exe
Token: SeIncBasePriorityPrivilege	17048	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1544	6efc5b7a231f3d1940f3556bc19a766ce819086bde30a5f3d3028608080a6730.exe
540	Unicorn-3146.exe
3228	Unicorn-577.exe
4296	Unicorn-20443.exe
3392	Unicorn-58543.exe
3116	Unicorn-25770.exe
2896	Unicorn-12035.exe
3748	Unicorn-13187.exe
1812	Unicorn-24069.exe
2524	Unicorn-43935.exe
4848	Unicorn-8932.exe
1992	Unicorn-17293.exe
3784	Unicorn-15246.exe
5016	Unicorn-17027.exe
4976	Unicorn-38829.exe
2352	Unicorn-36783.exe
3532	Unicorn-22301.exe
3556	Unicorn-26385.exe
1924	Unicorn-27515.exe
1056	Unicorn-35129.exe
4668	Unicorn-39213.exe
924	Unicorn-61195.exe
4968	Unicorn-30282.exe
4512	Unicorn-15263.exe
4116	Unicorn-55065.exe
1144	Unicorn-47116.exe
2100	Unicorn-39213.exe
1608	Unicorn-3224.exe
1532	Unicorn-7043.exe
464	Unicorn-48896.exe
4556	Unicorn-7592.exe
4936	Unicorn-21891.exe
4004	Unicorn-21891.exe
1936	Unicorn-57448.exe
2044	Unicorn-51034.exe
4368	Unicorn-56509.exe
3156	Unicorn-44812.exe
4392	Unicorn-29867.exe
3724	Unicorn-11584.exe
1560	Unicorn-26529.exe
640	Unicorn-40265.exe
3904	Unicorn-50479.exe
2848	Unicorn-42865.exe
620	Unicorn-54563.exe
3128	Unicorn-31818.exe
2632	Unicorn-10022.exe
936	Unicorn-18191.exe
4268	Unicorn-48917.exe
1852	Unicorn-10022.exe
3412	Unicorn-16144.exe
380	Unicorn-2409.exe
5004	Unicorn-35703.exe
3092	Unicorn-64988.exe
4880	Unicorn-15237.exe
1596	Unicorn-22467.exe
1272	Unicorn-6685.exe
2776	Unicorn-26551.exe
4916	Unicorn-63591.exe
3716	Unicorn-60791.exe
2284	Unicorn-39571.exe
2536	Unicorn-33349.exe
4324	Unicorn-55642.exe
2028	Unicorn-55907.exe
3508	Unicorn-37241.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1544 wrote to memory of 540	1544	6efc5b7a231f3d1940f3556bc19a766ce819086bde30a5f3d3028608080a6730.exe	86
PID 1544 wrote to memory of 540	1544	6efc5b7a231f3d1940f3556bc19a766ce819086bde30a5f3d3028608080a6730.exe	86
PID 1544 wrote to memory of 540	1544	6efc5b7a231f3d1940f3556bc19a766ce819086bde30a5f3d3028608080a6730.exe	86
PID 540 wrote to memory of 4296	540	Unicorn-3146.exe	87
PID 540 wrote to memory of 4296	540	Unicorn-3146.exe	87
PID 540 wrote to memory of 4296	540	Unicorn-3146.exe	87
PID 1544 wrote to memory of 3228	1544	6efc5b7a231f3d1940f3556bc19a766ce819086bde30a5f3d3028608080a6730.exe	88
PID 1544 wrote to memory of 3228	1544	6efc5b7a231f3d1940f3556bc19a766ce819086bde30a5f3d3028608080a6730.exe	88
PID 1544 wrote to memory of 3228	1544	6efc5b7a231f3d1940f3556bc19a766ce819086bde30a5f3d3028608080a6730.exe	88
PID 3228 wrote to memory of 3392	3228	Unicorn-577.exe	89
PID 3228 wrote to memory of 3392	3228	Unicorn-577.exe	89
PID 3228 wrote to memory of 3392	3228	Unicorn-577.exe	89
PID 1544 wrote to memory of 3116	1544	6efc5b7a231f3d1940f3556bc19a766ce819086bde30a5f3d3028608080a6730.exe	90
PID 1544 wrote to memory of 3116	1544	6efc5b7a231f3d1940f3556bc19a766ce819086bde30a5f3d3028608080a6730.exe	90
PID 1544 wrote to memory of 3116	1544	6efc5b7a231f3d1940f3556bc19a766ce819086bde30a5f3d3028608080a6730.exe	90
PID 540 wrote to memory of 2896	540	Unicorn-3146.exe	91
PID 540 wrote to memory of 2896	540	Unicorn-3146.exe	91
PID 540 wrote to memory of 2896	540	Unicorn-3146.exe	91
PID 4296 wrote to memory of 3748	4296	Unicorn-20443.exe	92
PID 4296 wrote to memory of 3748	4296	Unicorn-20443.exe	92
PID 4296 wrote to memory of 3748	4296	Unicorn-20443.exe	92
PID 3392 wrote to memory of 4848	3392	Unicorn-58543.exe	93
PID 3392 wrote to memory of 4848	3392	Unicorn-58543.exe	93
PID 3392 wrote to memory of 4848	3392	Unicorn-58543.exe	93
PID 3116 wrote to memory of 2524	3116	Unicorn-25770.exe	95
PID 3116 wrote to memory of 2524	3116	Unicorn-25770.exe	95
PID 3116 wrote to memory of 2524	3116	Unicorn-25770.exe	95
PID 3228 wrote to memory of 1812	3228	Unicorn-577.exe	94
PID 3228 wrote to memory of 1812	3228	Unicorn-577.exe	94
PID 3228 wrote to memory of 1812	3228	Unicorn-577.exe	94
PID 2896 wrote to memory of 1992	2896	Unicorn-12035.exe	96
PID 2896 wrote to memory of 1992	2896	Unicorn-12035.exe	96
PID 2896 wrote to memory of 1992	2896	Unicorn-12035.exe	96
PID 1544 wrote to memory of 5016	1544	6efc5b7a231f3d1940f3556bc19a766ce819086bde30a5f3d3028608080a6730.exe	97
PID 1544 wrote to memory of 5016	1544	6efc5b7a231f3d1940f3556bc19a766ce819086bde30a5f3d3028608080a6730.exe	97
PID 1544 wrote to memory of 5016	1544	6efc5b7a231f3d1940f3556bc19a766ce819086bde30a5f3d3028608080a6730.exe	97
PID 540 wrote to memory of 3784	540	Unicorn-3146.exe	98
PID 540 wrote to memory of 3784	540	Unicorn-3146.exe	98
PID 540 wrote to memory of 3784	540	Unicorn-3146.exe	98
PID 3748 wrote to memory of 4976	3748	Unicorn-13187.exe	99
PID 3748 wrote to memory of 4976	3748	Unicorn-13187.exe	99
PID 3748 wrote to memory of 4976	3748	Unicorn-13187.exe	99
PID 4296 wrote to memory of 2352	4296	Unicorn-20443.exe	100
PID 4296 wrote to memory of 2352	4296	Unicorn-20443.exe	100
PID 4296 wrote to memory of 2352	4296	Unicorn-20443.exe	100
PID 2524 wrote to memory of 3532	2524	Unicorn-43935.exe	101
PID 2524 wrote to memory of 3532	2524	Unicorn-43935.exe	101
PID 2524 wrote to memory of 3532	2524	Unicorn-43935.exe	101
PID 1812 wrote to memory of 3556	1812	Unicorn-24069.exe	102
PID 1812 wrote to memory of 3556	1812	Unicorn-24069.exe	102
PID 1812 wrote to memory of 3556	1812	Unicorn-24069.exe	102
PID 5016 wrote to memory of 924	5016	Unicorn-17027.exe	103
PID 5016 wrote to memory of 924	5016	Unicorn-17027.exe	103
PID 5016 wrote to memory of 924	5016	Unicorn-17027.exe	103
PID 3228 wrote to memory of 4116	3228	Unicorn-577.exe	104
PID 3228 wrote to memory of 4116	3228	Unicorn-577.exe	104
PID 3228 wrote to memory of 4116	3228	Unicorn-577.exe	104
PID 3116 wrote to memory of 4512	3116	Unicorn-25770.exe	105
PID 3116 wrote to memory of 4512	3116	Unicorn-25770.exe	105
PID 3116 wrote to memory of 4512	3116	Unicorn-25770.exe	105
PID 1992 wrote to memory of 1056	1992	Unicorn-17293.exe	106
PID 1992 wrote to memory of 1056	1992	Unicorn-17293.exe	106
PID 1992 wrote to memory of 1056	1992	Unicorn-17293.exe	106
PID 1544 wrote to memory of 4968	1544	6efc5b7a231f3d1940f3556bc19a766ce819086bde30a5f3d3028608080a6730.exe	107

C:\Users\Admin\AppData\Local\Temp\6efc5b7a231f3d1940f3556bc19a766ce819086bde30a5f3d3028608080a6730.exe
"C:\Users\Admin\AppData\Local\Temp\6efc5b7a231f3d1940f3556bc19a766ce819086bde30a5f3d3028608080a6730.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1544
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3146.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3146.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20443.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13187.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38829.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29675.exe
        6⤵
        Executes dropped EXE
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15237.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56675.exe
        7⤵
        
        PID:832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13011.exe
        8⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22135.exe
        9⤵
        
        PID:9448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59253.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32026.exe
        9⤵
        
        PID:17532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17156.exe
        8⤵
        
        PID:10584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57526.exe
        8⤵
        
        PID:15452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13630.exe
        8⤵
        
        PID:1696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49576.exe
        7⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
        8⤵
        
        PID:10188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39295.exe
        8⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20706.exe
        8⤵
        
        PID:18692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3306.exe
        7⤵
        
        PID:9908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49166.exe
        7⤵
        
        PID:15948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31824.exe
        7⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23902.exe
        6⤵
        
        PID:1736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2788.exe
        7⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7962.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44584.exe
        8⤵
        
        PID:12372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13908.exe
        8⤵
        
        PID:17988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30665.exe
        7⤵
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23290.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26572.exe
        7⤵
        
        PID:18768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23868.exe
        6⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41787.exe
        7⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
        7⤵
        
        PID:14684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14127.exe
        7⤵
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42177.exe
        6⤵
        
        PID:7852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17167.exe
        6⤵
        
        PID:14032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11638.exe
        6⤵
        
        PID:17608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48896.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26551.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28279.exe
        7⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38523.exe
        8⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35949.exe
        9⤵
        
        PID:9348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35508.exe
        9⤵
        
        PID:16396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28404.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:18984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50292.exe
        8⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15890.exe
        8⤵
        
        PID:14912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42052.exe
        8⤵
        
        PID:8896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-759.exe
        7⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26323.exe
        8⤵
        
        PID:13228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34800.exe
        7⤵
        
        PID:12036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64864.exe
        7⤵
        
        PID:17096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56033.exe
        7⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59752.exe
        6⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28217.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19229.exe
        8⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17339.exe
        8⤵
        
        PID:13896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22268.exe
        8⤵
        
        PID:18092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-515.exe
        7⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36503.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1875.exe
        7⤵
        
        PID:17568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37053.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62477.exe
        7⤵
        
        PID:14136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60064.exe
        7⤵
        
        PID:17216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40666.exe
        6⤵
        
        PID:12016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54464.exe
        6⤵
        
        PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63591.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36639.exe
        6⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55243.exe
        7⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46639.exe
        8⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22383.exe
        8⤵
        
        PID:12816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2040.exe
        8⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42777.exe
        7⤵
        
        PID:12220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26720.exe
        6⤵
        
        PID:8864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12243.exe
        6⤵
        
        PID:13080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2276.exe
        6⤵
        
        PID:7032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13815.exe
        5⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47075.exe
        6⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47599.exe
        7⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39601.exe
        7⤵
        
        PID:14592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28326.exe
        7⤵
        
        PID:17804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8542.exe
        6⤵
        
        PID:11608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12654.exe
        5⤵
        
        PID:7980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26733.exe
        6⤵
        
        PID:11572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45264.exe
        6⤵
        
        PID:17068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65439.exe
        6⤵
        
        PID:6748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62720.exe
        5⤵
        
        PID:11500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41446.exe
        5⤵
        
        PID:5568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36783.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3224.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3753.exe
        6⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31725.exe
        7⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1422.exe
        8⤵
        
        PID:9036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33510.exe
        8⤵
        
        PID:14664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43135.exe
        8⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35543.exe
        7⤵
        
        PID:8500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13202.exe
        7⤵
        
        PID:12452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37672.exe
        7⤵
        
        PID:16400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25978.exe
        6⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
        7⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9555.exe
        7⤵
        
        PID:14192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20706.exe
        7⤵
        
        PID:18716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35082.exe
        6⤵
        
        PID:1748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17174.exe
        6⤵
        
        PID:15156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54184.exe
        6⤵
        
        PID:8096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6685.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28279.exe
        6⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37153.exe
        7⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4044.exe
        8⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57578.exe
        8⤵
        
        PID:14216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20706.exe
        8⤵
        
        PID:18652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56862.exe
        7⤵
        
        PID:11080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
        7⤵
        
        PID:14888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64418.exe
        7⤵
        
        PID:9168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3473.exe
        6⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4506.exe
        7⤵
        
        PID:15404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29721.exe
        7⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26824.exe
        6⤵
        
        PID:11852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58363.exe
        6⤵
        
        PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7950.exe
        5⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1527.exe
        6⤵
        
        PID:6460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25262.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2861.exe
        6⤵
        
        PID:1744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45781.exe
        5⤵
        
        PID:13116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32355.exe
        5⤵
        
        PID:8992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7043.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22467.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        6⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52913.exe
        7⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38103.exe
        8⤵
        
        PID:14620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43727.exe
        8⤵
        
        PID:17508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36441.exe
        7⤵
        
        PID:10292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15096.exe
        7⤵
        
        PID:16344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59628.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26720.exe
        6⤵
        
        PID:8660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7583.exe
        6⤵
        
        PID:12484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19468.exe
        6⤵
        
        PID:17444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47308.exe
        5⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9934.exe
        6⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
        7⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22767.exe
        7⤵
        
        PID:14012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57463.exe
        7⤵
        
        PID:17520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2207.exe
        6⤵
        
        PID:11108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19528.exe
        6⤵
        
        PID:16916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62944.exe
        6⤵
        
        PID:1704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25568.exe
        5⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18819.exe
        6⤵
        
        PID:9488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39601.exe
        6⤵
        
        PID:15428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58668.exe
        6⤵
        
        PID:17980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50396.exe
        5⤵
        
        PID:11308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10350.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4687.exe
        5⤵
        
        PID:372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60791.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28279.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
        6⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4044.exe
        7⤵
        
        PID:10140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10515.exe
        7⤵
        
        PID:13832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22460.exe
        7⤵
        
        PID:18284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35979.exe
        6⤵
        
        PID:10960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37106.exe
        6⤵
        
        PID:15860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        6⤵
        
        PID:3232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25839.exe
        5⤵
        
        PID:7156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        6⤵
        
        PID:9824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6239.exe
        6⤵
        
        PID:14452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-478.exe
        6⤵
        
        PID:18540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7198.exe
        5⤵
        
        PID:11076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exe
        5⤵
        
        PID:16540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56609.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54152.exe
      4⤵
      PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47075.exe
        5⤵
        
        PID:7004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25643.exe
        6⤵
        
        PID:9288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35508.exe
        6⤵
        
        PID:15376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63215.exe
        6⤵
        
        PID:18460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6929.exe
        5⤵
        
        PID:10408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51661.exe
        5⤵
        
        PID:15484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42716.exe
        5⤵
        
        PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13184.exe
      4⤵
      PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4044.exe
        5⤵
        
        PID:10132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57578.exe
        5⤵
        
        PID:14256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20706.exe
        5⤵
        
        PID:18724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20154.exe
      4⤵
      PID:11024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51497.exe
      4⤵
      PID:16260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29149.exe
      4⤵
      PID:8532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12035.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12035.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17293.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35129.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56509.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39379.exe
        7⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-74.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-74.exe
        8⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12840.exe
        9⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47599.exe
        10⤵
        
        PID:10176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39601.exe
        10⤵
        
        PID:15524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42052.exe
        10⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8429.exe
        9⤵
        
        PID:11424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35865.exe
        9⤵
        
        PID:16664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26572.exe
        9⤵
        
        PID:18872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46347.exe
        8⤵
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50381.exe
        9⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36940.exe
        8⤵
        
        PID:13844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        8⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7504.exe
        7⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7552.exe
        8⤵
        
        PID:9304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35508.exe
        8⤵
        
        PID:16428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25882.exe
        8⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4355.exe
        7⤵
        
        PID:5100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17174.exe
        7⤵
        
        PID:14404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27541.exe
        7⤵
        
        PID:8724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39933.exe
        6⤵
        
        PID:4704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38777.exe
        7⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8564.exe
        8⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
        9⤵
        
        PID:10204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22767.exe
        9⤵
        
        PID:14344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34328.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60946.exe
        8⤵
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
        8⤵
        
        PID:16364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26572.exe
        8⤵
        
        PID:18964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe
        7⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57625.exe
        8⤵
        
        PID:12792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19031.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27208.exe
        7⤵
        
        PID:12152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58284.exe
        7⤵
        
        PID:17092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5018.exe
        6⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54449.exe
        7⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9389.exe
        7⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13908.exe
        7⤵
        
        PID:17688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55336.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28274.exe
        6⤵
        
        PID:13856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14993.exe
        6⤵
        
        PID:6320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44812.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59799.exe
        6⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10188.exe
        7⤵
        
        PID:756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25429.exe
        8⤵
        
        PID:8516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21513.exe
        9⤵
        
        PID:1880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43929.exe
        8⤵
        
        PID:12476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9659.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19207.exe
        7⤵
        
        PID:8264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49203.exe
        8⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45875.exe
        7⤵
        
        PID:12320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21247.exe
        7⤵
        
        PID:7424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44724.exe
        6⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
        7⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40395.exe
        7⤵
        
        PID:14708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58668.exe
        7⤵
        
        PID:18024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64027.exe
        6⤵
        
        PID:10108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25840.exe
        6⤵
        
        PID:14504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21798.exe
        6⤵
        
        PID:17008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57753.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63281.exe
        6⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16925.exe
        7⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe
        7⤵
        
        PID:11552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13551.exe
        7⤵
        
        PID:3736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59664.exe
        6⤵
        
        PID:8372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58319.exe
        6⤵
        
        PID:12388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17827.exe
        6⤵
        
        PID:4256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28974.exe
        5⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19229.exe
        6⤵
        
        PID:8356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40395.exe
        6⤵
        
        PID:14716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42052.exe
        6⤵
        
        PID:19464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48207.exe
        5⤵
        
        PID:10040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63846.exe
        5⤵
        
        PID:13660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63745.exe
        5⤵
        
        PID:18956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7592.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39571.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26333.exe
        6⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19809.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5264.exe
        8⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53659.exe
        7⤵
        
        PID:9624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11108.exe
        7⤵
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23317.exe
        6⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6566.exe
        7⤵
        
        PID:9836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36965.exe
        7⤵
        
        PID:14488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16430.exe
        7⤵
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36363.exe
        6⤵
        
        PID:11116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19015.exe
        6⤵
        
        PID:14584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7216.exe
        6⤵
        
        PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10551.exe
        5⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11880.exe
        6⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53053.exe
        7⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26964.exe
        7⤵
        
        PID:15880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23064.exe
        7⤵
        
        PID:18892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10104.exe
        6⤵
        
        PID:11936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64864.exe
        6⤵
        
        PID:17104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56033.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45605.exe
        5⤵
        
        PID:7608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53131.exe
        6⤵
        
        PID:14312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55440.exe
        5⤵
        
        PID:12280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56199.exe
        5⤵
        
        PID:17040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
        5⤵
        
        PID:1564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55642.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16411.exe
        5⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20001.exe
        6⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11937.exe
        7⤵
        
        PID:9580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13150.exe
        7⤵
        
        PID:14596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19773.exe
        7⤵
        
        PID:17656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5060.exe
        6⤵
        
        PID:10968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20961.exe
        6⤵
        
        PID:16304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17714.exe
        6⤵
        
        PID:1380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26720.exe
        5⤵
        
        PID:8676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6021.exe
        5⤵
        
        PID:12460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31528.exe
        5⤵
        
        PID:6212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15456.exe
      4⤵
      PID:6040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12840.exe
        5⤵
        
        PID:7696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9244.exe
        6⤵
        
        PID:7480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58833.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe
        5⤵
        
        PID:11808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32218.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49980.exe
      4⤵
      PID:7840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-626.exe
      4⤵
      PID:11580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61675.exe
      4⤵
      PID:4836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15246.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15246.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39213.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10022.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17205.exe
        6⤵
        
        PID:3272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23401.exe
        7⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54449.exe
        8⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36287.exe
        9⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40613.exe
        8⤵
        
        PID:11728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1491.exe
        8⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50623.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18849.exe
        7⤵
        
        PID:14328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39217.exe
        7⤵
        
        PID:8856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4267.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1138.exe
        7⤵
        
        PID:9640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64786.exe
        7⤵
        
        PID:14316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10016.exe
        7⤵
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29216.exe
        6⤵
        
        PID:10220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25840.exe
        6⤵
        
        PID:14412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25602.exe
        6⤵
        
        PID:20096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53146.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52913.exe
        6⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53053.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49047.exe
        8⤵
        
        PID:15576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53650.exe
        8⤵
        
        PID:17728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31048.exe
        7⤵
        
        PID:16084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6343.exe
        7⤵
        
        PID:18564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1283.exe
        6⤵
        
        PID:10920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24442.exe
        6⤵
        
        PID:14996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61958.exe
        6⤵
        
        PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5943.exe
        5⤵
        
        PID:8688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40335.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15377.exe
        5⤵
        
        PID:18268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2409.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35679.exe
        5⤵
        
        PID:3464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        6⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12840.exe
        7⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe
        7⤵
        
        PID:11524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58999.exe
        7⤵
        
        PID:17112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19773.exe
        7⤵
        
        PID:17704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46347.exe
        6⤵
        
        PID:8712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33240.exe
        6⤵
        
        PID:14228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39889.exe
        6⤵
        
        PID:4592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21817.exe
        5⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
        6⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11206.exe
        7⤵
        
        PID:8728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
        6⤵
        
        PID:14724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7521.exe
        6⤵
        
        PID:1392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53145.exe
        5⤵
        
        PID:8332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4506.exe
        6⤵
        
        PID:15412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26021.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11641.exe
        5⤵
        
        PID:2452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33666.exe
        5⤵
        
        PID:700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40239.exe
      4⤵
      PID:552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12.exe
        5⤵
        
        PID:6980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
        6⤵
        
        PID:10196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22767.exe
        6⤵
        
        PID:14064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57463.exe
        6⤵
        
        PID:17540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46940.exe
        5⤵
        
        PID:11224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43301.exe
        5⤵
        
        PID:15988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3157.exe
        5⤵
        
        PID:7576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-899.exe
      4⤵
      PID:7872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50853.exe
        5⤵
        
        PID:12156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58833.exe
        5⤵
        
        PID:1504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59027.exe
      4⤵
      PID:11304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13021.exe
      4⤵
      PID:17204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41701.exe
      4⤵
      PID:8540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47116.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47116.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50479.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17397.exe
        5⤵
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44999.exe
        6⤵
        
        PID:3760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37921.exe
        7⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4620.exe
        8⤵
        
        PID:1376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6239.exe
        8⤵
        
        PID:14520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13908.exe
        8⤵
        
        PID:17880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59000.exe
        7⤵
        
        PID:11016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54339.exe
        7⤵
        
        PID:16564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40194.exe
        7⤵
        
        PID:17416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19207.exe
        6⤵
        
        PID:8280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2896.exe
        6⤵
        
        PID:11804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15305.exe
        6⤵
        
        PID:17116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7504.exe
        5⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32201.exe
        6⤵
        
        PID:10672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51661.exe
        6⤵
        
        PID:15476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54776.exe
        6⤵
        
        PID:4800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35082.exe
        5⤵
        
        PID:8968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17174.exe
        5⤵
        
        PID:14468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23353.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30011.exe
      4⤵
      PID:3560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-650.exe
        5⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27397.exe
        6⤵
        
        PID:8568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40395.exe
        6⤵
        
        PID:14692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2389.exe
        6⤵
        
        PID:7396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31241.exe
        5⤵
        
        PID:8472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64132.exe
        5⤵
        
        PID:14628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17906.exe
        5⤵
        
        PID:18740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28500.exe
      4⤵
      PID:1460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63743.exe
        5⤵
        
        PID:10376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28797.exe
        5⤵
        
        PID:14880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-478.exe
        5⤵
        
        PID:18684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51958.exe
      4⤵
      PID:9684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12296.exe
      4⤵
      PID:16296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1371.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1371.exe
      4⤵
      PID:18628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31818.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31818.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49877.exe
      4⤵
      PID:5060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-266.exe
        5⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
        6⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27667.exe
        7⤵
        
        PID:14044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39067.exe
        7⤵
        
        PID:18036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9555.exe
        6⤵
        
        PID:14200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14484.exe
        6⤵
        
        PID:6260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39601.exe
        5⤵
        
        PID:9952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10728.exe
        6⤵
        
        PID:15656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26021.exe
        6⤵
        
        PID:18880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5200.exe
        5⤵
        
        PID:13644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6343.exe
        5⤵
        
        PID:18544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12243.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
        5⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55653.exe
        6⤵
        
        PID:16008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26021.exe
        6⤵
        
        PID:18992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35508.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64393.exe
        5⤵
        
        PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64027.exe
      4⤵
      PID:9960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25840.exe
      4⤵
      PID:14496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17906.exe
      4⤵
      PID:18708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57276.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57276.exe
    3⤵
    PID:5036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35077.exe
      4⤵
      PID:5824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12840.exe
        5⤵
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42939.exe
        6⤵
        
        PID:10236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22767.exe
        6⤵
        
        PID:14764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34712.exe
        6⤵
        
        PID:18256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34495.exe
        5⤵
        
        PID:11072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
        5⤵
        
        PID:14988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58668.exe
        5⤵
        
        PID:17996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24853.exe
      4⤵
      PID:8380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58319.exe
      4⤵
      PID:12380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15305.exe
      4⤵
      PID:4124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19624.exe
    3⤵
    PID:6560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19229.exe
      4⤵
      PID:9096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
      4⤵
      PID:15204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6343.exe
      4⤵
      PID:18556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55986.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55986.exe
    3⤵
    PID:1656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7367.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7367.exe
    3⤵
    PID:13968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9689.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9689.exe
    3⤵
    PID:6964
- C:\Users\Admin\AppData\Local\Temp\Unicorn-577.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-577.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58543.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58543.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8932.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39213.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11584.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23840.exe
        7⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15554.exe
        8⤵
        
        PID:7988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        8⤵
        
        PID:11536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20750.exe
        8⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
        7⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20485.exe
        8⤵
        
        PID:13616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57734.exe
        8⤵
        
        PID:1524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61900.exe
        7⤵
        
        PID:13584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17196.exe
        7⤵
        
        PID:7356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64822.exe
        6⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-650.exe
        7⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54449.exe
        8⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26323.exe
        9⤵
        
        PID:13248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14667.exe
        9⤵
        
        PID:20084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        8⤵
        
        PID:368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50003.exe
        8⤵
        
        PID:18056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35735.exe
        7⤵
        
        PID:9040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17942.exe
        7⤵
        
        PID:15672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6825.exe
        7⤵
        
        PID:6048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43275.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59275.exe
        7⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57578.exe
        7⤵
        
        PID:14944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63493.exe
        7⤵
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51958.exe
        6⤵
        
        PID:10388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12296.exe
        6⤵
        
        PID:14832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26529.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21241.exe
        6⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40661.exe
        7⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-536.exe
        8⤵
        
        PID:9892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1756.exe
        9⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6239.exe
        8⤵
        
        PID:14420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57463.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1631.exe
        7⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15096.exe
        7⤵
        
        PID:16352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1045.exe
        7⤵
        
        PID:7340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37053.exe
        6⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53053.exe
        7⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31048.exe
        7⤵
        
        PID:15924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45622.exe
        7⤵
        
        PID:18904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48066.exe
        6⤵
        
        PID:10316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65389.exe
        6⤵
        
        PID:15372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46679.exe
        6⤵
        
        PID:18520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60083.exe
        5⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24771.exe
        6⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57142.exe
        7⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23225.exe
        8⤵
        
        PID:11504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52882.exe
        8⤵
        
        PID:5740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57935.exe
        7⤵
        
        PID:12148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40194.exe
        7⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26720.exe
        6⤵
        
        PID:8668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22047.exe
        7⤵
        
        PID:12636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61242.exe
        7⤵
        
        PID:928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21973.exe
        6⤵
        
        PID:13200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33386.exe
        6⤵
        
        PID:9152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23868.exe
        5⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37293.exe
        6⤵
        
        PID:9280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57578.exe
        6⤵
        
        PID:14156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13908.exe
        6⤵
        
        PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63365.exe
        5⤵
        
        PID:10780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32325.exe
        5⤵
        
        PID:15464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20190.exe
        5⤵
        
        PID:17936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27515.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29867.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59799.exe
        6⤵
        
        PID:180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34609.exe
        7⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22135.exe
        8⤵
        
        PID:9472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18539.exe
        9⤵
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22731.exe
        9⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35508.exe
        8⤵
        
        PID:16388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46879.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20664.exe
        7⤵
        
        PID:10392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10728.exe
        8⤵
        
        PID:15628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15077.exe
        8⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57526.exe
        7⤵
        
        PID:15432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31528.exe
        7⤵
        
        PID:17496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43800.exe
        6⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39483.exe
        7⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
        8⤵
        
        PID:10168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22767.exe
        8⤵
        
        PID:14076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-478.exe
        8⤵
        
        PID:18504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1631.exe
        7⤵
        
        PID:10384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15096.exe
        7⤵
        
        PID:16336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41346.exe
        7⤵
        
        PID:7320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3778.exe
        6⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32483.exe
        7⤵
        
        PID:1856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8761.exe
        6⤵
        
        PID:11436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25927.exe
        5⤵
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        6⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22187.exe
        7⤵
        
        PID:1108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49545.exe
        8⤵
        
        PID:9616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57578.exe
        8⤵
        
        PID:14272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22460.exe
        8⤵
        
        PID:17872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32357.exe
        7⤵
        
        PID:10364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39601.exe
        7⤵
        
        PID:15516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53214.exe
        7⤵
        
        PID:18640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11833.exe
        6⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40832.exe
        6⤵
        
        PID:12356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31824.exe
        6⤵
        
        PID:8100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54027.exe
        5⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42197.exe
        6⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33287.exe
        7⤵
        
        PID:15648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-749.exe
        7⤵
        
        PID:17428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4236.exe
        6⤵
        
        PID:12172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22460.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43084.exe
        5⤵
        
        PID:8980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3578.exe
        5⤵
        
        PID:13196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50956.exe
        5⤵
        
        PID:7152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40265.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39955.exe
        5⤵
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6104.exe
        6⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47651.exe
        7⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
        8⤵
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39601.exe
        8⤵
        
        PID:15568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28326.exe
        8⤵
        
        PID:17796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59000.exe
        7⤵
        
        PID:11052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54339.exe
        7⤵
        
        PID:16908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17827.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28937.exe
        6⤵
        
        PID:8320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47003.exe
        7⤵
        
        PID:7736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50151.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15305.exe
        6⤵
        
        PID:1672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9373.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19364.exe
        6⤵
        
        PID:11392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35003.exe
        6⤵
        
        PID:16528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7746.exe
        6⤵
        
        PID:3732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49279.exe
        5⤵
        
        PID:8444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21513.exe
        6⤵
        
        PID:7344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
        5⤵
        
        PID:12808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23360.exe
        5⤵
        
        PID:4092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18885.exe
      4⤵
      PID:1764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14656.exe
        5⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62809.exe
        6⤵
        
        PID:8080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
        7⤵
        
        PID:11420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14667.exe
        7⤵
        
        PID:20076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61609.exe
        6⤵
        
        PID:12572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28326.exe
        6⤵
        
        PID:17852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44096.exe
        5⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22405.exe
        6⤵
        
        PID:15504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3463.exe
        6⤵
        
        PID:18916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21563.exe
        5⤵
        
        PID:13592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19660.exe
        5⤵
        
        PID:17844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41845.exe
      4⤵
      PID:6508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
        5⤵
        
        PID:7540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9555.exe
        5⤵
        
        PID:14180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31204.exe
        5⤵
        
        PID:18940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44691.exe
      4⤵
      PID:4552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40263.exe
      4⤵
      PID:14868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64197.exe
      4⤵
      PID:17904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24069.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24069.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26385.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21891.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55907.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48699.exe
        7⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9934.exe
        8⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22135.exe
        9⤵
        
        PID:9460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35508.exe
        9⤵
        
        PID:16404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63215.exe
        9⤵
        
        PID:18532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3421.exe
        8⤵
        
        PID:10592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51661.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26572.exe
        8⤵
        
        PID:18752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26720.exe
        7⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12243.exe
        7⤵
        
        PID:13088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23360.exe
        7⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17157.exe
        6⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31459.exe
        7⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58319.exe
        7⤵
        
        PID:12364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6945.exe
        7⤵
        
        PID:16768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63669.exe
        6⤵
        
        PID:8272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51740.exe
        6⤵
        
        PID:12312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49619.exe
        6⤵
        
        PID:5564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56270.exe
        5⤵
        
        PID:4852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55305.exe
        6⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60624.exe
        7⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6378.exe
        7⤵
        
        PID:13140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40194.exe
        7⤵
        
        PID:18352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19207.exe
        6⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25851.exe
        7⤵
        
        PID:15836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26021.exe
        7⤵
        
        PID:19000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2896.exe
        6⤵
        
        PID:11528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5679.exe
        6⤵
        
        PID:18800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65511.exe
        5⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        6⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17065.exe
        7⤵
        
        PID:10884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23535.exe
        7⤵
        
        PID:15392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64671.exe
        7⤵
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43239.exe
        6⤵
        
        PID:11408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19528.exe
        6⤵
        
        PID:16700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13935.exe
        6⤵
        
        PID:17596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17427.exe
        5⤵
        
        PID:8188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24408.exe
        5⤵
        
        PID:12188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59726.exe
        5⤵
        
        PID:5300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51034.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57661.exe
        5⤵
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34609.exe
        6⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13608.exe
        7⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50765.exe
        8⤵
        
        PID:18048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34050.exe
        7⤵
        
        PID:16664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23404.exe
        6⤵
        
        PID:7516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33510.exe
        6⤵
        
        PID:14648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46679.exe
        6⤵
        
        PID:18488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4905.exe
        5⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13177.exe
        6⤵
        
        PID:8488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5034.exe
        6⤵
        
        PID:12424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11221.exe
        6⤵
        
        PID:1284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49279.exe
        5⤵
        
        PID:8452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2560.exe
        6⤵
        
        PID:15760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15139.exe
        6⤵
        
        PID:18780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
        5⤵
        
        PID:12400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50100.exe
        5⤵
        
        PID:8164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16720.exe
      4⤵
      PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36363.exe
        5⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
        6⤵
        
        PID:8460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59253.exe
        6⤵
        
        PID:15096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28326.exe
        6⤵
        
        PID:17832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29216.exe
        5⤵
        
        PID:10052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25840.exe
        5⤵
        
        PID:14480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12582.exe
        5⤵
        
        PID:6732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20805.exe
      4⤵
      PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58533.exe
        5⤵
        
        PID:7864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2654.exe
        6⤵
        
        PID:7420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        5⤵
        
        PID:11780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17906.exe
        5⤵
        
        PID:18604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46671.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52580.exe
      4⤵
      PID:13076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32059.exe
      4⤵
      PID:4448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55065.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55065.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48917.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25373.exe
        5⤵
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7412.exe
        6⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7552.exe
        7⤵
        
        PID:9320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43811.exe
        8⤵
        
        PID:13336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20889.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35508.exe
        7⤵
        
        PID:15080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19660.exe
        7⤵
        
        PID:17912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46208.exe
        6⤵
        
        PID:9940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19974.exe
        6⤵
        
        PID:14444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25332.exe
        6⤵
        
        PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54236.exe
        5⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42171.exe
        6⤵
        
        PID:9292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35508.exe
        6⤵
        
        PID:16436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40465.exe
        6⤵
        
        PID:18972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39715.exe
        5⤵
        
        PID:10524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23334.exe
        5⤵
        
        PID:16768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3125.exe
        5⤵
        
        PID:17924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42839.exe
      4⤵
      PID:4388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43337.exe
      4⤵
      PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12840.exe
        5⤵
        
        PID:7596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4916.exe
        6⤵
        
        PID:12216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9197.exe
        5⤵
        
        PID:11384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32356.exe
        5⤵
        
        PID:17216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58668.exe
        5⤵
        
        PID:17864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13727.exe
      4⤵
      PID:7936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-96.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-96.exe
      4⤵
      PID:11876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60110.exe
      4⤵
      PID:17012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64988.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64988.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23811.exe
      4⤵
      PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60697.exe
        5⤵
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39166.exe
        6⤵
        
        PID:8416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25342.exe
        6⤵
        
        PID:14572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40073.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27375.exe
        5⤵
        
        PID:8360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50151.exe
        5⤵
        
        PID:12332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34548.exe
        5⤵
        
        PID:2240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30717.exe
      4⤵
      PID:6756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55767.exe
        5⤵
        
        PID:10304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47272.exe
        5⤵
        
        PID:14800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47349.exe
        5⤵
        
        PID:18616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15018.exe
      4⤵
      PID:10928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57526.exe
      4⤵
      PID:15444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23080.exe
      4⤵
      PID:8292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57859.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57859.exe
    3⤵
    PID:4468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1527.exe
      4⤵
      PID:6384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39431.exe
        5⤵
        
        PID:8432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14407.exe
        5⤵
        
        PID:14604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20706.exe
        5⤵
        
        PID:18760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22164.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25394.exe
      4⤵
      PID:16712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50003.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50003.exe
      4⤵
      PID:17956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6233.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6233.exe
    3⤵
    PID:8104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4044.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57578.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57578.exe
      4⤵
      PID:14952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52803.exe
      4⤵
      PID:17892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6874.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6874.exe
    3⤵
    PID:11056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56832.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56832.exe
    3⤵
    PID:16284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40299.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40299.exe
    3⤵
    PID:8240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25770.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25770.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43935.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43935.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22301.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21891.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33349.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1444.exe
        7⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7194.exe
        8⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42939.exe
        9⤵
        
        PID:3404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22767.exe
        9⤵
        
        PID:13964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21247.exe
        9⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30219.exe
        8⤵
        
        PID:10604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
        8⤵
        
        PID:15084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17827.exe
        8⤵
        
        PID:1556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23291.exe
        7⤵
        
        PID:8308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45875.exe
        7⤵
        
        PID:9904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15881.exe
        7⤵
        
        PID:3608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        6⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47075.exe
        7⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31455.exe
        8⤵
        
        PID:10840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10707.exe
        8⤵
        
        PID:15004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7214.exe
        8⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8542.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6640.exe
        7⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15454.exe
        6⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53053.exe
        7⤵
        
        PID:10016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31048.exe
        7⤵
        
        PID:15912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63328.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51958.exe
        6⤵
        
        PID:10036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36800.exe
        6⤵
        
        PID:15664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43493.exe
        6⤵
        
        PID:8960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25543.exe
        5⤵
        
        PID:3348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37023.exe
        6⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40661.exe
        7⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1631.exe
        7⤵
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15096.exe
        7⤵
        
        PID:16328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55160.exe
        7⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62212.exe
        6⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57137.exe
        7⤵
        
        PID:10064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16161.exe
        7⤵
        
        PID:13752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20706.exe
        7⤵
        
        PID:18700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38117.exe
        6⤵
        
        PID:9880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20961.exe
        6⤵
        
        PID:16320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29582.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53643.exe
        5⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17453.exe
        6⤵
        
        PID:9100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37105.exe
        6⤵
        
        PID:12252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32986.exe
        6⤵
        
        PID:18472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38808.exe
        5⤵
        
        PID:8232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
        6⤵
        
        PID:11972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48736.exe
        6⤵
        
        PID:7244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-96.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-96.exe
        5⤵
        
        PID:11600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56218.exe
        5⤵
        
        PID:2184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57448.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37241.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24303.exe
        6⤵
        
        PID:5312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15554.exe
        7⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        7⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11108.exe
        7⤵
        
        PID:17668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37219.exe
        6⤵
        
        PID:8972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42970.exe
        6⤵
        
        PID:13324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31528.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4521.exe
        5⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3110.exe
        6⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13473.exe
        6⤵
        
        PID:12256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61163.exe
        6⤵
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63669.exe
        5⤵
        
        PID:8256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51740.exe
        5⤵
        
        PID:9900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36188.exe
        5⤵
        
        PID:3808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39279.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39279.exe
      4⤵
      PID:1152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51221.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43567.exe
        6⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12212.exe
        7⤵
        
        PID:10180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57578.exe
        7⤵
        
        PID:12208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8070.exe
        7⤵
        
        PID:17448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55108.exe
        6⤵
        
        PID:9032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43301.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7521.exe
        6⤵
        
        PID:4692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42263.exe
        5⤵
        
        PID:8820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26826.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13630.exe
        5⤵
        
        PID:3012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38512.exe
      4⤵
      PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42005.exe
        5⤵
        
        PID:7888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58201.exe
        6⤵
        
        PID:12780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55788.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11527.exe
        5⤵
        
        PID:11904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31806.exe
        5⤵
        
        PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34226.exe
      4⤵
      PID:8296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26539.exe
      4⤵
      PID:12296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28167.exe
      4⤵
      PID:5280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15263.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15263.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10022.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54537.exe
        5⤵
        
        PID:1840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29239.exe
        6⤵
        
        PID:5484
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5484 -s 632
        7⤵
        Program crash
        
        PID:9900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37271.exe
        6⤵
        
        PID:10056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56539.exe
        6⤵
        
        PID:13680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58668.exe
        6⤵
        
        PID:18004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16327.exe
        5⤵
        
        PID:6608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35949.exe
        6⤵
        
        PID:9360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59253.exe
        6⤵
        
        PID:15088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65274.exe
        6⤵
        
        PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64027.exe
        5⤵
        
        PID:2588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25840.exe
        5⤵
        
        PID:14512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55232.exe
        5⤵
        
        PID:18676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46924.exe
      4⤵
      PID:536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9934.exe
        5⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1076.exe
        6⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5793.exe
        6⤵
        
        PID:16828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-478.exe
        6⤵
        
        PID:18444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51329.exe
        5⤵
        
        PID:11652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7024.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32586.exe
      4⤵
      PID:8628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49681.exe
      4⤵
      PID:12784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16144.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16144.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54537.exe
      4⤵
      PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9934.exe
        5⤵
        
        PID:3516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59275.exe
        6⤵
        
        PID:9248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57578.exe
        6⤵
        
        PID:14224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52803.exe
        6⤵
        
        PID:18016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24686.exe
        5⤵
        
        PID:11680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26720.exe
      4⤵
      PID:8652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51403.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48196.exe
        5⤵
        
        PID:6820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5445.exe
      4⤵
      PID:13128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27060.exe
      4⤵
      PID:16436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-987.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-987.exe
    3⤵
    PID:3752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40085.exe
      4⤵
      PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56395.exe
        5⤵
        
        PID:8004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38321.exe
        6⤵
        
        PID:17624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6867.exe
        5⤵
        
        PID:11540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58999.exe
        5⤵
        
        PID:17052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20733.exe
        5⤵
        
        PID:6812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28169.exe
      4⤵
      PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4620.exe
        5⤵
        
        PID:8608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39601.exe
        5⤵
        
        PID:15380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1875.exe
        5⤵
        
        PID:17584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56975.exe
      4⤵
      PID:11348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60204.exe
      4⤵
      PID:16636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8498.exe
      4⤵
      PID:7064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27262.exe
    3⤵
    PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3468.exe
      4⤵
      PID:8396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13639.exe
      4⤵
      PID:14276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26160.exe
      4⤵
      PID:2412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9881.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9881.exe
    3⤵
    PID:2904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17704.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17704.exe
    3⤵
    PID:14436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23076.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23076.exe
    3⤵
    PID:19584
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17027.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17027.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61195.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61195.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54563.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19151.exe
        5⤵
        
        PID:3868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35077.exe
        6⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32083.exe
        7⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20987.exe
        7⤵
        
        PID:11912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57917.exe
        7⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50623.exe
        6⤵
        
        PID:9660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18849.exe
        6⤵
        
        PID:11964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11108.exe
        6⤵
        
        PID:17696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47054.exe
        5⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19229.exe
        6⤵
        
        PID:8580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1500.exe
        6⤵
        
        PID:14700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29416.exe
        6⤵
        
        PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6082.exe
        5⤵
        
        PID:10212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42368.exe
        5⤵
        
        PID:13988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32680.exe
        5⤵
        
        PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26503.exe
      4⤵
      PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9934.exe
        5⤵
        
        PID:6412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37293.exe
        6⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57578.exe
        6⤵
        
        PID:14264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12730.exe
        6⤵
        
        PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51329.exe
        5⤵
        
        PID:11760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64864.exe
        5⤵
        
        PID:17088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46495.exe
        5⤵
        
        PID:16652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5943.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5943.exe
      4⤵
      PID:8696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48689.exe
        5⤵
        
        PID:13160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32757.exe
        5⤵
        
        PID:8752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64455.exe
      4⤵
      PID:11496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42865.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42865.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27319.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27319.exe
      4⤵
      PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18741.exe
        5⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12840.exe
        6⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19551.exe
        7⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15907.exe
        7⤵
        
        PID:16456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58833.exe
        7⤵
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48092.exe
        6⤵
        
        PID:11328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64698.exe
        6⤵
        
        PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55580.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11034.exe
        6⤵
        
        PID:10544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2155.exe
        6⤵
        
        PID:14900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1848.exe
        6⤵
        
        PID:17464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17504.exe
        5⤵
        
        PID:11132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55649.exe
        5⤵
        
        PID:2160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43467.exe
      4⤵
      PID:7412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4044.exe
        5⤵
        
        PID:9136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57578.exe
        5⤵
        
        PID:14252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13908.exe
        5⤵
        
        PID:17964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9171.exe
      4⤵
      PID:10088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40501.exe
      4⤵
      PID:16056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2933.exe
      4⤵
      PID:4148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40239.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40239.exe
    3⤵
    PID:1220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55243.exe
      4⤵
      PID:7088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53053.exe
        5⤵
        
        PID:9992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13406.exe
        6⤵
        
        PID:16616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12041.exe
        6⤵
        
        PID:16912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26964.exe
        5⤵
        
        PID:15996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5767.exe
        5⤵
        
        PID:6772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55108.exe
      4⤵
      PID:9572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43301.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28326.exe
      4⤵
      PID:17812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31434.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31434.exe
    3⤵
    PID:8156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22462.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22462.exe
    3⤵
    PID:11896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11101.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11101.exe
    3⤵
    PID:4412
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30282.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30282.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18191.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18191.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54537.exe
      4⤵
      PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-650.exe
        5⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17427.exe
        6⤵
        
        PID:9440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5776.exe
        6⤵
        
        PID:14144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58668.exe
        6⤵
        
        PID:17972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31241.exe
        5⤵
        
        PID:9068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36503.exe
        5⤵
        
        PID:14284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3157.exe
        5⤵
        
        PID:9140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14765.exe
      4⤵
      PID:6236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16297.exe
        5⤵
        
        PID:9016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22767.exe
        5⤵
        
        PID:13936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39757.exe
        5⤵
        
        PID:18928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46093.exe
      4⤵
      PID:10520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49742.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60029.exe
      4⤵
      PID:8904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46924.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46924.exe
    3⤵
    PID:2652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40085.exe
      4⤵
      PID:5716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1164.exe
        5⤵
        
        PID:7856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53053.exe
        6⤵
        
        PID:9984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42803.exe
        6⤵
        
        PID:13716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22460.exe
        6⤵
        
        PID:17824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24381.exe
        5⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15096.exe
        5⤵
        
        PID:16312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17163.exe
        5⤵
        
        PID:7144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54515.exe
      4⤵
      PID:8808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33510.exe
      4⤵
      PID:14656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16851.exe
      4⤵
      PID:7432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60789.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60789.exe
    3⤵
    PID:6640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7552.exe
      4⤵
      PID:9308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35508.exe
      4⤵
      PID:16412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17906.exe
      4⤵
      PID:18732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35082.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35082.exe
    3⤵
    PID:4264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17174.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17174.exe
    3⤵
    PID:15164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44157.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44157.exe
    3⤵
    PID:4840
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35703.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35703.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46369.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46369.exe
    3⤵
    PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35077.exe
      4⤵
      PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10318.exe
        5⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56862.exe
        6⤵
        
        PID:10808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58267.exe
        6⤵
        
        PID:16380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57106.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51329.exe
        5⤵
        
        PID:11748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64864.exe
        5⤵
        
        PID:17080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11108.exe
        5⤵
        
        PID:17712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20193.exe
      4⤵
      PID:7900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35887.exe
        5⤵
        
        PID:11096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3794.exe
        5⤵
        
        PID:4568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39269.exe
      4⤵
      PID:11628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10724.exe
      4⤵
      PID:18124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28579.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28579.exe
    3⤵
    PID:6696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37655.exe
      4⤵
      PID:10356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51661.exe
      4⤵
      PID:14464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1875.exe
      4⤵
      PID:17576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62840.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62840.exe
    3⤵
    PID:11360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51539.exe
    3⤵
    PID:16648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46679.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46679.exe
    3⤵
    PID:18512
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54305.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54305.exe
  2⤵
  PID:2012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9934.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9934.exe
    3⤵
    PID:6316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23635.exe
      4⤵
      PID:10164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30436.exe
      4⤵
      PID:5208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51329.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51329.exe
    3⤵
    PID:11708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27636.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27636.exe
    3⤵
    PID:18112
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1768.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1768.exe
  2⤵
  PID:8120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38321.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38321.exe
    3⤵
    PID:17632
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61664.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61664.exe
  2⤵
  PID:11888
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62870.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62870.exe
  2⤵
  PID:4180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5484 -ip 5484
1⤵
PID:9776

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12035.exe

Filesize
468KB

MD5
931ace41d6964d1f25d682ad0036cba1

SHA1
07e30e64716fe10cabe7adb448ee35a3a4ad37a7

SHA256
d120c1941db42bdf54d73d37934412a9d31efc699ff7913fbc4ac0d9b10a6bd1

SHA512
c10bc84314d33a2a131b8ba7d936e099224807b91835a5519d820fac65db7ffb307ca52e99ce3fb0bb00aa529d01b046b03e8d58e58591b0a79982664f29fe98

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13187.exe

Filesize
468KB

MD5
736d2381fd9dc31dc4f64169c80bef9d

SHA1
286234faeadcead731be5388e910ce0429fa0cf9

SHA256
d7504ca1242e9ddff28566d45d3a98c6fded941f53312034a8c714dd7be4e111

SHA512
2b674bacb05193c2dec162fe4efc01f675f9bdca6108e0cb5fe797050f881d6d9878a90dba8d41fffe8ff183e98e735d139145a785ae9b78093fe4f59cf52c9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15246.exe

Filesize
468KB

MD5
f89289d1080747fe5bb319ed56913760

SHA1
eb138064df739c609af0015361b6c4442dd9f931

SHA256
46ca208300defa7783ac7a18c2ecbe93692ba6a392c000d616c8bdc00be728bb

SHA512
8cbc87f2b60230b28db20cb204ff4fda30695c224ae48df057ae7b6b73ece2beec7500f721fe0645edb53dd78f6d8cdc7adf200afe91dc650f963e00b6871e8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15263.exe

Filesize
468KB

MD5
91f2dd87f59e16edd101cb37f9697468

SHA1
8cf3f4773aeac4c93946b58b93936f00b9b4c016

SHA256
5e11f46840526567250fbb590a83436d13b22021c100607202211cc28fe4cf8f

SHA512
b5f1daf4ea71bf66534a029f21736333ecff1daa9a77ce4ad4c411d9af015097a5aa40dc4b6ab204e31496cee917fcc3ce5c9dc0e3f5af2279da2b9d2bd0c3a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17027.exe

Filesize
468KB

MD5
35a26a5dc21ae4e323a793cfcef1af34

SHA1
070ce7fa1b99a03581b7d6997a9e84b0b1c9dc9e

SHA256
d25a14526ef5fdb25401a4fdd076ddc1a8a333bef0401d3465167a1e949aa75b

SHA512
e447cc59c3bf125492d73b53adc974e7716fa5e0a3a07b329c2d86099b1135b76d32d094c3537796adf5ce6f837f6b6c2a37064966684c9d7b2acb6e575513bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17293.exe

Filesize
468KB

MD5
a28677a10634902c5b333fe6af87fa44

SHA1
3700e1583960825d99e1f1fe9222024324b68fde

SHA256
e9241b899cb70408e4457073efa25154b9c5bdeb96fbee0fafb56e6ae3c1136a

SHA512
9b530bde84f9c3b9953d7eff9594ad667190ef5bbf8938972120eefdea1ae9493bce85459e99dc1fd1cbdaf2fee55a9da36ba13dbcdb374d33fec27c62c837eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20443.exe

Filesize
468KB

MD5
bce3768c14ce1430e60a549df7fbbdbb

SHA1
ea690541b49a8eeca336d282ded7e0958138b868

SHA256
0980c30c70fa7bcbdff05175cc282a8cfc83d1a60a7c14ae2be0e80beede276f

SHA512
715d0cb8e7e837feb364074c115bda2637e58d74875f42d05dda71e3fee04e2394bb3f1623f343ab8ef616ff1ae309e4daabeda823d86867eeb9c4d3a32050e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21891.exe

Filesize
468KB

MD5
fce11f6786f0a14c9711f78bb2eb5564

SHA1
e81cfb223e3231d74788892948b4e0bec79e5783

SHA256
af6affc7807744fba559603bafcb03590f68355b13f30544a177b8e3209cf23c

SHA512
cd9dde28032ddf3f92c26ecf9f5f04b5dd9ad68406ea5a41b5c5a337d3d566de8333492a131ae2854f390cdc6756b2a535e19504767067e88b9e8b23d62f7774

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22301.exe

Filesize
468KB

MD5
d19dd7da99a2d8b91fbddafd74f10523

SHA1
bc4c6ccaa9abfd185fb5bba6a046b90deb81e477

SHA256
2dc1ca3663183caa8436217315075c03bc53e3522c8601b7cbbf6539353efc53

SHA512
6d5dc0d644225a4118b31aca69d6fa7f17555c53a493a60cae2be3a6234409f12e759da3c6a72d96383e1a7ce34d8993c443a65f9ad3edba83f89d2e32569cb1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24069.exe

Filesize
468KB

MD5
4ac49f98a93df8bba651a92b3e82e619

SHA1
9cc31b9cc267d15b273471eeebe27ba8635d8533

SHA256
6b2b0bd3792e069dfa061981f785aef410c12cafbca8a446f880fc5d8adae149

SHA512
c758f2427041e107fae704f5ee6310ba8745d8b289282be574409524854951ba085600527ac5b83395ef97653fc6437103466fff5245f8dbc836bcae98794542

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25770.exe

Filesize
468KB

MD5
717bb44f990fc0ea167f0238d66c9c45

SHA1
9acb2baca3ac0754e8b7f1d50f0b8d2c4d653d80

SHA256
fd5e7a15f47529f44e96975a63eadc27f175598b57f8540b57ec86b4ed11ed2c

SHA512
6d1f66e657ed96cdb2cd9e89766370374273cd0b1434c353fb5502f1e846667576809742b098fceb729b6cbfa1242491fc6c77b6b46139975a89eb2b4e59a96d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26385.exe

Filesize
468KB

MD5
3f66b28ec2d8e473ec7a9795a0d0842c

SHA1
f30304f064f557708fbbead7a371da56ad439245

SHA256
984e0b2fc4b764c68dec95c7de067a7ac1a81dde335beadd54fea48c1b912149

SHA512
74226f3bb0c19a178b318c8b21c6a6ee14d2574f7d7592d97f49f7832ba091771eed4c712dbb905f196e0e4d3a1e5b0573db6091729f1fb0e1a034df1e1dc438

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27515.exe

Filesize
468KB

MD5
c3777b9ff897a350cfd646cd7f171060

SHA1
0b4ee401ffda8f5e59eed00cbae6b1e3304227b2

SHA256
51579b8c09b05acf8477d3683acd52aed69dda46a06b36f417ea77af06e52267

SHA512
95c48c0d8ea421367228e8be84421c08ae34e6ce4afe3f75c1f9ded52c280e1c3b52bc2aa7e2029b8040d63c50af094b38c5d9503de3f0d7ee6eab1830bd5e67

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27636.exe

Filesize
468KB

MD5
ed7b0450eae5b6525f16082392e091eb

SHA1
2d91172046b55a2c657b45073a605ccb71a69b47

SHA256
cb068d986f1a900f7777dc3a2bbe04208d8df605d94ec27af41b7c8ba7e5fdee

SHA512
a625c99538f3fa651811680bd059273f1d94dbfe72ab8798170a8f9abab5c52ff81f6aa03f585806cf7224dd58354704f8818f37e8531768e560e7cf39eaebf4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29675.exe

Filesize
468KB

MD5
bc070863de301d1ae3c56ac4f21e5319

SHA1
6975ce48c294c43dcb43d23eda17f45b9abea783

SHA256
49c9c78e339cb4451198c03d25c01b4167eaeacf601b44dd96434e5909d38535

SHA512
c21422ab3dfd14742edbe882ac1eb3c6cfb54512f7b7a41bc1a4fd2d71db63b90e47374e003489f950eeead56752b0cc295c17ba72891dc523f35773b113f964

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30282.exe

Filesize
468KB

MD5
57c483b7efa064741fb1ae044583ec87

SHA1
5835b9e4bb8681097319b1724d94e1a6b3566917

SHA256
e2fd47dae79001812521eafef1db2857d366a73eafd7f45aed3ee71511618896

SHA512
2802b597981fe5430766f7958a77a79cd88bc9a3a6c566092d806764798f22c4cf270ccafd042fb8c36aab5c5e0bcee9662f6206ba16f8a32e7794b12a046c1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3146.exe

Filesize
468KB

MD5
78a777600d536b9e44e47b29a40ea0d0

SHA1
2222842e0890ee6177c88b3a0c0e9e9385c8c42b

SHA256
834e173f45bde2e79b4b1f5db5c8a9780170d7f74092c6d3aa0ce0a3d74741c9

SHA512
6e1178936ddd26290ab663d4d76d23699bb82a279a5567d0761183f7c881ca6579e7fd7769107881fa0e5123917a25a5189cc061fb64ad6f2731f1e08a7af093

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3224.exe

Filesize
468KB

MD5
af21283dee63595ac944f6408bd51a9a

SHA1
7686d67029c8413b8a25ca97e25d37743d171331

SHA256
3c4501c49cbbeac20c94851ce5531b410d51ec6e679fecaa9bebb34cffed016f

SHA512
02a52f525a8e4d6c2544b39b1fb5b9b434f2c0ca243f8fbd73ccbf914ac46bb841d9b281b72993df0f7b82d0f3d7690f253b7237c06f2feb7737287f5b91018b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35129.exe

Filesize
468KB

MD5
e2b74630dc0d51d13b4e5514e3a71ab2

SHA1
2f2141282e3bada05b4757a55f17717ae79721ec

SHA256
5e958950cb84ad4745c580e424bd433d1ae3cc933ec8141576671a406106fa1f

SHA512
4efe21000f195b2d8581313ff1bd16cd9cbfc7997c27fc7ac23a7de46cdbff3b26584657b54a2730f910382f236d8282bc0c349d49af3a0dda612313434de6cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36783.exe

Filesize
468KB

MD5
11cd3981de128f1bb1469d1730ded7f0

SHA1
a589c0b979912ad490024da82c711285a7ea3938

SHA256
a1c90cef283d0f3f567dfd501bee965e1e8e1e53d5d2e7ae3b5e955d903bbd2f

SHA512
f79cc1138be8be22016078a2d8cc0478fdee6afc38bcbbc3ad2bdd43ca2354a9f924e71e5b28d8eb9e3ab5206a44832f4e682c2c15fb428697a06b88d25e885a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38829.exe

Filesize
468KB

MD5
76910454ca853904c766c7b9529d3091

SHA1
64bc1885452e82aba1b0d6d6164e1186d0f6cb2d

SHA256
33fea68e795116cf0ae26421de8e00818f0f18a6fcf5463b81d0d2c82a5054a1

SHA512
64e176dfed2a6ea7fb12df06c3914538f7e518a2434087604e0dba05ca16148b17ec1929dbe6de8277a1083d9c4a5fc3090c42162c50717054c24cc0c5fca795

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39213.exe

Filesize
468KB

MD5
99e788603ed472f03e4cb8f1b67fd41c

SHA1
8b0ebd934071b00a5a94966b7bab65eeb7bf4766

SHA256
db20fcc81cf136d26eb5408504643c983b24b87b035f27cce357fce1be50d60e

SHA512
415712f699e8bea15b810edc9286c35f91132cf964c47c359a26309e05269f5dc5088a81de4c42e419a93bf4d5dcf54ca3fa4022766d252b72103c673054a4b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43335.exe

Filesize
468KB

MD5
f679c96a6c1fa2b73cb028d0d7b3603e

SHA1
f4343016ec9a76f6b58f9a1f1c48d2e8b8fce8cb

SHA256
18ddf47d82856e880fff3a7b0ffe3f4e9e900a70529b3a5822ed8a2e28b5342c

SHA512
b24e15ae4835a9019baf3744bbffe48c2db3438c9e147543cb95035c98911c45957acd8d7969bfc3d76b40c2df837721a61ca8ecf84ba643b2bd19db5c1ba270

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43935.exe

Filesize
468KB

MD5
8db2fa5e915719d83f4917966a4efce0

SHA1
32ae8465be2a242ce8fa945235e80b2d3bf04c2f

SHA256
e746915fe991fb82a5b135a2adcdc32144d60424a8a81e2060f38a5cfe99424b

SHA512
7de54158463502815c327a0ca3520f0bae9f933def482ac4b1d4f0019b25faca971fceb92ba39deb5ac90cc1aa27f929bbc694f60b74b4a21d6fb69783477858

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47116.exe

Filesize
468KB

MD5
d37852a2f311d123ac2b871d325cfc2f

SHA1
5346a202289bdb42b616bd309a55b6c760f6e189

SHA256
9bfc95921325ba6e16470f9db37928f6a3a35f3fd775b225d56db9bf73a959fa

SHA512
8211a79e20e99994fdfbf39ddea626bc60abeb2c18e880406b2cd52c7d87a264caa724cd99102302ca91365ab232e6e377a89be1d13a1ec9ca7c8e440096de98

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-48896.exe

Filesize
468KB

MD5
abf51e94b1bd0523d4af8e229c23992c

SHA1
ef83ca28c6893b3c134a6da5e88560eaaa8bba29

SHA256
4707433a4a9a717a0eda5f7e5bfd47fa3dc1ade708242eb60277f5ad1ad40868

SHA512
e6f902079413441b42551f6eec88a33276835e479bfd8c54f28b817e77012437a00992fe0ba704a04ff6ba2b50d377adcfdb3e9ae4c95a6ecae1a96862eece75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55065.exe

Filesize
468KB

MD5
a6c3ec7c720cf0cc19059d36f33cdcf0

SHA1
14ea7471eb9ce173fbe45f27235ed737128869d7

SHA256
8c62070d307959240dc16fe4495d8b82fcf8743ebc67849fb8d2009030e11200

SHA512
784b576261107b9dabcd195db8ea24da88f661ddfbf1ae254f919f9eddbd8bd2df815c460e7d00e519e3819375a3034cf3214627ee037aabaaf94c95f3ce8cec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-577.exe

Filesize
468KB

MD5
aec56c4ca4bc55e589b883c4b95011b5

SHA1
0caf528cd7792bb169bb422997e584e22933d253

SHA256
2d5f94f1d3c1efebb37b57c3400e8f81160efbdc9a747e7bd322c886e6479d0a

SHA512
a459ffc216ed93096daa6c84aa0e657784fbeb7ed5f0da07e052a25c8324c7da5d32f96a67235fdf50b744f96c7431a01b1c84cf6014459c4cf29ca8816746c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58543.exe

Filesize
468KB

MD5
f49e531ed875f7d3d3fc6037eee74b13

SHA1
6301dd73a53e755a4b3f57ea3689c85548bf60c4

SHA256
2407ec3d1ed90d93d0f38f78262f6b1710a99c6d33a2d7e125343b911f948e4f

SHA512
3c8d5f2e047caec2263ee5bc033702b1a59d58d80385b686512241e7b6a385b7d1a757bff0ea1d6b114aa1836616f5d3ff19eae84cd344f74b8a52934c062a02

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5995.exe

Filesize
468KB

MD5
8728c963e99cd72f09cec1313fed6e83

SHA1
3829a204e1def3366812d1160b37906e149f2c37

SHA256
797f07e752f4a322a86af029e3baf56a10ac72002610b3a7af85657f11f68a60

SHA512
909efd9faa21d168f017263b6dbde280234ba36c7f7bad0d6b284cb339a00f1eb53f1d744a95609fa447b66d0a501a5161e3df1fd0f3ffb2ed4c254e602d848e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61195.exe

Filesize
468KB

MD5
4ae4190a4d00da577805a41a4aeee317

SHA1
a1b1ba4e87a75ba31217f7dd538e9165427bacf1

SHA256
2ccfae0a807de1f4ad54034730dfdbaffce026fda46896496c46a5dce1194e26

SHA512
c6bc992dc3038ef3a47077ee893152d32509143ea6b4fc23ba535cf57894c7e3f16e97d9dcdd86ea7c394d47d95c65b341de01a1324147f6ad69fdd720295954

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7043.exe

Filesize
468KB

MD5
0e7059f444d1fd09c74baab50a1d7399

SHA1
bb6b968f9f420bf47b4a15da631577e2b520b171

SHA256
27c7b8654cbf2bd565d3b7d4e13a01c0b639459a09714cdd3237a9b4b50a85c6

SHA512
decd6e0f7a2a09e271721ba26383240014d2b44633c9920f8efad75965ccaf98f1e619d9b038b205a19f887539e2e07d9a6233479c6e357b6961ff819a5143b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7592.exe

Filesize
468KB

MD5
affb74d7940a68c96b16df519649c1e1

SHA1
5e6682cd85d7b09f9ac75f7d4dc1cc657e923a5c

SHA256
f8e324ae287ff906ff459a439bf3c9676109f8f9f31c28b4b9d00626cca9ed75

SHA512
5578e420b0a8ba43dcc1784f27afaa0fa240830b43ba70600dd57a8a9a50512bd1cf19bada9639e19378a49fc9285e1796840dc9ee0889db420fa81548d029b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8932.exe

Filesize
468KB

MD5
340b4ee285d3c925759f73d8853faf97

SHA1
e6568fd25b64a20e3cb160504e1f08dd55cf93f5

SHA256
4ea2a6a787916968c36b899533a1bec87e768c751ee2ffb48529e5ff2208e740

SHA512
227375985a16aabc0065428b574f15e98b161b0b443441e8caf16f143baea9c824ccf0b6cf675c0234d65c27e820b51ff711bfe2831988ce48fce161c3f3b72d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads