692089076dc68b80fcb56134de66d6d1a1c4930c4d7d1ad4813036c7904fd3c7

Analysis

max time kernel
109s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 03:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

692089076dc68b80fcb56134de66d6d1a1c4930c4d7d1ad4813036c7904fd3c7N.exe
Size

468KB
MD5

d2f23a4753ad15653e84070feb5b57b0
SHA1

82ad20093f889e988f1853ec2984ab00998d2042
SHA256

692089076dc68b80fcb56134de66d6d1a1c4930c4d7d1ad4813036c7904fd3c7
SHA512

c9052f99db751d2826dc7402b0432d0e3ddfde5e740288ea9eff4ef2bd8d22a12cf3a7d77928dce688dfe3b3dd7be3f1ec2fb7cc56bcd6f2aa6d9d6d74361a29
SSDEEP

3072:4belogxaIU57tbYZPzcfmbfD/n2DnsIHnQmyeQVq4u5Kkki3uxNl9:4b4oCc7tCP4fmbfra9ou5D73ux

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
456	Unicorn-39160.exe
4704	Unicorn-38776.exe
2256	Unicorn-34177.exe
3692	Unicorn-38299.exe
4104	Unicorn-2590.exe
3132	Unicorn-55128.exe
2168	Unicorn-65526.exe
1956	Unicorn-25832.exe
3468	Unicorn-37761.exe
5036	Unicorn-40907.exe
4644	Unicorn-40907.exe
1884	Unicorn-41976.exe
1796	Unicorn-19317.exe
4648	Unicorn-5582.exe
3020	Unicorn-25183.exe
4812	Unicorn-38328.exe
3172	Unicorn-18462.exe
5088	Unicorn-37451.exe
5112	Unicorn-18165.exe
4940	Unicorn-54939.exe
2884	Unicorn-13351.exe
3772	Unicorn-13086.exe
4492	Unicorn-4613.exe
2412	Unicorn-13543.exe
4456	Unicorn-13543.exe
3932	Unicorn-45832.exe
1976	Unicorn-9630.exe
5008	Unicorn-58639.exe
2936	Unicorn-58639.exe
1772	Unicorn-22488.exe
4872	Unicorn-57560.exe
4376	Unicorn-20481.exe
2604	Unicorn-40347.exe
1912	Unicorn-24696.exe
4600	Unicorn-18565.exe
3788	Unicorn-39698.exe
2420	Unicorn-20097.exe
1456	Unicorn-56143.exe
724	Unicorn-43035.exe
3784	Unicorn-17384.exe
1932	Unicorn-50264.exe
3808	Unicorn-33051.exe
4032	Unicorn-16331.exe
4696	Unicorn-16331.exe
4256	Unicorn-17134.exe
552	Unicorn-16331.exe
2280	Unicorn-12801.exe
3140	Unicorn-33160.exe
2584	Unicorn-48427.exe
1948	Unicorn-17016.exe
2872	Unicorn-59894.exe
4144	Unicorn-46159.exe
3580	Unicorn-7310.exe
4088	Unicorn-26645.exe
924	Unicorn-45583.exe
3452	Unicorn-59318.exe
4348	Unicorn-50767.exe
3960	Unicorn-4519.exe
1032	Unicorn-21240.exe
1072	Unicorn-60456.exe
4008	Unicorn-57311.exe
3308	Unicorn-7534.exe
2996	Unicorn-53942.exe
2140	Unicorn-60264.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
15340	9964	WerFault.exe	446

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60264.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57993.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35030.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20124.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39232.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7574.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29149.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40772.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43636.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9418.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62407.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3967.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11155.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29798.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40038.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16063.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13543.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3878.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32919.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42233.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4959.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14390.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61165.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43415.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42048.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41472.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9560.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24326.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4903.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54425.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23062.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-814.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55385.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23920.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64240.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26854.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	884	dwm.exe
Token: SeChangeNotifyPrivilege	884	dwm.exe
Token: 33	884	dwm.exe
Token: SeIncBasePriorityPrivilege	884	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2020	692089076dc68b80fcb56134de66d6d1a1c4930c4d7d1ad4813036c7904fd3c7N.exe
456	Unicorn-39160.exe
4704	Unicorn-38776.exe
2256	Unicorn-34177.exe
3692	Unicorn-38299.exe
4104	Unicorn-2590.exe
3132	Unicorn-55128.exe
2168	Unicorn-65526.exe
1956	Unicorn-25832.exe
3468	Unicorn-37761.exe
1796	Unicorn-19317.exe
4648	Unicorn-5582.exe
1884	Unicorn-41976.exe
4644	Unicorn-40907.exe
3020	Unicorn-25183.exe
5036	Unicorn-40907.exe
4812	Unicorn-38328.exe
3172	Unicorn-18462.exe
5088	Unicorn-37451.exe
5112	Unicorn-18165.exe
4940	Unicorn-54939.exe
3772	Unicorn-13086.exe
2884	Unicorn-13351.exe
1772	Unicorn-22488.exe
2412	Unicorn-13543.exe
4492	Unicorn-4613.exe
5008	Unicorn-58639.exe
4456	Unicorn-13543.exe
3932	Unicorn-45832.exe
2936	Unicorn-58639.exe
1976	Unicorn-9630.exe
4872	Unicorn-57560.exe
4376	Unicorn-20481.exe
2604	Unicorn-40347.exe
1912	Unicorn-24696.exe
3788	Unicorn-39698.exe
4600	Unicorn-18565.exe
2420	Unicorn-20097.exe
1456	Unicorn-56143.exe
724	Unicorn-43035.exe
3784	Unicorn-17384.exe
1932	Unicorn-50264.exe
3140	Unicorn-33160.exe
3808	Unicorn-33051.exe
4256	Unicorn-17134.exe
4696	Unicorn-16331.exe
4032	Unicorn-16331.exe
552	Unicorn-16331.exe
2280	Unicorn-12801.exe
4144	Unicorn-46159.exe
2872	Unicorn-59894.exe
4088	Unicorn-26645.exe
2584	Unicorn-48427.exe
1948	Unicorn-17016.exe
3580	Unicorn-7310.exe
924	Unicorn-45583.exe
3452	Unicorn-59318.exe
4348	Unicorn-50767.exe
3960	Unicorn-4519.exe
1032	Unicorn-21240.exe
1072	Unicorn-60456.exe
4008	Unicorn-57311.exe
2996	Unicorn-53942.exe
3308	Unicorn-7534.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2020 wrote to memory of 456	2020	692089076dc68b80fcb56134de66d6d1a1c4930c4d7d1ad4813036c7904fd3c7N.exe	86
PID 2020 wrote to memory of 456	2020	692089076dc68b80fcb56134de66d6d1a1c4930c4d7d1ad4813036c7904fd3c7N.exe	86
PID 2020 wrote to memory of 456	2020	692089076dc68b80fcb56134de66d6d1a1c4930c4d7d1ad4813036c7904fd3c7N.exe	86
PID 456 wrote to memory of 4704	456	Unicorn-39160.exe	87
PID 456 wrote to memory of 4704	456	Unicorn-39160.exe	87
PID 456 wrote to memory of 4704	456	Unicorn-39160.exe	87
PID 2020 wrote to memory of 2256	2020	692089076dc68b80fcb56134de66d6d1a1c4930c4d7d1ad4813036c7904fd3c7N.exe	88
PID 2020 wrote to memory of 2256	2020	692089076dc68b80fcb56134de66d6d1a1c4930c4d7d1ad4813036c7904fd3c7N.exe	88
PID 2020 wrote to memory of 2256	2020	692089076dc68b80fcb56134de66d6d1a1c4930c4d7d1ad4813036c7904fd3c7N.exe	88
PID 4704 wrote to memory of 3692	4704	Unicorn-38776.exe	89
PID 4704 wrote to memory of 3692	4704	Unicorn-38776.exe	89
PID 4704 wrote to memory of 3692	4704	Unicorn-38776.exe	89
PID 456 wrote to memory of 4104	456	Unicorn-39160.exe	90
PID 456 wrote to memory of 4104	456	Unicorn-39160.exe	90
PID 456 wrote to memory of 4104	456	Unicorn-39160.exe	90
PID 2256 wrote to memory of 3132	2256	Unicorn-34177.exe	91
PID 2256 wrote to memory of 3132	2256	Unicorn-34177.exe	91
PID 2256 wrote to memory of 3132	2256	Unicorn-34177.exe	91
PID 2020 wrote to memory of 2168	2020	692089076dc68b80fcb56134de66d6d1a1c4930c4d7d1ad4813036c7904fd3c7N.exe	92
PID 2020 wrote to memory of 2168	2020	692089076dc68b80fcb56134de66d6d1a1c4930c4d7d1ad4813036c7904fd3c7N.exe	92
PID 2020 wrote to memory of 2168	2020	692089076dc68b80fcb56134de66d6d1a1c4930c4d7d1ad4813036c7904fd3c7N.exe	92
PID 3692 wrote to memory of 1956	3692	Unicorn-38299.exe	93
PID 3692 wrote to memory of 1956	3692	Unicorn-38299.exe	93
PID 3692 wrote to memory of 1956	3692	Unicorn-38299.exe	93
PID 4704 wrote to memory of 3468	4704	Unicorn-38776.exe	94
PID 4704 wrote to memory of 3468	4704	Unicorn-38776.exe	94
PID 4704 wrote to memory of 3468	4704	Unicorn-38776.exe	94
PID 3132 wrote to memory of 5036	3132	Unicorn-55128.exe	95
PID 3132 wrote to memory of 5036	3132	Unicorn-55128.exe	95
PID 3132 wrote to memory of 5036	3132	Unicorn-55128.exe	95
PID 2168 wrote to memory of 4644	2168	Unicorn-65526.exe	96
PID 2168 wrote to memory of 4644	2168	Unicorn-65526.exe	96
PID 2168 wrote to memory of 4644	2168	Unicorn-65526.exe	96
PID 4104 wrote to memory of 1884	4104	Unicorn-2590.exe	97
PID 4104 wrote to memory of 1884	4104	Unicorn-2590.exe	97
PID 4104 wrote to memory of 1884	4104	Unicorn-2590.exe	97
PID 456 wrote to memory of 1796	456	Unicorn-39160.exe	99
PID 456 wrote to memory of 1796	456	Unicorn-39160.exe	99
PID 456 wrote to memory of 1796	456	Unicorn-39160.exe	99
PID 2256 wrote to memory of 4648	2256	Unicorn-34177.exe	98
PID 2256 wrote to memory of 4648	2256	Unicorn-34177.exe	98
PID 2256 wrote to memory of 4648	2256	Unicorn-34177.exe	98
PID 2020 wrote to memory of 3020	2020	692089076dc68b80fcb56134de66d6d1a1c4930c4d7d1ad4813036c7904fd3c7N.exe	100
PID 2020 wrote to memory of 3020	2020	692089076dc68b80fcb56134de66d6d1a1c4930c4d7d1ad4813036c7904fd3c7N.exe	100
PID 2020 wrote to memory of 3020	2020	692089076dc68b80fcb56134de66d6d1a1c4930c4d7d1ad4813036c7904fd3c7N.exe	100
PID 1956 wrote to memory of 4812	1956	Unicorn-25832.exe	101
PID 1956 wrote to memory of 4812	1956	Unicorn-25832.exe	101
PID 1956 wrote to memory of 4812	1956	Unicorn-25832.exe	101
PID 3692 wrote to memory of 3172	3692	Unicorn-38299.exe	102
PID 3692 wrote to memory of 3172	3692	Unicorn-38299.exe	102
PID 3692 wrote to memory of 3172	3692	Unicorn-38299.exe	102
PID 3468 wrote to memory of 5088	3468	Unicorn-37761.exe	103
PID 3468 wrote to memory of 5088	3468	Unicorn-37761.exe	103
PID 3468 wrote to memory of 5088	3468	Unicorn-37761.exe	103
PID 4704 wrote to memory of 5112	4704	Unicorn-38776.exe	104
PID 4704 wrote to memory of 5112	4704	Unicorn-38776.exe	104
PID 4704 wrote to memory of 5112	4704	Unicorn-38776.exe	104
PID 1796 wrote to memory of 4940	1796	Unicorn-19317.exe	105
PID 1796 wrote to memory of 4940	1796	Unicorn-19317.exe	105
PID 1796 wrote to memory of 4940	1796	Unicorn-19317.exe	105
PID 3020 wrote to memory of 2884	3020	Unicorn-25183.exe	106
PID 3020 wrote to memory of 2884	3020	Unicorn-25183.exe	106
PID 3020 wrote to memory of 2884	3020	Unicorn-25183.exe	106
PID 456 wrote to memory of 3772	456	Unicorn-39160.exe	107

C:\Users\Admin\AppData\Local\Temp\692089076dc68b80fcb56134de66d6d1a1c4930c4d7d1ad4813036c7904fd3c7N.exe
"C:\Users\Admin\AppData\Local\Temp\692089076dc68b80fcb56134de66d6d1a1c4930c4d7d1ad4813036c7904fd3c7N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38776.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38776.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38299.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25832.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38328.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57560.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4519.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41048.exe
        9⤵
        
        PID:1820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62182.exe
        10⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        11⤵
        
        PID:9908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        11⤵
        
        PID:17076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21983.exe
        10⤵
        
        PID:2484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46637.exe
        10⤵
        
        PID:16004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3878.exe
        9⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27574.exe
        10⤵
        
        PID:13716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
        9⤵
        
        PID:12552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4246.exe
        9⤵
        
        PID:16852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20316.exe
        9⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53855.exe
        8⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28441.exe
        9⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30505.exe
        10⤵
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18175.exe
        10⤵
        
        PID:12020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35467.exe
        10⤵
        
        PID:16456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14390.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:11592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        9⤵
        
        PID:16408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6950.exe
        8⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6296.exe
        9⤵
        
        PID:12120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18102.exe
        10⤵
        
        PID:17668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9344.exe
        10⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20508.exe
        9⤵
        
        PID:17344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1843.exe
        9⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36317.exe
        8⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30566.exe
        8⤵
        
        PID:17100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57311.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8759.exe
        8⤵
        
        PID:5404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10376.exe
        9⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14360.exe
        10⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18175.exe
        10⤵
        
        PID:13036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44795.exe
        10⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46384.exe
        9⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1926.exe
        9⤵
        
        PID:14680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16138.exe
        9⤵
        
        PID:4524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26847.exe
        8⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9560.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42687.exe
        9⤵
        
        PID:14968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60356.exe
        9⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62055.exe
        8⤵
        
        PID:10472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        8⤵
        
        PID:16124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60761.exe
        7⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6360.exe
        8⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6296.exe
        9⤵
        
        PID:12152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20508.exe
        9⤵
        
        PID:17248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1843.exe
        9⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58512.exe
        8⤵
        
        PID:11996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19786.exe
        8⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3407.exe
        7⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28726.exe
        8⤵
        
        PID:14012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64240.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:18020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-838.exe
        7⤵
        
        PID:12816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        7⤵
        
        PID:17764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20481.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21240.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7114.exe
        8⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18265.exe
        9⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55990.exe
        10⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        10⤵
        
        PID:16932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41884.exe
        9⤵
        
        PID:10504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34816.exe
        9⤵
        
        PID:16304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3878.exe
        8⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2575.exe
        9⤵
        
        PID:9564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
        9⤵
        
        PID:17068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22175.exe
        8⤵
        
        PID:12012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30566.exe
        8⤵
        
        PID:16436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37421.exe
        8⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53087.exe
        7⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45213.exe
        8⤵
        
        PID:7428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41270.exe
        9⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3484.exe
        9⤵
        
        PID:14584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4330.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10534.exe
        8⤵
        
        PID:10168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55456.exe
        8⤵
        
        PID:14516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20790.exe
        8⤵
        
        PID:18392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9743.exe
        7⤵
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47257.exe
        8⤵
        
        PID:13056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46391.exe
        7⤵
        
        PID:12348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35759.exe
        7⤵
        
        PID:16788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37714.exe
        7⤵
        
        PID:15380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53942.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8266.exe
        7⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11720.exe
        8⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
        9⤵
        
        PID:9484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40772.exe
        9⤵
        
        PID:15660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16138.exe
        9⤵
        
        PID:17836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14390.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        8⤵
        
        PID:16596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43676.exe
        7⤵
        
        PID:2448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57993.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44800.exe
        8⤵
        
        PID:15268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24804.exe
        8⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38720.exe
        7⤵
        
        PID:10272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20316.exe
        7⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63855.exe
        6⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46246.exe
        7⤵
        
        PID:6352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25263.exe
        8⤵
        
        PID:10180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
        8⤵
        
        PID:16496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42868.exe
        8⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64656.exe
        7⤵
        
        PID:10652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
        7⤵
        
        PID:16520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65531.exe
        7⤵
        
        PID:13512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16838.exe
        6⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58905.exe
        7⤵
        
        PID:15108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14780.exe
        6⤵
        
        PID:7788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37065.exe
        6⤵
        
        PID:16656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18462.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40347.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60456.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9527.exe
        8⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-968.exe
        9⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9752.exe
        10⤵
        
        PID:10264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23283.exe
        10⤵
        
        PID:16080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41116.exe
        9⤵
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe
        9⤵
        
        PID:14812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43567.exe
        8⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25455.exe
        9⤵
        
        PID:10412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34243.exe
        9⤵
        
        PID:17352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36122.exe
        9⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64359.exe
        8⤵
        
        PID:11348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        8⤵
        
        PID:16464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12734.exe
        7⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46246.exe
        8⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25263.exe
        9⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
        9⤵
        
        PID:16916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2490.exe
        9⤵
        
        PID:5080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31791.exe
        8⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31939.exe
        8⤵
        
        PID:14792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42048.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7574.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47980.exe
        7⤵
        
        PID:18000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7534.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9335.exe
        7⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12872.exe
        8⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56265.exe
        9⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53543.exe
        9⤵
        
        PID:14340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32460.exe
        8⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3187.exe
        8⤵
        
        PID:14740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16138.exe
        8⤵
        
        PID:13272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27366.exe
        7⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60681.exe
        8⤵
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27887.exe
        8⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22586.exe
        8⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62055.exe
        7⤵
        
        PID:9980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        7⤵
        
        PID:15628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20080.exe
        7⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60486.exe
        6⤵
        
        PID:4636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46438.exe
        7⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5912.exe
        8⤵
        
        PID:10216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20508.exe
        8⤵
        
        PID:17364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15455.exe
        7⤵
        
        PID:9932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14342.exe
        7⤵
        
        PID:14408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9359.exe
        6⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58409.exe
        7⤵
        
        PID:13768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3178.exe
        7⤵
        
        PID:16544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30246.exe
        6⤵
        
        PID:11800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19999.exe
        6⤵
        
        PID:17296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18565.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9418.exe
        6⤵
        
        PID:1528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47016.exe
        7⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61705.exe
        8⤵
        
        PID:6156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8104.exe
        9⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3484.exe
        9⤵
        
        PID:12376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54299.exe
        9⤵
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38511.exe
        8⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29149.exe
        8⤵
        
        PID:16100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21683.exe
        7⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58704.exe
        7⤵
        
        PID:12832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8963.exe
        7⤵
        
        PID:17644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        7⤵
        
        PID:896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44722.exe
        6⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61705.exe
        7⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6104.exe
        8⤵
        
        PID:12080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20508.exe
        8⤵
        
        PID:16136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11155.exe
        8⤵
        
        PID:18168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43415.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25974.exe
        7⤵
        
        PID:17596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43008.exe
        6⤵
        
        PID:8256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50039.exe
        6⤵
        
        PID:12788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60866.exe
        6⤵
        
        PID:1104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9153.exe
        5⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64312.exe
        6⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50937.exe
        7⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25897.exe
        8⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40772.exe
        8⤵
        
        PID:13152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1843.exe
        8⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41884.exe
        7⤵
        
        PID:10512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25094.exe
        7⤵
        
        PID:12484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
        7⤵
        
        PID:8148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61248.exe
        6⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40038.exe
        7⤵
        
        PID:12248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20508.exe
        7⤵
        
        PID:17216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8659.exe
        7⤵
        
        PID:17020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59847.exe
        6⤵
        
        PID:10708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31458.exe
        6⤵
        
        PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7608.exe
        5⤵
        
        PID:5152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6936.exe
        6⤵
        
        PID:7424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4044.exe
        6⤵
        
        PID:8320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39335.exe
        6⤵
        
        PID:16712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49195.exe
        6⤵
        
        PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42399.exe
        5⤵
        
        PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49609.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52347.exe
        5⤵
        
        PID:16720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63681.exe
        5⤵
        
        PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37761.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37451.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50767.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54888.exe
        7⤵
        
        PID:464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44969.exe
        8⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe
        9⤵
        
        PID:9724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10591.exe
        9⤵
        
        PID:14820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        9⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55424.exe
        8⤵
        
        PID:9580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46637.exe
        8⤵
        
        PID:4016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9743.exe
        7⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42806.exe
        8⤵
        
        PID:9248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16063.exe
        8⤵
        
        PID:13708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37748.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62288.exe
        7⤵
        
        PID:14952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17704.exe
        6⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23257.exe
        7⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42233.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42687.exe
        8⤵
        
        PID:14996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61323.exe
        8⤵
        
        PID:6844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14303.exe
        7⤵
        
        PID:11012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe
        7⤵
        
        PID:14736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57860.exe
        7⤵
        
        PID:16688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23968.exe
        6⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2575.exe
        7⤵
        
        PID:10292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
        7⤵
        
        PID:16560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13510.exe
        6⤵
        
        PID:12024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
        6⤵
        
        PID:17020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37714.exe
        6⤵
        
        PID:1648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20097.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59880.exe
        6⤵
        
        PID:1620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31448.exe
        7⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46246.exe
        8⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27817.exe
        9⤵
        
        PID:10604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44416.exe
        9⤵
        
        PID:14312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20710.exe
        9⤵
        
        PID:17948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48320.exe
        8⤵
        
        PID:9772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
        8⤵
        
        PID:16424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35408.exe
        8⤵
        
        PID:16428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5903.exe
        7⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11237.exe
        8⤵
        
        PID:13736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64240.exe
        8⤵
        
        PID:18072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49575.exe
        7⤵
        
        PID:11920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45200.exe
        7⤵
        
        PID:16668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60674.exe
        6⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46246.exe
        7⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61849.exe
        8⤵
        
        PID:10540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20124.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11347.exe
        8⤵
        
        PID:16460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8630.exe
        7⤵
        
        PID:12224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8796.exe
        7⤵
        
        PID:17896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65140.exe
        7⤵
        
        PID:17188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19638.exe
        6⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44646.exe
        7⤵
        
        PID:10716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4063.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        6⤵
        
        PID:11972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14246.exe
        6⤵
        
        PID:17964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3288.exe
        5⤵
        
        PID:2028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30680.exe
        6⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45286.exe
        7⤵
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9176.exe
        8⤵
        
        PID:10332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45184.exe
        8⤵
        
        PID:15184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24804.exe
        8⤵
        
        PID:17332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48320.exe
        7⤵
        
        PID:10364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
        7⤵
        
        PID:16512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22348.exe
        6⤵
        
        PID:7496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49191.exe
        6⤵
        
        PID:12496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12911.exe
        6⤵
        
        PID:16812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-814.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        6⤵
        
        PID:8588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58409.exe
        7⤵
        
        PID:13760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65168.exe
        6⤵
        
        PID:15112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36122.exe
        6⤵
        
        PID:7772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12163.exe
        5⤵
        
        PID:9164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10463.exe
        5⤵
        
        PID:13824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18440.exe
        5⤵
        
        PID:18012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18165.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24696.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60264.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14234.exe
        7⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61705.exe
        8⤵
        
        PID:3924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26806.exe
        9⤵
        
        PID:13796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33436.exe
        8⤵
        
        PID:11240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
        8⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21683.exe
        7⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34870.exe
        7⤵
        
        PID:14056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20316.exe
        7⤵
        
        PID:1156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30414.exe
        6⤵
        
        PID:4472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        7⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10099.exe
        7⤵
        
        PID:12408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12735.exe
        7⤵
        
        PID:16476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48880.exe
        6⤵
        
        PID:10132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14607.exe
        6⤵
        
        PID:688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13394.exe
        6⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39822.exe
        5⤵
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48168.exe
        6⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28441.exe
        7⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26470.exe
        8⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16063.exe
        8⤵
        
        PID:14144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8467.exe
        8⤵
        
        PID:18320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14390.exe
        7⤵
        
        PID:11608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        7⤵
        
        PID:16416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51492.exe
        7⤵
        
        PID:18088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3878.exe
        6⤵
        
        PID:7696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4246.exe
        6⤵
        
        PID:16800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3212.exe
        6⤵
        
        PID:17560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12053.exe
        5⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61705.exe
        6⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5720.exe
        7⤵
        
        PID:12172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20508.exe
        7⤵
        
        PID:17228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16716.exe
        6⤵
        
        PID:10236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
        6⤵
        
        PID:17108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25504.exe
        5⤵
        
        PID:7220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59062.exe
        6⤵
        
        PID:10392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13004.exe
        6⤵
        
        PID:15308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30723.exe
        5⤵
        
        PID:12268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14908.exe
        5⤵
        
        PID:17276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39698.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60264.exe
        5⤵
        
        PID:3876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24987.exe
        6⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28441.exe
        7⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56265.exe
        8⤵
        
        PID:9860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59408.exe
        8⤵
        
        PID:14864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38731.exe
        8⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21708.exe
        7⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24326.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3878.exe
        6⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5720.exe
        7⤵
        
        PID:12200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20508.exe
        7⤵
        
        PID:17308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
        6⤵
        
        PID:12544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4246.exe
        6⤵
        
        PID:16844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20316.exe
        6⤵
        
        PID:7648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44255.exe
        5⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39209.exe
        6⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45321.exe
        7⤵
        
        PID:11356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        7⤵
        
        PID:17052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60548.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14303.exe
        6⤵
        
        PID:11004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25069.exe
        7⤵
        
        PID:3136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe
        6⤵
        
        PID:14748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34054.exe
        5⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22057.exe
        6⤵
        
        PID:12184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20508.exe
        6⤵
        
        PID:17376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31216.exe
        5⤵
        
        PID:11964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3020.exe
        5⤵
        
        PID:2008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1365.exe
      4⤵
      PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31832.exe
        5⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61705.exe
        6⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57993.exe
        7⤵
        
        PID:10464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28950.exe
        7⤵
        
        PID:16380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32854.exe
        6⤵
        
        PID:11392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65140.exe
        6⤵
        
        PID:7400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21683.exe
        5⤵
        
        PID:8228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58704.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49725.exe
        5⤵
        
        PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25006.exe
      4⤵
      PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62774.exe
        5⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24441.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18175.exe
        6⤵
        
        PID:11940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5482.exe
        6⤵
        
        PID:17092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21983.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46637.exe
        5⤵
        
        PID:15956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4903.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51302.exe
      4⤵
      PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25014.exe
        5⤵
        
        PID:18064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24995.exe
        5⤵
        
        PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10315.exe
      4⤵
      PID:10668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25959.exe
      4⤵
      PID:16728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2590.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2590.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41976.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13543.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10222.exe
        6⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65080.exe
        7⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11791.exe
        8⤵
        
        PID:9852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16726.exe
        8⤵
        
        PID:14540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
        7⤵
        
        PID:9124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64116.exe
        7⤵
        
        PID:13572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24804.exe
        7⤵
        
        PID:13264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26150.exe
        6⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28281.exe
        7⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28717.exe
        8⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45072.exe
        7⤵
        
        PID:12984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61447.exe
        7⤵
        
        PID:17052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41472.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26998.exe
        6⤵
        
        PID:14084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3596.exe
        6⤵
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45583.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3658.exe
        6⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28441.exe
        7⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10136.exe
        8⤵
        
        PID:10280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28655.exe
        8⤵
        
        PID:15144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9043.exe
        8⤵
        
        PID:8288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14390.exe
        7⤵
        
        PID:11616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        7⤵
        
        PID:16480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26550.exe
        7⤵
        
        PID:17332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9743.exe
        6⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59847.exe
        6⤵
        
        PID:13304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44530.exe
        6⤵
        
        PID:856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65369.exe
        5⤵
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1160.exe
        6⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40038.exe
        7⤵
        
        PID:12144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20508.exe
        7⤵
        
        PID:17264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39307.exe
        7⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21510.exe
        6⤵
        
        PID:9776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64429.exe
        5⤵
        
        PID:7532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9176.exe
        6⤵
        
        PID:10476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11359.exe
        6⤵
        
        PID:14272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8467.exe
        6⤵
        
        PID:17916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63287.exe
        5⤵
        
        PID:11952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
        5⤵
        
        PID:16964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58639.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17016.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4151.exe
        6⤵
        
        PID:4236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28441.exe
        7⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36361.exe
        8⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65264.exe
        8⤵
        
        PID:13872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11155.exe
        8⤵
        
        PID:17200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45808.exe
        7⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49591.exe
        7⤵
        
        PID:14508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58944.exe
        6⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40038.exe
        7⤵
        
        PID:12132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        7⤵
        
        PID:17044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59847.exe
        6⤵
        
        PID:10724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60674.exe
        6⤵
        
        PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61913.exe
        5⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        6⤵
        
        PID:8580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45913.exe
        7⤵
        
        PID:14128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28543.exe
        6⤵
        
        PID:13096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16138.exe
        6⤵
        
        PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41472.exe
        5⤵
        
        PID:9360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26998.exe
        5⤵
        
        PID:14356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59318.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47327.exe
        5⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26854.exe
        6⤵
        
        PID:8432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23062.exe
        6⤵
        
        PID:14220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50525.exe
        5⤵
        
        PID:10112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31135.exe
        5⤵
        
        PID:16316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60182.exe
      4⤵
      PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        5⤵
        
        PID:8620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31231.exe
        5⤵
        
        PID:13168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-378.exe
        5⤵
        
        PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61165.exe
      4⤵
      PID:9144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61846.exe
      4⤵
      PID:13756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19317.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19317.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54939.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54939.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50264.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46808.exe
        6⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65080.exe
        7⤵
        
        PID:5800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6728.exe
        8⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40038.exe
        9⤵
        
        PID:10360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20508.exe
        9⤵
        
        PID:17284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14303.exe
        8⤵
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51815.exe
        8⤵
        
        PID:14452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27684.exe
        8⤵
        
        PID:15540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53568.exe
        7⤵
        
        PID:6692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58761.exe
        8⤵
        
        PID:8688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40772.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34516.exe
        8⤵
        
        PID:7576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50244.exe
        7⤵
        
        PID:12100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        7⤵
        
        PID:16504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43743.exe
        6⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26854.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23062.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50525.exe
        6⤵
        
        PID:10104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31135.exe
        6⤵
        
        PID:16148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59423.exe
        5⤵
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15002.exe
        6⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        7⤵
        
        PID:8644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30463.exe
        7⤵
        
        PID:13248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32474.exe
        7⤵
        
        PID:2732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2655.exe
        6⤵
        
        PID:9220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29798.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26150.exe
        5⤵
        
        PID:6308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55385.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16063.exe
        6⤵
        
        PID:14100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38731.exe
        6⤵
        
        PID:1260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4383.exe
        5⤵
        
        PID:8692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46023.exe
        5⤵
        
        PID:14156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52413.exe
        5⤵
        
        PID:3920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12801.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4042.exe
        5⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63609.exe
        6⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
        7⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13743.exe
        7⤵
        
        PID:13232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17814.exe
        7⤵
        
        PID:17924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        7⤵
        
        PID:18224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
        6⤵
        
        PID:9188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13462.exe
        6⤵
        
        PID:13808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2298.exe
        6⤵
        
        PID:984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54320.exe
        5⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29158.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28351.exe
        6⤵
        
        PID:13064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51499.exe
        6⤵
        
        PID:3512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35030.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5487.exe
        5⤵
        
        PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57947.exe
        5⤵
        
        PID:6544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2625.exe
      4⤵
      PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58457.exe
        5⤵
        
        PID:8380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52825.exe
        6⤵
        
        PID:13616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18938.exe
        6⤵
        
        PID:15736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23062.exe
        5⤵
        
        PID:14196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20170.exe
        5⤵
        
        PID:8048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62407.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44646.exe
      4⤵
      PID:4620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13086.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13086.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43035.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27291.exe
        5⤵
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65080.exe
        6⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62390.exe
        7⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5720.exe
        8⤵
        
        PID:10620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27300.exe
        8⤵
        
        PID:1144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49088.exe
        7⤵
        
        PID:11120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5302.exe
        7⤵
        
        PID:15380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39452.exe
        6⤵
        
        PID:7316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16134.exe
        6⤵
        
        PID:11284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60960.exe
        6⤵
        
        PID:16740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43743.exe
        5⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        6⤵
        
        PID:8540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28351.exe
        6⤵
        
        PID:13072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18966.exe
        6⤵
        
        PID:18328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41140.exe
        6⤵
        
        PID:17380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16399.exe
        5⤵
        
        PID:10184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13926.exe
        5⤵
        
        PID:14476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43662.exe
      4⤵
      PID:1928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49320.exe
        5⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50169.exe
        6⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26086.exe
        7⤵
        
        PID:9440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13833.exe
        8⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46916.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65531.exe
        7⤵
        
        PID:16232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21983.exe
        6⤵
        
        PID:9712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56423.exe
        6⤵
        
        PID:14960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16138.exe
        6⤵
        
        PID:8176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43567.exe
        5⤵
        
        PID:7476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64359.exe
        5⤵
        
        PID:11340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        5⤵
        
        PID:16444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42179.exe
        5⤵
        
        PID:7348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26150.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        5⤵
        
        PID:8564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41703.exe
        5⤵
        
        PID:12456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45600.exe
        5⤵
        
        PID:17880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34947.exe
      4⤵
      PID:9992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37087.exe
      4⤵
      PID:14940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17384.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17384.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13642.exe
      4⤵
      PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50472.exe
        5⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46246.exe
        6⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62985.exe
        7⤵
        
        PID:9652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20095.exe
        7⤵
        
        PID:14368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44788.exe
        7⤵
        
        PID:7740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56576.exe
        6⤵
        
        PID:10684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41623.exe
        6⤵
        
        PID:372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65339.exe
        6⤵
        
        PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5903.exe
        5⤵
        
        PID:6912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-152.exe
        6⤵
        
        PID:12092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3612.exe
        6⤵
        
        PID:17840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49575.exe
        5⤵
        
        PID:11928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45200.exe
        5⤵
        
        PID:16704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15422.exe
      4⤵
      PID:5516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49894.exe
        5⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
        6⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55465.exe
        7⤵
        
        PID:18136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27420.exe
        6⤵
        
        PID:15028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45556.exe
        6⤵
        
        PID:6456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2575.exe
        5⤵
        
        PID:12040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33366.exe
        5⤵
        
        PID:17004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28403.exe
      4⤵
      PID:7952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32566.exe
        5⤵
        
        PID:12480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3178.exe
        5⤵
        
        PID:18028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41133.exe
      4⤵
      PID:12628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4246.exe
      4⤵
      PID:16860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20809.exe
      4⤵
      PID:6152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38254.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38254.exe
    3⤵
    PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65080.exe
      4⤵
      PID:5808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44617.exe
        5⤵
        
        PID:8492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45072.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16138.exe
        5⤵
        
        PID:8184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4959.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29798.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29798.exe
      4⤵
      PID:6916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55209.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55209.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61337.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37641.exe
        5⤵
        
        PID:13484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51803.exe
        5⤵
        
        PID:18360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33151.exe
      4⤵
      PID:13636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12438.exe
      4⤵
      PID:17604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56699.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56699.exe
    3⤵
    PID:9156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7208.exe
      4⤵
      PID:16196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-663.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-663.exe
    3⤵
    PID:13840
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34177.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34177.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55128.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55128.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40907.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13543.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16331.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39512.exe
        7⤵
        
        PID:4868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1160.exe
        8⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46073.exe
        9⤵
        
        PID:9700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40073.exe
        10⤵
        
        PID:16308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2991.exe
        9⤵
        
        PID:14456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24996.exe
        9⤵
        
        PID:3036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41116.exe
        8⤵
        
        PID:10660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41623.exe
        8⤵
        
        PID:14484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28452.exe
        8⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10895.exe
        7⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42422.exe
        8⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18175.exe
        8⤵
        
        PID:13208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29713.exe
        8⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37364.exe
        7⤵
        
        PID:9284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62288.exe
        7⤵
        
        PID:14976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50532.exe
        7⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61913.exe
        6⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        7⤵
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7208.exe
        8⤵
        
        PID:15244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33151.exe
        7⤵
        
        PID:13664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24804.exe
        7⤵
        
        PID:9384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55120.exe
        6⤵
        
        PID:9256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26998.exe
        6⤵
        
        PID:13660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15939.exe
        6⤵
        
        PID:17596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56822.exe
        5⤵
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17416.exe
        6⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54217.exe
        7⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45465.exe
        8⤵
        
        PID:17320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62896.exe
        8⤵
        
        PID:16824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54683.exe
        8⤵
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4044.exe
        7⤵
        
        PID:12036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39335.exe
        7⤵
        
        PID:16676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47808.exe
        6⤵
        
        PID:6568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51879.exe
        6⤵
        
        PID:12700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32666.exe
        6⤵
        
        PID:16700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
        5⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4056.exe
        6⤵
        
        PID:8204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39103.exe
        6⤵
        
        PID:12804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42599.exe
        6⤵
        
        PID:17740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-378.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30419.exe
        5⤵
        
        PID:8684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63421.exe
        5⤵
        
        PID:12360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9630.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33160.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48344.exe
        6⤵
        
        PID:2592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50280.exe
        7⤵
        
        PID:3752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44617.exe
        8⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45072.exe
        8⤵
        
        PID:12992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34150.exe
        8⤵
        
        PID:17868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
        7⤵
        
        PID:9196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64116.exe
        7⤵
        
        PID:12448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36890.exe
        7⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12415.exe
        6⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63488.exe
        7⤵
        
        PID:9964
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9964 -s 632
        8⤵
        Program crash
        
        PID:15340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16726.exe
        7⤵
        
        PID:14464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14854.exe
        6⤵
        
        PID:8572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54688.exe
        6⤵
        
        PID:14240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36506.exe
        6⤵
        
        PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60082.exe
        5⤵
        
        PID:1412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3967.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24012.exe
        7⤵
        
        PID:9784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46637.exe
        7⤵
        
        PID:15672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60695.exe
        6⤵
        
        PID:9948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47671.exe
        6⤵
        
        PID:16184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35347.exe
        6⤵
        
        PID:17992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9539.exe
        5⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45878.exe
        6⤵
        
        PID:8524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22486.exe
        6⤵
        
        PID:14256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
        6⤵
        
        PID:7472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52240.exe
        5⤵
        
        PID:8304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26998.exe
        5⤵
        
        PID:13920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26645.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55848.exe
        5⤵
        
        PID:2588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28441.exe
        6⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40038.exe
        7⤵
        
        PID:12240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        7⤵
        
        PID:16588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5647.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29149.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58752.exe
        5⤵
        
        PID:7252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59145.exe
        6⤵
        
        PID:10308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11743.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44596.exe
        6⤵
        
        PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59847.exe
        5⤵
        
        PID:8752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44914.exe
        5⤵
        
        PID:17532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60182.exe
      4⤵
      PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26854.exe
        5⤵
        
        PID:8424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23062.exe
        5⤵
        
        PID:14180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16138.exe
        5⤵
        
        PID:15324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61165.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61846.exe
      4⤵
      PID:13744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22859.exe
      4⤵
      PID:16192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5582.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5582.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45832.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48427.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5962.exe
        6⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11720.exe
        7⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
        8⤵
        
        PID:9804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27420.exe
        8⤵
        
        PID:15036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1651.exe
        8⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14390.exe
        7⤵
        
        PID:11600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        7⤵
        
        PID:16528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27340.exe
        6⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39654.exe
        7⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20508.exe
        7⤵
        
        PID:17256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11155.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30451.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        6⤵
        
        PID:16400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19262.exe
        5⤵
        
        PID:1444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28441.exe
        6⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40313.exe
        7⤵
        
        PID:9924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60176.exe
        7⤵
        
        PID:14796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5647.exe
        6⤵
        
        PID:10252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29149.exe
        6⤵
        
        PID:16120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9743.exe
        5⤵
        
        PID:7680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46391.exe
        5⤵
        
        PID:12340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53248.exe
        5⤵
        
        PID:16836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60674.exe
        5⤵
        
        PID:18300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56246.exe
      4⤵
      PID:1136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17416.exe
        5⤵
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26854.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45072.exe
        6⤵
        
        PID:13000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15318.exe
        6⤵
        
        PID:18036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9043.exe
        6⤵
        
        PID:16528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
        5⤵
        
        PID:9180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13462.exe
        5⤵
        
        PID:13788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29713.exe
        5⤵
        
        PID:1236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
      4⤵
      PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22521.exe
        5⤵
        
        PID:9240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16063.exe
        5⤵
        
        PID:6260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44795.exe
        5⤵
        
        PID:16448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30502.exe
      4⤵
      PID:9300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57417.exe
      4⤵
      PID:13684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
      4⤵
      PID:7204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22488.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22488.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33051.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54312.exe
        5⤵
        
        PID:2424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18843.exe
        6⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61145.exe
        7⤵
        
        PID:9084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65072.exe
        7⤵
        
        PID:13832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32639.exe
        6⤵
        
        PID:7464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29798.exe
        6⤵
        
        PID:13964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45281.exe
        6⤵
        
        PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48461.exe
        5⤵
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58649.exe
        6⤵
        
        PID:8396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23062.exe
        6⤵
        
        PID:14188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16138.exe
        6⤵
        
        PID:7240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35030.exe
        5⤵
        
        PID:9344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54688.exe
        5⤵
        
        PID:14232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50783.exe
      4⤵
      PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63609.exe
        5⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54425.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16063.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5098.exe
        6⤵
        
        PID:18072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
        5⤵
        
        PID:9204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64116.exe
        5⤵
        
        PID:13584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62196.exe
      4⤵
      PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59145.exe
        5⤵
        
        PID:10300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11743.exe
        5⤵
        
        PID:15216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57668.exe
        5⤵
        
        PID:3180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16015.exe
      4⤵
      PID:9748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63127.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63127.exe
      4⤵
      PID:14416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51601.exe
      4⤵
      PID:6056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17134.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17134.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32910.exe
      4⤵
      PID:5184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58457.exe
        5⤵
        
        PID:8736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-479.exe
        5⤵
        
        PID:13688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28836.exe
        5⤵
        
        PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32918.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32918.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26518.exe
      4⤵
      PID:13828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30197.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30197.exe
    3⤵
    PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10376.exe
      4⤵
      PID:6820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
        5⤵
        
        PID:10152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26351.exe
        5⤵
        
        PID:15060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45556.exe
        5⤵
        
        PID:5436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32460.exe
      4⤵
      PID:8488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1542.exe
      4⤵
      PID:14756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21766.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21766.exe
    3⤵
    PID:6228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55990.exe
      4⤵
      PID:10340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
      4⤵
      PID:16068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29225.exe
    3⤵
    PID:11308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9566.exe
    3⤵
    PID:16580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13795.exe
    3⤵
    PID:5976
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65526.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65526.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40907.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40907.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56143.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9418.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30680.exe
        6⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6360.exe
        7⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26908.exe
        7⤵
        
        PID:4860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58523.exe
        7⤵
        
        PID:7596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48960.exe
        6⤵
        
        PID:7996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35268.exe
        6⤵
        
        PID:12620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12911.exe
        6⤵
        
        PID:16828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3251.exe
        6⤵
        
        PID:17612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63087.exe
        5⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30342.exe
        6⤵
        
        PID:11084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11167.exe
        6⤵
        
        PID:13816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65332.exe
        6⤵
        
        PID:16236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46375.exe
        5⤵
        
        PID:8200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35664.exe
        5⤵
        
        PID:6940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35930.exe
        5⤵
        
        PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19624.exe
      4⤵
      PID:2544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17032.exe
        5⤵
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33833.exe
        6⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59145.exe
        7⤵
        
        PID:10352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28079.exe
        7⤵
        
        PID:15236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38539.exe
        7⤵
        
        PID:4568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21510.exe
        6⤵
        
        PID:9780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        6⤵
        
        PID:16944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44829.exe
        5⤵
        
        PID:7528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28425.exe
        6⤵
        
        PID:13912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48023.exe
        5⤵
        
        PID:11452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        5⤵
        
        PID:16472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32016.exe
      4⤵
      PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44809.exe
        5⤵
        
        PID:8596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24035.exe
        6⤵
        
        PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14511.exe
        5⤵
        
        PID:13124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18883.exe
        5⤵
        
        PID:17884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61255.exe
      4⤵
      PID:8616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43577.exe
      4⤵
      PID:15364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58639.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58639.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16331.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
        5⤵
        
        PID:4356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51321.exe
        6⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56265.exe
        7⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59408.exe
        7⤵
        
        PID:14880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40623.exe
        6⤵
        
        PID:10436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58535.exe
        6⤵
        
        PID:15280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51883.exe
        6⤵
        
        PID:4112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3878.exe
        5⤵
        
        PID:7896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
        5⤵
        
        PID:12560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4246.exe
        5⤵
        
        PID:16876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52703.exe
      4⤵
      PID:4452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62182.exe
        5⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
        6⤵
        
        PID:9972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40772.exe
        6⤵
        
        PID:15940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49195.exe
        6⤵
        
        PID:600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5647.exe
        5⤵
        
        PID:10244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29149.exe
        5⤵
        
        PID:16108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65140.exe
        5⤵
        
        PID:13508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40692.exe
      4⤵
      PID:7288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59145.exe
        5⤵
        
        PID:10316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45184.exe
        5⤵
        
        PID:15192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41332.exe
        5⤵
        
        PID:3484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30054.exe
      4⤵
      PID:12052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30498.exe
      4⤵
      PID:1536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59894.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59894.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32910.exe
      4⤵
      PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58457.exe
        5⤵
        
        PID:8448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18102.exe
        6⤵
        
        PID:17380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40563.exe
        6⤵
        
        PID:4136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45072.exe
        5⤵
        
        PID:13016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17046.exe
        5⤵
        
        PID:17980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24804.exe
        5⤵
        
        PID:216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14963.exe
      4⤵
      PID:7376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4444.exe
      4⤵
      PID:13596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36122.exe
      4⤵
      PID:7876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38863.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38863.exe
    3⤵
    PID:1644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55840.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3448.exe
        5⤵
        
        PID:13332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5290.exe
        5⤵
        
        PID:220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
      4⤵
      PID:12528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4246.exe
      4⤵
      PID:17188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20700.exe
      4⤵
      PID:5948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37891.exe
    3⤵
    PID:7296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11116.exe
    3⤵
    PID:7792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31097.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31097.exe
    3⤵
    PID:17088
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25183.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25183.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13351.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13351.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16331.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32910.exe
        5⤵
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3496.exe
        6⤵
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45847.exe
        6⤵
        
        PID:15372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29713.exe
        6⤵
        
        PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48880.exe
        5⤵
        
        PID:10124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14607.exe
        5⤵
        
        PID:960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19548.exe
        5⤵
        
        PID:428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29925.exe
      4⤵
      PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11944.exe
        5⤵
        
        PID:8504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12399.exe
        5⤵
        
        PID:13040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15318.exe
        5⤵
        
        PID:17796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11155.exe
        5⤵
        
        PID:17316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55120.exe
      4⤵
      PID:9264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-296.exe
        5⤵
        
        PID:18120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25187.exe
        5⤵
        
        PID:7840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24892.exe
      4⤵
      PID:13608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64707.exe
      4⤵
      PID:5464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46159.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46159.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6839.exe
      4⤵
      PID:2016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11720.exe
        5⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60214.exe
        6⤵
        
        PID:10224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42687.exe
        6⤵
        
        PID:14988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61515.exe
        6⤵
        
        PID:7620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55424.exe
        5⤵
        
        PID:9916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46637.exe
        5⤵
        
        PID:15936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43676.exe
      4⤵
      PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57993.exe
        5⤵
        
        PID:10416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13004.exe
        5⤵
        
        PID:15316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60916.exe
      4⤵
      PID:13288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32997.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32997.exe
    3⤵
    PID:4960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34601.exe
      4⤵
      PID:7068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13784.exe
        5⤵
        
        PID:9676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20095.exe
        5⤵
        
        PID:14560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40623.exe
      4⤵
      PID:10428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34816.exe
      4⤵
      PID:16352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14927.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14927.exe
    3⤵
    PID:7368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39654.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20508.exe
      4⤵
      PID:17240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29542.exe
      4⤵
      PID:16460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27651.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27651.exe
    3⤵
    PID:10784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14031.exe
    3⤵
    PID:16388
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4613.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4613.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10222.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10222.exe
    3⤵
    PID:988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1079.exe
      4⤵
      PID:676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11944.exe
        5⤵
        
        PID:8512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58409.exe
        6⤵
        
        PID:13780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15039.exe
        6⤵
        
        PID:17436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22486.exe
        5⤵
        
        PID:14248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19786.exe
        5⤵
        
        PID:7732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1228.exe
      4⤵
      PID:9212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64116.exe
      4⤵
      PID:13632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57860.exe
      4⤵
      PID:14276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
    3⤵
    PID:6616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3496.exe
      4⤵
      PID:8536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19932.exe
      4⤵
      PID:16260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57319.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57319.exe
    3⤵
    PID:9984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14495.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14495.exe
    3⤵
    PID:14380
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7310.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7310.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4151.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4151.exe
    3⤵
    PID:1548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28441.exe
      4⤵
      PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40038.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
        5⤵
        
        PID:17060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8659.exe
        5⤵
        
        PID:17936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5647.exe
      4⤵
      PID:9644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42391.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42391.exe
      4⤵
      PID:15160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43636.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:18084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3878.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3878.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe
    3⤵
    PID:12536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4246.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4246.exe
    3⤵
    PID:16868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21577.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21577.exe
    3⤵
    PID:5140
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64168.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64168.exe
  2⤵
  PID:1700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11445.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11445.exe
    3⤵
    PID:6924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25263.exe
      4⤵
      PID:116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34243.exe
      4⤵
      PID:17332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18303.exe
      4⤵
      PID:1232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14390.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14390.exe
    3⤵
    PID:11584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
    3⤵
    PID:17012
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31691.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31691.exe
  2⤵
  PID:6280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55305.exe
    3⤵
    PID:12072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19631.exe
    3⤵
    PID:16952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60164.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60164.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:60
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32919.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32919.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4308
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8431.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8431.exe
  2⤵
  PID:2776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 9964 -ip 9964
1⤵
PID:14264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 15316 -ip 15316
1⤵
PID:17656

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-13086.exe

Filesize
468KB

MD5
02cf4d848842950df7d2c6dbfff0bf0e

SHA1
8386224825adb8e8a409370ab4614df7a0ec6807

SHA256
deef311f005c735ad1897fa172542e6afbc26315689046a6b2e0805b65e65039

SHA512
bf37573312c6e7da5c74fb919ae3e9a9bda8c3cde24a208e9f4e40dddfbd6093cfa8eb927e43601f5f176c6e7f5372f84b00a7d382b527a3e3b60024cc16ec60

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13351.exe

Filesize
468KB

MD5
ef34b3d9c07538ccc14248b328b74356

SHA1
b4e1163cb9091c94e5102d7662ef4cddcedd80a7

SHA256
8438d3a3e64d2ba006ce2118e47a94f3c2a9549dc9685ab5f358859fbd5d7e45

SHA512
2c453b9da9c519fe8dd729038ef4b4f830bb5dd2d539ee583faa5dc484369bd9a6938d5678deb3e5491551089518cf1876d68e98d2bb35ff4edefd1558384d6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13543.exe

Filesize
468KB

MD5
ef392be8fbb939a697175f2d48fcb9c5

SHA1
fe96b7dcb6e727d13e899664ce5bb1334ef1a048

SHA256
b122dacc670888750f9f04717c85c60aba8a18163f363941b19694e38044f293

SHA512
0a7248392f2d02abfbcb07f1ca47ca8bfbec83550c83196c7860d8e2aefb2c74a39fa88cf3a25219b76bb6b6635f4902c9a781bd42660abece97975b9a72e1d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16716.exe

Filesize
468KB

MD5
4ed4122592e943f8f58f4bdd7cb7ff07

SHA1
c3487fb5772789b817ecf3b23a2933c1f6ca4381

SHA256
b273adc2388372a1341dc5c386abb18df8ffdec389b02f6714ad4ade64639e02

SHA512
2d174ff5896ea133cd63c2772d1ca328fcbef1b33c9b7eb59fe1047609a33a696591bbac3500acc728b9b1fb49c63fdb24dec188fbeb6ee5fe6cf581f9fdf565

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18165.exe

Filesize
468KB

MD5
1f81a256c5efd151cf8797b3ad851c49

SHA1
40cd8d5887b3d405e9824f2866772819f7545908

SHA256
77a565f21787d463442b31ac646e3afdde017e57ce298b67d5e530deda68fcd2

SHA512
cae0de2cac5085cfaf132528074754828d805177944a65138fa6f4de90ce7a4e16800843ccabc4be8a4b95a510d21ac7462f7a48e6995037d9fe09e40800cf19

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18462.exe

Filesize
468KB

MD5
039a94f2c313b62f5b0eeef8eccd51ce

SHA1
f5dea74ff5b28ee851b6cf69e73fd17f08f58207

SHA256
57fdfab00a3c9138a826fbe571d20c22597b850be4f1ddae6d839df6cf0856c0

SHA512
83aa6ec634e5eac4da1c2f023194aa456046edad36013fe1fcb8a4d4068b83f4b16e1df50f448ca38909fb188b0647496a7214916d9bd9549be15565f4d38c47

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19317.exe

Filesize
468KB

MD5
36403306211b5267e4b11b9e95180a3c

SHA1
23482a994ade4941065989eed0586e1a7a7735a9

SHA256
6285910c7bf4157d5e11e5555989a00097f2b84395afac5563b6e40cfb8b7632

SHA512
34aff2c482a53482ece0db53acc9b764d69f4c23703398cdc10ab7daf63465b3e6481f7f37886cafe13c0ed98d866e4a6b9de30ea75621f1ad7ac19385b6f01d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20481.exe

Filesize
468KB

MD5
52b9baa40d7ee6b01fa025b736c47033

SHA1
a1d35e0c78e12238517ce26e65274a0ae57c7a79

SHA256
0de052ea03decfa1d890320e988c951c761468108c480fdf586c98aa3edfcf54

SHA512
be3fa34a3a363a910cccac06ccca575840eb100160d860c99f0cfbb3bef487c5487eac3e08aab2f127ce15c770d67b2563ebaa3c499813ddce50e58d89463037

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21708.exe

Filesize
468KB

MD5
c01031f07e20d70746c0b82fb8e8f36f

SHA1
b6a2969de9e98f5ff506ea35aec7348476178455

SHA256
0f30a07d7142a3c2c2c5f072ee22288d164df2c3f78d1d7878396b4bd7dbdf5b

SHA512
81eb27ac6ec6f49f4b8956fb668e19a2eb9181b857ee7bf595b7fce9e6b553416898d0a0b424b5da194defc781cb9ed98663d4faa613b5288f27bd92941e83e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22488.exe

Filesize
468KB

MD5
75a2e72101349b4d9665379bad93e7e6

SHA1
10a5637fca8bffc88271159c36f8d16e35cb40c7

SHA256
a53d9d33630a2f64e1df3e1f99f7fecd75bacaf47595728826c3cafef9eae217

SHA512
783ca066575b1fbe4eb09dc39a5f9ef485bdae5875d0f8cc110a1e7ee652b5f14cfc1693fef0a106a7987a4d02810a9b2b0f23696c0effa1141e46de1dd761e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23920.exe

Filesize
468KB

MD5
6ea7931e1a80ab1f4486a8ba1dc107dc

SHA1
03311242fe4fd63d25e991a9876e8448e014b36f

SHA256
d9abbbb3d98d8227458392e43f1f66786a5999e05b9e66045209ca1abe920516

SHA512
60e79b24983c6c85e8e52bac79abd9071274231522e4fd2fb3a546f5d33f67519d1e4bcf11233dc7c5ab6475008ebc6ad13beab5300705d044456d11bec5db48

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25183.exe

Filesize
468KB

MD5
00fa75d399e8088b775c781f14707b63

SHA1
e2442ed649fe2a614b4905fd5e5e9ff9afd1c944

SHA256
6e4a8a466678c2f9a0043deb75de94c91ad3f19e30246e728ac24c1f761efd1a

SHA512
d8068a4eef92a5e0bc7f0d9d1ef7c3c25323668f0309f67ce2a430c6075c018fcfa5fdb3a7be8ec15a4d38715cb857b76db5fc7b4c89793680bbdc64dc1523a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25832.exe

Filesize
468KB

MD5
0bf52431d8cffb26dfb9f43d58409471

SHA1
3db6da3277a69649611157d7281c3cbc1e0a2008

SHA256
b2bd66e12f42e7deaae4877414d99daf4004b4e48bc1dddfee2f3a406207f11a

SHA512
6c886ae655e45e6d257019f5f6e73573131c44b1fc7efc7705cecb1640013feeee9084f7aa6406e9e33ce259f92fb801ab3311f9a25439ede37ce5676843cf21

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2590.exe

Filesize
468KB

MD5
fee3364f25303fa1425c755519400b97

SHA1
71d37024cd87e0367c02c4f6d183ceb855de6b5e

SHA256
30220cd185968a34d6fa67097bf65cab84414126cfa46a6eadcf1ecad18d110d

SHA512
f1addc0ade9e675b53b5f14fbbce7b0f6b36b775372ed0718290700555bccf2af67470a7905bfed07a39abc78d89875b523b03a44f49e2ebd46e6cc8d9a57068

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34177.exe

Filesize
468KB

MD5
dad8e97b9bbbd79a3efb03011013169b

SHA1
d18de790a9f026efb6cd335f08ae7948da871ef4

SHA256
67b1ac5ae8e70fcf1928d9eaa461c7308dcc1c1c2adf2ffabcb7f522ef7bdb66

SHA512
e85f8ead7c42816595af5af09af8164b813959013ee91fc8fdb0cc08489d3301866dfe09ba43b18e6ef05c1b37fd5b3c399c245195b73c760d84e0f7f9eb4e02

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37451.exe

Filesize
468KB

MD5
be71ce60c83b02f6888951343ed7f584

SHA1
b9630f0c6b9a693d3d2fd169102d03cbc6c004ea

SHA256
aed7e567fc01cea6f11e78883169d3bb0b0ece6ee23881763e464ceaaec15dde

SHA512
aeffa51a615af5f2e62544fbb0c5925d02c9f82b3f998b1c5fc383591dd362c00aec36fb5be776676187c653bd5cf83a6464c5b0e5000720aa821307a0dc0e58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37761.exe

Filesize
468KB

MD5
059281403435cce3c2b8e4a7f1b78922

SHA1
0a904593a0297e702c5489b24058e41934aeca09

SHA256
5ef547f0b49b116c6d32b95069d0da8e5b82ea26e421e39f5cf9473154f9b8a5

SHA512
02d87da8bbbdc795a216544d6111df173476fc97c95d345905572a1c08e1aa41a0e9a5eb312a710e2fb6ebd30ff0cb4ee5c516ede76b7f187b08c76d735bc935

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38299.exe

Filesize
468KB

MD5
d5c43e1f519f6c659115d3d6f3d7075e

SHA1
12b802907f588de2601253b58eab9da6f7c4fee3

SHA256
cc58a8f4c89612c4a17135ac98e36305f6bcd76921773afa832c2bf7b7e1ea45

SHA512
b55c128c045e66313f5330e8e04b875562570904b3b49f1193e112a26b7e22b986c820db2095dd3b6a6ec2006832ebd3c6e356ea8b131a4b61f2d222d8bccc02

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38328.exe

Filesize
468KB

MD5
6fd774d96bf8a7d562f70cec70da0d45

SHA1
9dcc26cadb732295e59036a0ac53bffaa8ba0928

SHA256
73e90ed13b691dfa4f36d7efba18672b1bbb4064e7bffaba897acea044e2b912

SHA512
ca462000dba13fc6d3225783531a5061e7c498022a1b3927868cae956acea95925185a630bd4c8d760526f39e899429c4837dfab07e7e82839c8aaed12a89869

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38776.exe

Filesize
468KB

MD5
e4a95d2be3461f12878461b9ebab3dbc

SHA1
16bc1ee8dce9b511a4f1bda5db33736740b57245

SHA256
52d0a9360f3c8a51fabe58569d36d820f45a1233e204908b6e1858d1c294476e

SHA512
c1a3da72726111f68e99fd5d424a2deb4f85f5cfebb97a96b7e63f65b4dfbdeffad353bfaa994c63f0029b95fcc1ee6a56e57f1ef0a4dc8fc6f4a503d950bb0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39160.exe

Filesize
468KB

MD5
2ba874c22c4fc06fa21cf0df72123498

SHA1
9572f72f2d9c30f27ff169f5807a635e1f919130

SHA256
866bd515d1e646b5385d261bcd8be3e3633721b7c92f3d077719dc1143d70717

SHA512
0f6cbcde82e3d160e372fac3d529e1fb67e0c88ac79fb57e26d1e381248a2dddc745bf02f3258919dfb25d28af8cf3df5f26f4d800a26b5547041485a0900680

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40907.exe

Filesize
468KB

MD5
3c18284094ff9bc9e4ec8eb326d0dfd1

SHA1
83026b390167b79873256e0f9008194020a48cd7

SHA256
0879f8ef295ab41de89ca8f3eeb4e37a29ec59211dde7fbc3c420bcb391e17ff

SHA512
5096fa1012b9f8c7c3be3023b3dbe398f5c05ac22084bbc6ec03f94cbcaf191d15a572bc161fc925bef7da53206251d6ede804a8c4eb486d7ed78204836e1a70

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41976.exe

Filesize
468KB

MD5
49291ad00fd84adbf810f42ac9d7ea9c

SHA1
fa319fb31cf3fe6258b72dbc4cb883de54ee1df4

SHA256
95fec0f995ae2c8edeb1967cbec676d6bf28f31d1b4faa59b0baff093cb65758

SHA512
df2c41ab346b68ec9dcd7f8056001ca062621cdb11edc9ebd38b2a38af1cacff50b76767a65b4fe74c4b20c9d10b0ff907c2c69ed5aa8de3617f52cf64f82111

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45832.exe

Filesize
468KB

MD5
ec90af2fb24131e217bbcccae156cbd9

SHA1
8397114cb7dff15b3cde6006f154d3713d5f5454

SHA256
a9afbf4d55426f3c677203cab5784f7c625b2bc783c536a73c3cdd3099ffc69b

SHA512
d019ebb1877638835858260c2abc9294ec40ed9a17f578e9fc167dadf8735ad4fc465425618b1a8913c3bcc9bab98dfb154f8c841425b2a0368d77943a79dc8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4613.exe

Filesize
468KB

MD5
04b8b744835ae8316594d5e93f75129c

SHA1
3b6f24027503ce5d81ff5e8400bd2f45cb0d3be4

SHA256
3e91c46b2703969d55102cb5f1491c60472eeb36c09972f26468754c614fadba

SHA512
6ff843f4b90429e103eaefa51a480ae4d576727a4151cb6633222772d999690653644ec0a55cf91e5c6c851d4ab51936bcdff8ab0bda76ca98ce072934f2a00f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54939.exe

Filesize
468KB

MD5
4729873951a078bf630b51b5425dbce3

SHA1
5fc6a4459bb86895d4720a0fc23ecf391194fb31

SHA256
f75f5dad380182d77cbde44f636a2eed21a1ded5b0004a3de9b468d4c29c93a2

SHA512
cf50a9081bf6471fe0e079c84412f8c986f4b621382b18e66c02fc0ed14f19f5d9592a9c10e39b73965787eb4dbb062c5bbf0ecc6fb20c65ce2393bc76e09ae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55128.exe

Filesize
468KB

MD5
ccc1f02bc86813612028711255dad581

SHA1
1c77f0db224f7c3559188ae399800a249a095bce

SHA256
4ec9da88355072461325c622c293b7c7740d3810676e7d431802b96eb1639cac

SHA512
a694b1e5d24b2ce263d07cd83194a046ae00a569348db8970079f643357f2a0ef2b79e4b894ffdbc7a34882ef22684d542b2b3d36b88a8dc97b6ce2a9c8ae2ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5582.exe

Filesize
468KB

MD5
dca8232caf333caaf66ac1eaf3896725

SHA1
1e7d2c10d08f445b5b6309440256f800cbb86e82

SHA256
d473df7cebbb3c67100f5307d68097fe6b2951e3535e181fbc0ad436be2cc539

SHA512
312b2db38a96d788d73d763e12bdec3d90abf32a619f9a84e6059155670ac372945cbd44aba9812c4b6eaee770b5af35afb392850c3c8887cd618e4d94b41aba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57560.exe

Filesize
468KB

MD5
53ca5187ba57bc7319d5fa70375d8e25

SHA1
654960c12c5baaa237260f6f244d8d53e917007a

SHA256
e4eded3fd665a34899b262d76ef62c1bee504f7b16970a6649d35ea27b90ea72

SHA512
12a30b84ea7359c054b09496c1c5dc68ea04f9007a80cb5e62a14a8d46e2b9f9d8f469ae4d9614b5c1eb260ee54533ac1a26b4c401a72ba0da6ffacef34494af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58639.exe

Filesize
468KB

MD5
53268be271772032e52ed233b26f1d6b

SHA1
44fd23730a4388bec11fd2a71d65c3a5118f48e1

SHA256
61fc49a6461ad190e9dde73ce9ee8554a4232c217b94e386198f06f39bd64b93

SHA512
ac2aeea926034eb5d89bfd739bd7cc89c52d7f9101875e8e5fb5a807d6d3cffff509e4a16c7d2a7ae2304600acc54741d35410d18fb729d01bc2d65697273ef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65526.exe

Filesize
468KB

MD5
ab4fdcf604d9a066eff2c1cd3b575f1d

SHA1
c09d2441e6a811521b333d2dff4fb94a1f3608c0

SHA256
9b22f3704853e32c0d52706309be5f5f1268b97d7e09ba8ff9ee63fcaa3ac359

SHA512
11cfecd1d65bae0cf9d92ff64ed2982ac0f0a1dfae1c6cd1e253e1b19f0fb485ddd1d3d8fd841ca8f25fb97ca0a331a8d7969c373e50b918afcc59c0f7ceb292

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9344.exe

Filesize
468KB

MD5
04029222a47bc6e05ec2c9750b374277

SHA1
2833c208ca0132f469a2172e6ba0e1510d286ae1

SHA256
feab83d9f6413c2435c8a826001df4e366d3b771c14ce1344994236ae41cae60

SHA512
acbf0cfab6fe15f10b70f700a3bdc0ef70b6b02183c63033c29cf3955c05ed92654332a44815eeb73cbdc4c6b86e3568d943c674b0e61c8c7af4f379c9a0e605

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9630.exe

Filesize
468KB

MD5
53528ca3225c12c1e5ab278af6890fb6

SHA1
c309bb01c5a7104d0c706bd6b2f3c05896cc62e9

SHA256
f7da96694831dbe58e75c326bd0a117a877c77587a266ba56f45d030d8909668

SHA512
203e49d3c24aa344930c2a4be25932c7fae9f1be533fe0c2f6c5261dfc6e0d265391a1b044020d26440070bdce7e12296589cbdc08706bf68e3104c48d0bdd91

Download Submit
memory/456-2761-0x0000000075E80000-0x0000000075EF5000-memory.dmp

Filesize
468KB

Download
memory/7424-2745-0x0000000077A00000-0x0000000077A0A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads