48c304504bc8319759da0097b2c670b695597a19050fa6d40fbf8c53e8454ab0

Analysis

max time kernel
120s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 07:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

48c304504bc8319759da0097b2c670b695597a19050fa6d40fbf8c53e8454ab0N.exe
Size

468KB
MD5

a680f7b5870d652aa6eae6885e684010
SHA1

08a82343588f8cd0a67d08bb5f96bd3e9f684a4a
SHA256

48c304504bc8319759da0097b2c670b695597a19050fa6d40fbf8c53e8454ab0
SHA512

33a27f5dc94d8899dc469d1897c9a5d6d7c186e1fd09adecb846323816a034acf78010abd9a4ba341dbc42c0bca44ae6fdee87ece30a6549629067d502442ed1
SSDEEP

3072:4belogsaIU57tbYZPzcfmbfD/n2DnsIH9QmyoQVqBf5mkkiDumulE:4b4oHc7tCP4fmbfraJxf5H7Dum

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3000	Unicorn-16670.exe
4976	Unicorn-32246.exe
1792	Unicorn-61773.exe
1772	Unicorn-49646.exe
4932	Unicorn-13444.exe
648	Unicorn-33310.exe
4108	Unicorn-60703.exe
916	Unicorn-60798.exe
1280	Unicorn-44270.exe
220	Unicorn-38519.exe
232	Unicorn-58385.exe
4252	Unicorn-14015.exe
4452	Unicorn-27750.exe
4160	Unicorn-42926.exe
2456	Unicorn-58312.exe
4236	Unicorn-53393.exe
1124	Unicorn-62630.exe
1604	Unicorn-33719.exe
3188	Unicorn-53320.exe
4604	Unicorn-53585.exe
4972	Unicorn-33444.exe
3788	Unicorn-33444.exe
3600	Unicorn-53310.exe
1924	Unicorn-580.exe
3756	Unicorn-20446.exe
4408	Unicorn-12277.exe
3632	Unicorn-61670.exe
4612	Unicorn-28043.exe
4616	Unicorn-30843.exe
4428	Unicorn-12479.exe
2780	Unicorn-41317.exe
456	Unicorn-22937.exe
2468	Unicorn-7477.exe
3832	Unicorn-10772.exe
4340	Unicorn-51805.exe
2616	Unicorn-32942.exe
3148	Unicorn-2499.exe
2404	Unicorn-8821.exe
4720	Unicorn-33518.exe
4168	Unicorn-17182.exe
2956	Unicorn-39772.exe
1732	Unicorn-48702.exe
5020	Unicorn-48702.exe
4012	Unicorn-15838.exe
3608	Unicorn-50932.exe
4640	Unicorn-37196.exe
3132	Unicorn-57062.exe
2436	Unicorn-23321.exe
1672	Unicorn-26235.exe
4484	Unicorn-7861.exe
1620	Unicorn-7861.exe
1092	Unicorn-3647.exe
4240	Unicorn-23248.exe
1800	Unicorn-10091.exe
4696	Unicorn-56293.exe
4812	Unicorn-61893.exe
3596	Unicorn-33902.exe
736	Unicorn-3267.exe
2200	Unicorn-49745.exe
1840	Unicorn-41884.exe
2176	Unicorn-27270.exe
2948	Unicorn-15764.exe
3692	Unicorn-35630.exe
3820	Unicorn-51281.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6224	548	WerFault.exe	178

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61155.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49417.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57650.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7033.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-663.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21209.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8721.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61674.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44537.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13680.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44419.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55530.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33610.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47139.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38233.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8441.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62957.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6370.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17472.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29769.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61090.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38644.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25551.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62101.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31944.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37961.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45236.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9281.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53038.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8986.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16993.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9977.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27270.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	8788	dwm.exe
Token: SeChangeNotifyPrivilege	8788	dwm.exe
Token: 33	8788	dwm.exe
Token: SeIncBasePriorityPrivilege	8788	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3168	48c304504bc8319759da0097b2c670b695597a19050fa6d40fbf8c53e8454ab0N.exe
3000	Unicorn-16670.exe
4976	Unicorn-32246.exe
1792	Unicorn-61773.exe
1772	Unicorn-49646.exe
4932	Unicorn-13444.exe
648	Unicorn-33310.exe
4108	Unicorn-60703.exe
916	Unicorn-60798.exe
1280	Unicorn-44270.exe
4452	Unicorn-27750.exe
232	Unicorn-58385.exe
4160	Unicorn-42926.exe
2456	Unicorn-58312.exe
220	Unicorn-38519.exe
4252	Unicorn-14015.exe
4236	Unicorn-53393.exe
1124	Unicorn-62630.exe
1604	Unicorn-33719.exe
4604	Unicorn-53585.exe
3788	Unicorn-33444.exe
3188	Unicorn-53320.exe
3600	Unicorn-53310.exe
4408	Unicorn-12277.exe
4616	Unicorn-30843.exe
4972	Unicorn-33444.exe
3632	Unicorn-61670.exe
3756	Unicorn-20446.exe
4612	Unicorn-28043.exe
1924	Unicorn-580.exe
4428	Unicorn-12479.exe
2780	Unicorn-41317.exe
456	Unicorn-22937.exe
2468	Unicorn-7477.exe
3832	Unicorn-10772.exe
4340	Unicorn-51805.exe
2616	Unicorn-32942.exe
3148	Unicorn-2499.exe
2404	Unicorn-8821.exe
4720	Unicorn-33518.exe
4168	Unicorn-17182.exe
2956	Unicorn-39772.exe
1732	Unicorn-48702.exe
5020	Unicorn-48702.exe
4012	Unicorn-15838.exe
1092	Unicorn-3647.exe
1800	Unicorn-10091.exe
3132	Unicorn-57062.exe
4640	Unicorn-37196.exe
1672	Unicorn-26235.exe
2436	Unicorn-23321.exe
3608	Unicorn-50932.exe
1620	Unicorn-7861.exe
4484	Unicorn-7861.exe
4812	Unicorn-61893.exe
4696	Unicorn-56293.exe
4240	Unicorn-23248.exe
736	Unicorn-3267.exe
3596	Unicorn-33902.exe
2200	Unicorn-49745.exe
1840	Unicorn-41884.exe
2176	Unicorn-27270.exe
2948	Unicorn-15764.exe
3692	Unicorn-35630.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 3000	3168	48c304504bc8319759da0097b2c670b695597a19050fa6d40fbf8c53e8454ab0N.exe	86
PID 3168 wrote to memory of 3000	3168	48c304504bc8319759da0097b2c670b695597a19050fa6d40fbf8c53e8454ab0N.exe	86
PID 3168 wrote to memory of 3000	3168	48c304504bc8319759da0097b2c670b695597a19050fa6d40fbf8c53e8454ab0N.exe	86
PID 3000 wrote to memory of 4976	3000	Unicorn-16670.exe	87
PID 3000 wrote to memory of 4976	3000	Unicorn-16670.exe	87
PID 3000 wrote to memory of 4976	3000	Unicorn-16670.exe	87
PID 3168 wrote to memory of 1792	3168	48c304504bc8319759da0097b2c670b695597a19050fa6d40fbf8c53e8454ab0N.exe	88
PID 3168 wrote to memory of 1792	3168	48c304504bc8319759da0097b2c670b695597a19050fa6d40fbf8c53e8454ab0N.exe	88
PID 3168 wrote to memory of 1792	3168	48c304504bc8319759da0097b2c670b695597a19050fa6d40fbf8c53e8454ab0N.exe	88
PID 4976 wrote to memory of 1772	4976	Unicorn-32246.exe	89
PID 4976 wrote to memory of 1772	4976	Unicorn-32246.exe	89
PID 4976 wrote to memory of 1772	4976	Unicorn-32246.exe	89
PID 3000 wrote to memory of 4932	3000	Unicorn-16670.exe	90
PID 3000 wrote to memory of 4932	3000	Unicorn-16670.exe	90
PID 3000 wrote to memory of 4932	3000	Unicorn-16670.exe	90
PID 1792 wrote to memory of 648	1792	Unicorn-61773.exe	91
PID 1792 wrote to memory of 648	1792	Unicorn-61773.exe	91
PID 1792 wrote to memory of 648	1792	Unicorn-61773.exe	91
PID 3168 wrote to memory of 4108	3168	48c304504bc8319759da0097b2c670b695597a19050fa6d40fbf8c53e8454ab0N.exe	92
PID 3168 wrote to memory of 4108	3168	48c304504bc8319759da0097b2c670b695597a19050fa6d40fbf8c53e8454ab0N.exe	92
PID 3168 wrote to memory of 4108	3168	48c304504bc8319759da0097b2c670b695597a19050fa6d40fbf8c53e8454ab0N.exe	92
PID 1772 wrote to memory of 916	1772	Unicorn-49646.exe	93
PID 1772 wrote to memory of 916	1772	Unicorn-49646.exe	93
PID 1772 wrote to memory of 916	1772	Unicorn-49646.exe	93
PID 4932 wrote to memory of 1280	4932	Unicorn-13444.exe	94
PID 4932 wrote to memory of 1280	4932	Unicorn-13444.exe	94
PID 4932 wrote to memory of 1280	4932	Unicorn-13444.exe	94
PID 4976 wrote to memory of 220	4976	Unicorn-32246.exe	95
PID 4976 wrote to memory of 220	4976	Unicorn-32246.exe	95
PID 4976 wrote to memory of 220	4976	Unicorn-32246.exe	95
PID 648 wrote to memory of 232	648	Unicorn-33310.exe	96
PID 648 wrote to memory of 232	648	Unicorn-33310.exe	96
PID 648 wrote to memory of 232	648	Unicorn-33310.exe	96
PID 1792 wrote to memory of 4252	1792	Unicorn-61773.exe	97
PID 1792 wrote to memory of 4252	1792	Unicorn-61773.exe	97
PID 1792 wrote to memory of 4252	1792	Unicorn-61773.exe	97
PID 3000 wrote to memory of 4452	3000	Unicorn-16670.exe	98
PID 3000 wrote to memory of 4452	3000	Unicorn-16670.exe	98
PID 3000 wrote to memory of 4452	3000	Unicorn-16670.exe	98
PID 4108 wrote to memory of 4160	4108	Unicorn-60703.exe	99
PID 4108 wrote to memory of 4160	4108	Unicorn-60703.exe	99
PID 4108 wrote to memory of 4160	4108	Unicorn-60703.exe	99
PID 3168 wrote to memory of 2456	3168	48c304504bc8319759da0097b2c670b695597a19050fa6d40fbf8c53e8454ab0N.exe	100
PID 3168 wrote to memory of 2456	3168	48c304504bc8319759da0097b2c670b695597a19050fa6d40fbf8c53e8454ab0N.exe	100
PID 3168 wrote to memory of 2456	3168	48c304504bc8319759da0097b2c670b695597a19050fa6d40fbf8c53e8454ab0N.exe	100
PID 232 wrote to memory of 4236	232	Unicorn-58385.exe	101
PID 232 wrote to memory of 4236	232	Unicorn-58385.exe	101
PID 232 wrote to memory of 4236	232	Unicorn-58385.exe	101
PID 4452 wrote to memory of 1124	4452	Unicorn-27750.exe	102
PID 4452 wrote to memory of 1124	4452	Unicorn-27750.exe	102
PID 4452 wrote to memory of 1124	4452	Unicorn-27750.exe	102
PID 648 wrote to memory of 1604	648	Unicorn-33310.exe	103
PID 648 wrote to memory of 1604	648	Unicorn-33310.exe	103
PID 648 wrote to memory of 1604	648	Unicorn-33310.exe	103
PID 3000 wrote to memory of 3188	3000	Unicorn-16670.exe	104
PID 3000 wrote to memory of 3188	3000	Unicorn-16670.exe	104
PID 3000 wrote to memory of 3188	3000	Unicorn-16670.exe	104
PID 1280 wrote to memory of 4604	1280	Unicorn-44270.exe	105
PID 1280 wrote to memory of 4604	1280	Unicorn-44270.exe	105
PID 1280 wrote to memory of 4604	1280	Unicorn-44270.exe	105
PID 4932 wrote to memory of 4972	4932	Unicorn-13444.exe	106
PID 4108 wrote to memory of 3788	4108	Unicorn-60703.exe	107
PID 4932 wrote to memory of 4972	4932	Unicorn-13444.exe	106
PID 4108 wrote to memory of 3788	4108	Unicorn-60703.exe	107

C:\Users\Admin\AppData\Local\Temp\48c304504bc8319759da0097b2c670b695597a19050fa6d40fbf8c53e8454ab0N.exe
"C:\Users\Admin\AppData\Local\Temp\48c304504bc8319759da0097b2c670b695597a19050fa6d40fbf8c53e8454ab0N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16670.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16670.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32246.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32246.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60798.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53310.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48702.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26414.exe
        8⤵
        
        PID:1004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21614.exe
        9⤵
        
        PID:1512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16931.exe
        10⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49936.exe
        11⤵
        
        PID:13608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51802.exe
        11⤵
        
        PID:16888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59267.exe
        11⤵
        
        PID:16284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63407.exe
        10⤵
        
        PID:9784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28040.exe
        10⤵
        
        PID:13572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48455.exe
        10⤵
        
        PID:15716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47995.exe
        10⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46754.exe
        9⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5447.exe
        10⤵
        
        PID:10424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        10⤵
        
        PID:15424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33610.exe
        10⤵
        
        PID:9632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21392.exe
        9⤵
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9977.exe
        9⤵
        
        PID:14740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1637.exe
        9⤵
        
        PID:1976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5004.exe
        9⤵
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18764.exe
        8⤵
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30491.exe
        9⤵
        
        PID:9212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46864.exe
        10⤵
        
        PID:13140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        10⤵
        
        PID:16876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27361.exe
        9⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21328.exe
        9⤵
        
        PID:15576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5931.exe
        9⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2160.exe
        8⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61674.exe
        8⤵
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44673.exe
        8⤵
        
        PID:17220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1151.exe
        7⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17006.exe
        8⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34627.exe
        9⤵
        
        PID:4820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47663.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36954.exe
        9⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61658.exe
        8⤵
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44574.exe
        8⤵
        
        PID:13076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54874.exe
        8⤵
        
        PID:16764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53369.exe
        7⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46755.exe
        8⤵
        
        PID:12852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44298.exe
        8⤵
        
        PID:15896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23714.exe
        8⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6889.exe
        7⤵
        
        PID:10088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56569.exe
        7⤵
        
        PID:13824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63410.exe
        7⤵
        
        PID:3588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43551.exe
        7⤵
        
        PID:17992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
        6⤵
        
        PID:4292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        7⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30491.exe
        8⤵
        
        PID:9180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58683.exe
        9⤵
        
        PID:15224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56810.exe
        9⤵
        
        PID:16800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
        8⤵
        
        PID:12180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21328.exe
        8⤵
        
        PID:15612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30820.exe
        8⤵
        
        PID:15396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54538.exe
        7⤵
        
        PID:8624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-277.exe
        7⤵
        
        PID:12592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20753.exe
        7⤵
        
        PID:16300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23519.exe
        7⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65365.exe
        6⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62416.exe
        7⤵
        
        PID:10640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9024.exe
        7⤵
        
        PID:16580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13304.exe
        6⤵
        
        PID:9060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63666.exe
        6⤵
        
        PID:12320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12146.exe
        6⤵
        
        PID:17136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17182.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10845.exe
        7⤵
        
        PID:2524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65054.exe
        8⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30491.exe
        9⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
        9⤵
        
        PID:12196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15080.exe
        9⤵
        
        PID:15668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21962.exe
        9⤵
        
        PID:14884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9769.exe
        8⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43422.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45170.exe
        8⤵
        
        PID:17192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38481.exe
        7⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59515.exe
        8⤵
        
        PID:10016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61970.exe
        8⤵
        
        PID:13752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17208.exe
        8⤵
        
        PID:16336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36954.exe
        8⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20328.exe
        7⤵
        
        PID:880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1726.exe
        7⤵
        
        PID:13052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65082.exe
        7⤵
        
        PID:816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64768.exe
        6⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61227.exe
        7⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64803.exe
        8⤵
        
        PID:9228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19489.exe
        8⤵
        
        PID:13000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37961.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63788.exe
        8⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39649.exe
        7⤵
        
        PID:9420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36894.exe
        7⤵
        
        PID:12668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31083.exe
        7⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20032.exe
        6⤵
        
        PID:7676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36578.exe
        6⤵
        
        PID:9712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42073.exe
        6⤵
        
        PID:15296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26235.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28718.exe
        6⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8920.exe
        7⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61155.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14801.exe
        8⤵
        
        PID:15216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7659.exe
        8⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20625.exe
        7⤵
        
        PID:9444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43505.exe
        7⤵
        
        PID:13316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44402.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44537.exe
        6⤵
        
        PID:7856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38681.exe
        6⤵
        
        PID:11556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58978.exe
        6⤵
        
        PID:15404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37101.exe
        6⤵
        
        PID:1420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54493.exe
        5⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36251.exe
        6⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33417.exe
        6⤵
        
        PID:12088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7488.exe
        6⤵
        
        PID:16148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47452.exe
        6⤵
        
        PID:8664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3693.exe
        5⤵
        
        PID:8020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11377.exe
        5⤵
        
        PID:10768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42603.exe
        5⤵
        
        PID:15148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52120.exe
        5⤵
        
        PID:17112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5440.exe
        5⤵
        
        PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38519.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38519.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12277.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23321.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43217.exe
        7⤵
        
        PID:4892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6808.exe
        8⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11409.exe
        9⤵
        
        PID:11596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45833.exe
        9⤵
        
        PID:15868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6507.exe
        9⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51377.exe
        8⤵
        
        PID:10216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8249.exe
        8⤵
        
        PID:14076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63609.exe
        8⤵
        
        PID:16920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24241.exe
        8⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44537.exe
        7⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38681.exe
        7⤵
        
        PID:11508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58978.exe
        7⤵
        
        PID:15388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30661.exe
        7⤵
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34892.exe
        6⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28083.exe
        7⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16477.exe
        8⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8721.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48521.exe
        7⤵
        
        PID:15816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7659.exe
        7⤵
        
        PID:7480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62793.exe
        6⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-946.exe
        7⤵
        
        PID:16924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39371.exe
        7⤵
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38681.exe
        6⤵
        
        PID:11540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58978.exe
        6⤵
        
        PID:15412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9702.exe
        5⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36113.exe
        6⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19443.exe
        7⤵
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12103.exe
        8⤵
        
        PID:4076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36299.exe
        8⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60802.exe
        7⤵
        
        PID:11704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45833.exe
        7⤵
        
        PID:15684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45236.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52130.exe
        6⤵
        
        PID:8284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63489.exe
        6⤵
        
        PID:11972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61703.exe
        6⤵
        
        PID:15100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62803.exe
        6⤵
        
        PID:7152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14908.exe
        5⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6287.exe
        6⤵
        
        PID:7304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50543.exe
        6⤵
        
        PID:11740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14421.exe
        6⤵
        
        PID:15588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32740.exe
        6⤵
        
        PID:760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40585.exe
        5⤵
        
        PID:8536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35513.exe
        5⤵
        
        PID:12568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12618.exe
        5⤵
        
        PID:16272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9618.exe
        5⤵
        
        PID:9668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30843.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15838.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41681.exe
        6⤵
        
        PID:1992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15365.exe
        7⤵
        
        PID:516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49899.exe
        8⤵
        
        PID:9160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3729.exe
        8⤵
        
        PID:12408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14416.exe
        8⤵
        
        PID:17120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55415.exe
        7⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54849.exe
        7⤵
        
        PID:12600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20753.exe
        7⤵
        
        PID:16288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55507.exe
        7⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62101.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32795.exe
        7⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48189.exe
        8⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52930.exe
        7⤵
        
        PID:12528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14416.exe
        7⤵
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58206.exe
        6⤵
        
        PID:9128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23330.exe
        6⤵
        
        PID:11872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11616.exe
        6⤵
        
        PID:17128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61940.exe
        6⤵
        
        PID:8048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1151.exe
        5⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58082.exe
        6⤵
        
        PID:7940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43593.exe
        6⤵
        
        PID:10444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44295.exe
        6⤵
        
        PID:14512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48905.exe
        6⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6088.exe
        5⤵
        
        PID:7820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35899.exe
        6⤵
        
        PID:9016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        6⤵
        
        PID:16368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24954.exe
        6⤵
        
        PID:448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9577.exe
        5⤵
        
        PID:10328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35437.exe
        5⤵
        
        PID:14412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43530.exe
        5⤵
        
        PID:8712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23248.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52262.exe
        5⤵
        
        PID:3104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31657.exe
        6⤵
        
        PID:7396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35899.exe
        7⤵
        
        PID:12224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        7⤵
        
        PID:376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-663.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10837.exe
        6⤵
        
        PID:10144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8249.exe
        6⤵
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48905.exe
        6⤵
        
        PID:17088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24049.exe
        6⤵
        
        PID:7440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44537.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8519.exe
        6⤵
        
        PID:12796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24225.exe
        6⤵
        
        PID:15728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28410.exe
        5⤵
        
        PID:9728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55226.exe
        5⤵
        
        PID:16524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10166.exe
      4⤵
      PID:5180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61227.exe
        5⤵
        
        PID:7900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5447.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        6⤵
        
        PID:16380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
        6⤵
        
        PID:8764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63599.exe
        5⤵
        
        PID:10416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38430.exe
        5⤵
        
        PID:14496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6737.exe
        5⤵
        
        PID:17092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12251.exe
        5⤵
        
        PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-697.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-697.exe
      4⤵
      PID:7668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47632.exe
        5⤵
        
        PID:12824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44298.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28443.exe
      4⤵
      PID:1196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21072.exe
      4⤵
      PID:15076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46785.exe
      4⤵
      PID:15796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64596.exe
      4⤵
      PID:7752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13444.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13444.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44270.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53585.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48702.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53414.exe
        7⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1289.exe
        8⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1906.exe
        9⤵
        
        PID:4316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54556.exe
        9⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1600.exe
        8⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8249.exe
        8⤵
        
        PID:14044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48905.exe
        8⤵
        
        PID:1588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65274.exe
        8⤵
        
        PID:9620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55010.exe
        7⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11605.exe
        7⤵
        
        PID:9876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17381.exe
        7⤵
        
        PID:12632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1609.exe
        7⤵
        
        PID:15432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7033.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1151.exe
        6⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33843.exe
        7⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61954.exe
        7⤵
        
        PID:4848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36894.exe
        7⤵
        
        PID:12608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13512.exe
        7⤵
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28584.exe
        6⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35899.exe
        7⤵
        
        PID:12116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        7⤵
        
        PID:16360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27471.exe
        7⤵
        
        PID:7484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59079.exe
        6⤵
        
        PID:10516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59449.exe
        6⤵
        
        PID:14576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41802.exe
        6⤵
        
        PID:7376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37196.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19289.exe
        6⤵
        
        PID:2084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31998.exe
        7⤵
        
        PID:6356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36475.exe
        8⤵
        
        PID:12512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1153.exe
        8⤵
        
        PID:16308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe
        8⤵
        
        PID:17528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17937.exe
        7⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55530.exe
        7⤵
        
        PID:14192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30386.exe
        7⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63178.exe
        6⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52254.exe
        6⤵
        
        PID:9452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42759.exe
        6⤵
        
        PID:12648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39317.exe
        6⤵
        
        PID:848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22587.exe
        5⤵
        
        PID:4888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15854.exe
        6⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59323.exe
        7⤵
        
        PID:9324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28048.exe
        7⤵
        
        PID:15260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-785.exe
        7⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51377.exe
        6⤵
        
        PID:9716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2110.exe
        6⤵
        
        PID:13440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe
        6⤵
        
        PID:3988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24241.exe
        6⤵
        
        PID:7776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18310.exe
        5⤵
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13426.exe
        6⤵
        
        PID:15756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27363.exe
        6⤵
        
        PID:7596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8805.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8705.exe
        5⤵
        
        PID:13584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48008.exe
        5⤵
        
        PID:8068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33444.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57062.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28910.exe
        6⤵
        
        PID:548
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 484
        7⤵
        Program crash
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14958.exe
        6⤵
        
        PID:7328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21392.exe
        6⤵
        
        PID:10696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9977.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37973.exe
        6⤵
        
        PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34892.exe
        5⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe
        6⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34627.exe
        7⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28048.exe
        7⤵
        
        PID:15276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34460.exe
        7⤵
        
        PID:8
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4398.exe
        6⤵
        
        PID:9652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35721.exe
        6⤵
        
        PID:13468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5865.exe
        6⤵
        
        PID:2960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55803.exe
        6⤵
        
        PID:16616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32651.exe
        6⤵
        
        PID:5712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24570.exe
        5⤵
        
        PID:9940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33133.exe
        5⤵
        
        PID:13696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28071.exe
        5⤵
        
        PID:924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10091.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12189.exe
        5⤵
        
        PID:748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7301.exe
        6⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61539.exe
        7⤵
        
        PID:10176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9024.exe
        7⤵
        
        PID:16680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23908.exe
        7⤵
        
        PID:17516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26680.exe
        6⤵
        
        PID:9740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33906.exe
        6⤵
        
        PID:13616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe
        6⤵
        
        PID:3100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39509.exe
        6⤵
        
        PID:9588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63178.exe
        5⤵
        
        PID:224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10153.exe
        5⤵
        
        PID:10748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58030.exe
        5⤵
        
        PID:14812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9898.exe
        5⤵
        
        PID:6892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44680.exe
      4⤵
      PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36168.exe
        5⤵
        
        PID:7276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7465.exe
        5⤵
        
        PID:10616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52937.exe
        5⤵
        
        PID:15356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4282.exe
        5⤵
        
        PID:16160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62105.exe
      4⤵
      PID:7036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3121.exe
      4⤵
      PID:12120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53568.exe
      4⤵
      PID:12500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41610.exe
      4⤵
      PID:3432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27750.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27750.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62630.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62630.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7477.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51281.exe
        6⤵
        Executes dropped EXE
        
        PID:3820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44945.exe
        7⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61227.exe
        8⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63874.exe
        8⤵
        
        PID:10380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63489.exe
        8⤵
        
        PID:11944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61703.exe
        8⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31424.exe
        8⤵
        
        PID:17244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32536.exe
        8⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51170.exe
        7⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22456.exe
        7⤵
        
        PID:12016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20094.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38787.exe
        7⤵
        
        PID:16324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56320.exe
        6⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36168.exe
        7⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56666.exe
        7⤵
        
        PID:10644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36977.exe
        7⤵
        
        PID:14700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10302.exe
        7⤵
        
        PID:17320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53476.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6192.exe
        6⤵
        
        PID:7920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28322.exe
        6⤵
        
        PID:11920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53038.exe
        6⤵
        
        PID:15164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12251.exe
        6⤵
        
        PID:5720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65157.exe
        5⤵
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52641.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38467.exe
        7⤵
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51674.exe
        7⤵
        
        PID:11564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21328.exe
        7⤵
        
        PID:15564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17472.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61559.exe
        6⤵
        
        PID:8448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6312.exe
        6⤵
        
        PID:12152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61703.exe
        6⤵
        
        PID:15156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32280.exe
        6⤵
        
        PID:816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11592.exe
        6⤵
        
        PID:8412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6075.exe
        5⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65083.exe
        6⤵
        
        PID:8668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59562.exe
        6⤵
        
        PID:12884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5865.exe
        6⤵
        
        PID:16332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1637.exe
        6⤵
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37973.exe
        6⤵
        
        PID:4232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9478.exe
        5⤵
        
        PID:8444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52049.exe
        5⤵
        
        PID:12536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61090.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65082.exe
        5⤵
        
        PID:8036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51805.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27654.exe
        5⤵
        
        PID:636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10565.exe
        6⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16931.exe
        7⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48311.exe
        7⤵
        
        PID:9528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27007.exe
        7⤵
        
        PID:15304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35456.exe
        7⤵
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33385.exe
        6⤵
        
        PID:8000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19947.exe
        7⤵
        
        PID:12636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1153.exe
        7⤵
        
        PID:16280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58307.exe
        7⤵
        
        PID:18140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27064.exe
        6⤵
        
        PID:10464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2193.exe
        6⤵
        
        PID:14524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7873.exe
        6⤵
        
        PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60845.exe
        5⤵
        
        PID:5952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5602.exe
        6⤵
        
        PID:9064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37366.exe
        6⤵
        
        PID:11760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45833.exe
        6⤵
        
        PID:15856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6315.exe
        6⤵
        
        PID:17400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25234.exe
        5⤵
        
        PID:9892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29952.exe
        5⤵
        
        PID:13772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46201.exe
        5⤵
        
        PID:17088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8114.exe
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41610.exe
        5⤵
        
        PID:4044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34590.exe
      4⤵
      PID:2904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60352.exe
        5⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31944.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41689.exe
        6⤵
        
        PID:12064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15765.exe
        6⤵
        
        PID:15864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39476.exe
        6⤵
        
        PID:9624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57801.exe
        5⤵
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20449.exe
        5⤵
        
        PID:11472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53121.exe
        5⤵
        
        PID:16344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4379.exe
        5⤵
        
        PID:9196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13948.exe
      4⤵
      PID:5636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36168.exe
        5⤵
        
        PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21880.exe
        5⤵
        
        PID:11632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25658.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47235.exe
        5⤵
        
        PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31845.exe
      4⤵
      PID:8552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19755.exe
        5⤵
        
        PID:12448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        5⤵
        
        PID:16200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
        5⤵
        
        PID:9584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31766.exe
      4⤵
      PID:11644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43563.exe
      4⤵
      PID:15980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57282.exe
      4⤵
      PID:6292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53320.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53320.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8821.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51494.exe
        5⤵
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18158.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32219.exe
        7⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26806.exe
        7⤵
        
        PID:13036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24016.exe
        7⤵
        
        PID:16864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26680.exe
        6⤵
        
        PID:9732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33906.exe
        6⤵
        
        PID:14464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48533.exe
        6⤵
        
        PID:5780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1014.exe
        5⤵
        
        PID:7268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54629.exe
        6⤵
        
        PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18704.exe
        5⤵
        
        PID:9956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41799.exe
        5⤵
        
        PID:13732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22876.exe
        5⤵
        
        PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56325.exe
      4⤵
      PID:1164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13253.exe
        5⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63163.exe
        6⤵
        
        PID:9096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51674.exe
        6⤵
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21328.exe
        6⤵
        
        PID:15604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56668.exe
        6⤵
        
        PID:6784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9281.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41097.exe
        5⤵
        
        PID:1344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27194.exe
        5⤵
        
        PID:15556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24074.exe
        5⤵
        
        PID:8484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-787.exe
      4⤵
      PID:2232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32219.exe
        5⤵
        
        PID:8860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26806.exe
        5⤵
        
        PID:13044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33528.exe
        5⤵
        
        PID:16808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33599.exe
      4⤵
      PID:8900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13404.exe
        5⤵
        
        PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53009.exe
      4⤵
      PID:13080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55226.exe
      4⤵
      PID:16540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39772.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39772.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11037.exe
      4⤵
      PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13253.exe
        5⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21456.exe
        6⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13352.exe
        7⤵
        
        PID:8116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40438.exe
        6⤵
        
        PID:10360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38430.exe
        6⤵
        
        PID:14480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7923.exe
        6⤵
        
        PID:1068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59447.exe
        5⤵
        
        PID:8264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22456.exe
        5⤵
        
        PID:12208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61127.exe
        5⤵
        
        PID:15696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-146.exe
        5⤵
        
        PID:8392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59413.exe
      4⤵
      PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38851.exe
        5⤵
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25545.exe
        5⤵
        
        PID:12148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57841.exe
        5⤵
        
        PID:16496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27733.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61674.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6224.exe
      4⤵
      PID:16556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59168.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59168.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44139.exe
      4⤵
      PID:8940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60802.exe
      4⤵
      PID:11752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54001.exe
      4⤵
      PID:15540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30628.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17762.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17762.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6912.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6912.exe
    3⤵
    PID:9220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49670.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49670.exe
    3⤵
    PID:4896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15011.exe
    3⤵
    PID:5660
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61773.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61773.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1792
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33310.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33310.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58385.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53393.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22937.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27270.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21209.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17198.exe
        9⤵
        
        PID:6800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8986.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:13552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22642.exe
        10⤵
        
        PID:15640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4206.exe
        9⤵
        
        PID:9572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44766.exe
        9⤵
        
        PID:13432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24241.exe
        9⤵
        
        PID:4352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56162.exe
        8⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39829.exe
        9⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9384.exe
        8⤵
        
        PID:10112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16225.exe
        8⤵
        
        PID:13912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64677.exe
        8⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1452.exe
        7⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41544.exe
        8⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45712.exe
        9⤵
        
        PID:12700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44106.exe
        9⤵
        
        PID:15772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
        9⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49655.exe
        8⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1808.exe
        8⤵
        
        PID:14120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54353.exe
        8⤵
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5704.exe
        7⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46755.exe
        8⤵
        
        PID:12860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44298.exe
        8⤵
        
        PID:15936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18814.exe
        7⤵
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65313.exe
        7⤵
        
        PID:14272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10967.exe
        7⤵
        
        PID:5956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15764.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4789.exe
        7⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6370.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24393.exe
        8⤵
        
        PID:12296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55921.exe
        8⤵
        
        PID:16216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46108.exe
        8⤵
        
        PID:16232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51170.exe
        7⤵
        
        PID:264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22456.exe
        7⤵
        
        PID:12184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63431.exe
        7⤵
        
        PID:15848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62803.exe
        7⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6355.exe
        6⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61227.exe
        7⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63874.exe
        7⤵
        
        PID:10388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63489.exe
        7⤵
        
        PID:11956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61703.exe
        7⤵
        
        PID:15232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31424.exe
        7⤵
        
        PID:17176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13507.exe
        7⤵
        
        PID:9092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13510.exe
        6⤵
        
        PID:8252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19656.exe
        6⤵
        
        PID:12216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36502.exe
        6⤵
        
        PID:920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31763.exe
        6⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51698.exe
        6⤵
        
        PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10772.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35630.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10072.exe
        7⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56886.exe
        8⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
        9⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52655.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58033.exe
        9⤵
        
        PID:15964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45322.exe
        8⤵
        
        PID:9344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8720.exe
        8⤵
        
        PID:12984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44402.exe
        8⤵
        
        PID:16520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13977.exe
        7⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27834.exe
        7⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34184.exe
        7⤵
        
        PID:13956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33721.exe
        7⤵
        
        PID:17312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57005.exe
        6⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58998.exe
        7⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13890.exe
        8⤵
        
        PID:12992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44298.exe
        8⤵
        
        PID:15888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12457.exe
        7⤵
        
        PID:9460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16993.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41325.exe
        7⤵
        
        PID:8496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29824.exe
        6⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31277.exe
        7⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49266.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32064.exe
        6⤵
        
        PID:13656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27002.exe
        6⤵
        
        PID:7388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13355.exe
        5⤵
        
        PID:3492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17399.exe
        6⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36251.exe
        7⤵
        
        PID:548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59074.exe
        7⤵
        
        PID:12076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12968.exe
        7⤵
        
        PID:15652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17472.exe
        7⤵
        
        PID:7232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22741.exe
        6⤵
        
        PID:8908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56967.exe
        6⤵
        
        PID:11628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43033.exe
        6⤵
        
        PID:16004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14467.exe
        6⤵
        
        PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45469.exe
        5⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28291.exe
        6⤵
        
        PID:10284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9024.exe
        6⤵
        
        PID:16532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46729.exe
        5⤵
        
        PID:8456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52514.exe
        5⤵
        
        PID:12160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53568.exe
        5⤵
        
        PID:13720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37339.exe
        5⤵
        
        PID:9296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33719.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33719.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32942.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41982.exe
        6⤵
        
        PID:4764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21038.exe
        7⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17198.exe
        8⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61155.exe
        9⤵
        
        PID:10304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14801.exe
        9⤵
        
        PID:14340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31394.exe
        9⤵
        
        PID:15112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27640.exe
        8⤵
        
        PID:10568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57650.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8039.exe
        8⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30313.exe
        7⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61553.exe
        7⤵
        
        PID:9400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1726.exe
        7⤵
        
        PID:12692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7692.exe
        7⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49709.exe
        6⤵
        
        PID:5416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37995.exe
        7⤵
        
        PID:8956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55995.exe
        8⤵
        
        PID:15840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59946.exe
        7⤵
        
        PID:12680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22776.exe
        7⤵
        
        PID:17252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3613.exe
        6⤵
        
        PID:8388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60714.exe
        6⤵
        
        PID:12576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12088.exe
        6⤵
        
        PID:16256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5915.exe
        6⤵
        
        PID:8952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62957.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43430.exe
        6⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35971.exe
        7⤵
        
        PID:8992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1320.exe
        7⤵
        
        PID:12560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20281.exe
        7⤵
        
        PID:17144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50210.exe
        6⤵
        
        PID:8232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22456.exe
        6⤵
        
        PID:12200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20561.exe
        6⤵
        
        PID:15400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57427.exe
        6⤵
        
        PID:17436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38644.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31923.exe
        6⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44451.exe
        7⤵
        
        PID:12460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        7⤵
        
        PID:16164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25250.exe
        7⤵
        
        PID:9148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39073.exe
        6⤵
        
        PID:7392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26706.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20611.exe
        6⤵
        
        PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45695.exe
        5⤵
        
        PID:7808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-912.exe
        5⤵
        
        PID:10320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18902.exe
        5⤵
        
        PID:14392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45704.exe
        5⤵
        
        PID:6152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2499.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9309.exe
        5⤵
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61878.exe
        6⤵
        
        PID:3560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50563.exe
        7⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39073.exe
        7⤵
        
        PID:9924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35934.exe
        7⤵
        
        PID:13676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23074.exe
        7⤵
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47139.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14849.exe
        6⤵
        
        PID:8152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53214.exe
        6⤵
        
        PID:10524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2577.exe
        6⤵
        
        PID:14592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34226.exe
        6⤵
        
        PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59884.exe
        5⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64144.exe
        6⤵
        
        PID:7492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19297.exe
        6⤵
        
        PID:12760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37961.exe
        6⤵
        
        PID:17376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65114.exe
        5⤵
        
        PID:9516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41774.exe
        5⤵
        
        PID:13056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19201.exe
        5⤵
        
        PID:16128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29997.exe
        5⤵
        
        PID:1040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50269.exe
      4⤵
      PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12485.exe
        5⤵
        
        PID:6056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31923.exe
        6⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8602.exe
        7⤵
        
        PID:13444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51802.exe
        7⤵
        
        PID:17216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39073.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34402.exe
        6⤵
        
        PID:15244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59923.exe
        6⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24833.exe
        5⤵
        
        PID:7768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45712.exe
        6⤵
        
        PID:12504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1153.exe
        6⤵
        
        PID:16076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15546.exe
        6⤵
        
        PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11880.exe
        5⤵
        
        PID:10288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44103.exe
        5⤵
        
        PID:14400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65082.exe
        5⤵
        
        PID:9040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6243.exe
      4⤵
      PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27419.exe
        5⤵
        
        PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35929.exe
        5⤵
        
        PID:14152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64744.exe
        5⤵
        
        PID:9276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49814.exe
      4⤵
      PID:8356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52579.exe
      4⤵
      PID:12616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56624.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56624.exe
      4⤵
      PID:15628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63105.exe
      4⤵
      PID:5840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14015.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14015.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61670.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7861.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32775.exe
        6⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10319.exe
        7⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35638.exe
        7⤵
        
        PID:11864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48521.exe
        7⤵
        
        PID:15780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7659.exe
        7⤵
        
        PID:7732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9757.exe
        6⤵
        
        PID:8436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20523.exe
        7⤵
        
        PID:12048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2030.exe
        7⤵
        
        PID:15768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41779.exe
        7⤵
        
        PID:9548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12177.exe
        6⤵
        
        PID:12136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53038.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7609.exe
        6⤵
        
        PID:2280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1151.exe
        5⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36168.exe
        6⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21880.exe
        6⤵
        
        PID:11648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19793.exe
        6⤵
        
        PID:14632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38299.exe
        6⤵
        
        PID:2776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60978.exe
        5⤵
        
        PID:8600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48302.exe
        5⤵
        
        PID:11624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26497.exe
        5⤵
        
        PID:16056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22980.exe
        5⤵
        
        PID:9052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61893.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53414.exe
        5⤵
        
        PID:1212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9413.exe
        6⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61155.exe
        7⤵
        
        PID:9772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9024.exe
        7⤵
        
        PID:16672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62636.exe
        7⤵
        
        PID:7608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51377.exe
        6⤵
        
        PID:9596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
        6⤵
        
        PID:12720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21148.exe
        6⤵
        
        PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44537.exe
        5⤵
        
        PID:7580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28026.exe
        5⤵
        
        PID:10564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34184.exe
        5⤵
        
        PID:13600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64101.exe
        5⤵
        
        PID:4508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38540.exe
      4⤵
      PID:5128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6808.exe
        5⤵
        
        PID:6436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28779.exe
        6⤵
        
        PID:12040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18065.exe
        6⤵
        
        PID:15720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34224.exe
        6⤵
        
        PID:13592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62828.exe
        6⤵
        
        PID:8348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45322.exe
        5⤵
        
        PID:9352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8720.exe
        5⤵
        
        PID:13356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20857.exe
        5⤵
        
        PID:16900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58082.exe
      4⤵
      PID:6196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60194.exe
      4⤵
      PID:9852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26267.exe
      4⤵
      PID:14444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16146.exe
      4⤵
      PID:5400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41317.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41317.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49745.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18713.exe
        5⤵
        
        PID:1592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32382.exe
        6⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6023.exe
        7⤵
        
        PID:13180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25569.exe
        7⤵
        
        PID:17200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46282.exe
        6⤵
        
        PID:10044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26504.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55780.exe
        6⤵
        
        PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44537.exe
        5⤵
        
        PID:7568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21310.exe
        5⤵
        
        PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25736.exe
        5⤵
        
        PID:14004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17857.exe
        5⤵
        
        PID:7944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1260.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1260.exe
      4⤵
      PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43267.exe
        5⤵
        
        PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7657.exe
        5⤵
        
        PID:10680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4112.exe
        5⤵
        
        PID:14724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10302.exe
        5⤵
        
        PID:17400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62035.exe
        5⤵
        
        PID:17088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8605.exe
      4⤵
      PID:7224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28322.exe
      4⤵
      PID:12004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53038.exe
      4⤵
      PID:15112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31225.exe
      4⤵
      PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65082.exe
      4⤵
      PID:8128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41884.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41884.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11421.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11421.exe
      4⤵
      PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34494.exe
        5⤵
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45898.exe
        6⤵
        
        PID:9976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24557.exe
        7⤵
        
        PID:17540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26312.exe
        6⤵
        
        PID:14048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20611.exe
        6⤵
        
        PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37153.exe
        5⤵
        
        PID:9376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2280.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44402.exe
        5⤵
        
        PID:16512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55010.exe
      4⤵
      PID:6112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44067.exe
        5⤵
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        5⤵
        
        PID:15132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27834.exe
      4⤵
      PID:11228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51865.exe
      4⤵
      PID:14820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18921.exe
      4⤵
      PID:4296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52557.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52557.exe
    3⤵
    PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44419.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44419.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59074.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59074.exe
      4⤵
      PID:11880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47177.exe
      4⤵
      PID:15912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39284.exe
      4⤵
      PID:4328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38899.exe
    3⤵
    PID:8340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39688.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39688.exe
    3⤵
    PID:11936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26702.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26702.exe
    3⤵
    PID:12732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22169.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22169.exe
    3⤵
    PID:7180
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42926.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42926.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12479.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33902.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18713.exe
        6⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31998.exe
        7⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38587.exe
        8⤵
        
        PID:12912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44298.exe
        8⤵
        
        PID:15828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1601.exe
        7⤵
        
        PID:8540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55530.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29125.exe
        7⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63178.exe
        6⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4103.exe
        7⤵
        
        PID:12168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62723.exe
        7⤵
        
        PID:8416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28026.exe
        6⤵
        
        PID:3696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34184.exe
        6⤵
        
        PID:13928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39317.exe
        6⤵
        
        PID:8608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25079.exe
        5⤵
        
        PID:5472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64862.exe
        6⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59323.exe
        7⤵
        
        PID:9256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38233.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34418.exe
        7⤵
        
        PID:512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4474.exe
        7⤵
        
        PID:5608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45130.exe
        6⤵
        
        PID:9244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8720.exe
        6⤵
        
        PID:13236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44402.exe
        6⤵
        
        PID:16264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11376.exe
        5⤵
        
        PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17470.exe
        5⤵
        
        PID:9880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33133.exe
        5⤵
        
        PID:13704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63410.exe
        5⤵
        
        PID:4456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42570.exe
        5⤵
        
        PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3267.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43601.exe
        5⤵
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41160.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19563.exe
        7⤵
        
        PID:12416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43254.exe
        7⤵
        
        PID:16176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32266.exe
        7⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48311.exe
        6⤵
        
        PID:8804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61206.exe
        6⤵
        
        PID:15044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22751.exe
        6⤵
        
        PID:8420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-137.exe
        5⤵
        
        PID:7604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18227.exe
        6⤵
        
        PID:13096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3520.exe
        5⤵
        
        PID:7496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8441.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24028.exe
        5⤵
        
        PID:16276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9999.exe
      4⤵
      PID:5628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26163.exe
        5⤵
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44451.exe
        6⤵
        
        PID:12380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        6⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe
        6⤵
        
        PID:8360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-641.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13269.exe
        5⤵
        
        PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-126.exe
        5⤵
        
        PID:17240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32626.exe
        5⤵
        
        PID:4280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3392.exe
      4⤵
      PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3121.exe
      4⤵
      PID:12028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53568.exe
      4⤵
      PID:14328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26618.exe
      4⤵
      PID:6968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33444.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33444.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33518.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16025.exe
        5⤵
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52641.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58082.exe
        7⤵
        
        PID:7948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12072.exe
        7⤵
        
        PID:10396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44295.exe
        7⤵
        
        PID:14504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39317.exe
        7⤵
        
        PID:17496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57506.exe
        6⤵
        
        PID:7632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12949.exe
        6⤵
        
        PID:10252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8441.exe
        6⤵
        
        PID:14228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55461.exe
        6⤵
        
        PID:8696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59884.exe
        5⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59323.exe
        6⤵
        
        PID:9512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28048.exe
        6⤵
        
        PID:15284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44122.exe
        6⤵
        
        PID:15796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26111.exe
        5⤵
        
        PID:9812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64633.exe
        5⤵
        
        PID:13620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46201.exe
        5⤵
        
        PID:16924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62913.exe
        5⤵
        
        PID:9288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33548.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65015.exe
        5⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61155.exe
        6⤵
        
        PID:11280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9024.exe
        6⤵
        
        PID:16564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62828.exe
        6⤵
        
        PID:5644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52809.exe
        5⤵
        
        PID:9240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1534.exe
        5⤵
        
        PID:14284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65082.exe
        5⤵
        
        PID:8872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3976.exe
      4⤵
      PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53371.exe
        5⤵
        
        PID:10392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65071.exe
        5⤵
        
        PID:15292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29666.exe
        5⤵
        
        PID:13636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34170.exe
      4⤵
      PID:9384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57529.exe
      4⤵
      PID:14436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1751.exe
      4⤵
      PID:8400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50932.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45246.exe
      4⤵
      PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31998.exe
        5⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61555.exe
        6⤵
        
        PID:12248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44106.exe
        6⤵
        
        PID:16608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17937.exe
        5⤵
        
        PID:8464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7066.exe
        6⤵
        
        PID:12612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25569.exe
        6⤵
        
        PID:17184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55530.exe
        5⤵
        
        PID:14164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57745.exe
        5⤵
        
        PID:15220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29509.exe
        5⤵
        
        PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63178.exe
      4⤵
      PID:7188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30699.exe
        5⤵
        
        PID:11700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58906.exe
        5⤵
        
        PID:15636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25551.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11605.exe
      4⤵
      PID:9836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33906.exe
      4⤵
      PID:13544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33650.exe
      4⤵
      PID:13780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44405.exe
    3⤵
    PID:5136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7685.exe
      4⤵
      PID:6508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10522.exe
        5⤵
        
        PID:11364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9024.exe
        5⤵
        
        PID:16572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51377.exe
      4⤵
      PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9017.exe
      4⤵
      PID:12768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39790.exe
      4⤵
      PID:16080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9217.exe
      4⤵
      PID:872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29317.exe
      4⤵
      PID:5616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49417.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-993.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-993.exe
    3⤵
    PID:3984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59128.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59128.exe
    3⤵
    PID:12488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17123.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17123.exe
    3⤵
    PID:6692
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58312.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58312.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20446.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20446.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29516.exe
      4⤵
      PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18734.exe
        5⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36168.exe
        6⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21880.exe
        6⤵
        
        PID:11656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50546.exe
        6⤵
        
        PID:3708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22154.exe
        6⤵
        
        PID:4384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35601.exe
        5⤵
        
        PID:8320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63489.exe
        5⤵
        
        PID:11964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61703.exe
        5⤵
        
        PID:12820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12251.exe
        5⤵
        
        PID:5528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9043.exe
      4⤵
      PID:5220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48555.exe
        5⤵
        
        PID:8856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52655.exe
        5⤵
        
        PID:12952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5865.exe
        5⤵
        
        PID:16860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29317.exe
        5⤵
        
        PID:5648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16568.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16568.exe
      4⤵
      PID:9900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13417.exe
      4⤵
      PID:13788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63267.exe
      4⤵
      PID:872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3647.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18713.exe
      4⤵
      PID:5116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23105.exe
        5⤵
        
        PID:7308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45712.exe
        6⤵
        
        PID:12724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
        6⤵
        
        PID:16320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1815.exe
        6⤵
        
        PID:6996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1024.exe
        5⤵
        
        PID:10076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7865.exe
        5⤵
        
        PID:13796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30578.exe
        5⤵
        
        PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64247.exe
      4⤵
      PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11394.exe
        5⤵
        
        PID:12392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42185.exe
        5⤵
        
        PID:15500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33610.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35919.exe
      4⤵
      PID:10772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30920.exe
      4⤵
      PID:14840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15745.exe
      4⤵
      PID:4036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4153.exe
      4⤵
      PID:6296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6827.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6827.exe
    3⤵
    PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36168.exe
      4⤵
      PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42550.exe
      4⤵
      PID:9372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28536.exe
      4⤵
      PID:15104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39898.exe
      4⤵
      PID:1628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47619.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47619.exe
      4⤵
      PID:6716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5233.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5233.exe
    3⤵
    PID:6444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19656.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19656.exe
    3⤵
    PID:11988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36502.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36502.exe
    3⤵
    PID:15312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7033.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7033.exe
    3⤵
    PID:6456
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28043.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28043.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7861.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7861.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45246.exe
      4⤵
      PID:1652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41318.exe
        5⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63075.exe
        6⤵
        
        PID:9260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60522.exe
        6⤵
        
        PID:12940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62849.exe
        6⤵
        
        PID:16340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18897.exe
        5⤵
        
        PID:9152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17464.exe
        5⤵
        
        PID:12400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28642.exe
        5⤵
        
        PID:17268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55778.exe
      4⤵
      PID:6496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25819.exe
        5⤵
        
        PID:13764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22952.exe
        5⤵
        
        PID:8752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62046.exe
      4⤵
      PID:9272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1534.exe
      4⤵
      PID:14300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16712.exe
      4⤵
      PID:17312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37677.exe
      4⤵
      PID:5724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25847.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25847.exe
    3⤵
    PID:5316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31923.exe
      4⤵
      PID:5884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47632.exe
        5⤵
        
        PID:12808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44106.exe
        5⤵
        
        PID:15808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32074.exe
        5⤵
        
        PID:1480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49655.exe
      4⤵
      PID:10236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1808.exe
      4⤵
      PID:14136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47331.exe
      4⤵
      PID:8976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30400.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30400.exe
    3⤵
    PID:7784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17745.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17745.exe
    3⤵
    PID:10296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35437.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35437.exe
    3⤵
    PID:14424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1642.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1642.exe
    3⤵
    PID:8272
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53414.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53414.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31998.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31998.exe
      4⤵
      PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30019.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29769.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38537.exe
        5⤵
        
        PID:15956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17937.exe
      4⤵
      PID:8316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55530.exe
      4⤵
      PID:14176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65082.exe
      4⤵
      PID:6404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63178.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63178.exe
    3⤵
    PID:448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42347.exe
      4⤵
      PID:15248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28304.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28304.exe
    3⤵
    PID:9496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57834.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57834.exe
    3⤵
    PID:14320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65061.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65061.exe
    3⤵
    PID:8756
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12616.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12616.exe
  2⤵
  PID:5264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34494.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34494.exe
    3⤵
    PID:6548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28099.exe
      4⤵
      PID:9820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14801.exe
      4⤵
      PID:15344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28594.exe
      4⤵
      PID:5384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43209.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43209.exe
    3⤵
    PID:9648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58218.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58218.exe
    3⤵
    PID:13332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32773.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32773.exe
    3⤵
    PID:8044
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3912.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3912.exe
  2⤵
  PID:3128
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48006.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48006.exe
  2⤵
  PID:9792
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11273.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11273.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:13476
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55455.exe
  2⤵
  PID:17164
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54738.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54738.exe
  2⤵
  PID:3752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 548 -ip 548
1⤵
PID:5916

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 12820 -ip 12820
1⤵
PID:4564

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 17312 -ip 17312
1⤵
PID:244

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:8788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-12277.exe

Filesize
468KB

MD5
a7230c12d06d5f415ca9024d63c1bdf6

SHA1
58188f0b0cd00eb9a97d106cee18d078460469e9

SHA256
3787907b2ca41b5a77a4c69d9bc827daf521c7a85ec9761c4ccc1e1fbb240923

SHA512
5688e713049288337eb1e0a0738ce3d161e2f3bafda2c7dddcbb7aee10da6ddf7be2a007f3770705e55b916281633dc586f09fda17711faf04a13882ef9dd370

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12479.exe

Filesize
468KB

MD5
5ec35da8197a0d91664bcca527ac57f7

SHA1
adc0441840f1c9b2d131fcd0c10e783fed810c6e

SHA256
750637e9cf318f179b40cc0f4404ad469e9b2cb6343599fadd259ed9362a0cfe

SHA512
3c5408fcdb9ba37fae6f6b1fa301771340bd6820acd40ba409df4ac77cdf0187cd5abfaac5b7d1aa813d9c6b7b32500216d94c1875c5c0bf44617487a041206f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13444.exe

Filesize
468KB

MD5
38462408ac11d6390a6ad6fc0bb83bda

SHA1
2226cda1d2ca72ed1862dd729a74901569962e57

SHA256
5b387a0b98e858dc94abcfa7a5a428f0d2990013d2f0bba7ba25399e9a9ed20f

SHA512
c9c6c48e5d501d31b98f135103e39d9f1dfe7c8bf44736c4feef5244463e618db28765369ab51b29bfd36460bfa41e4d8a54ce61f66e8705c81ef33445588052

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14015.exe

Filesize
468KB

MD5
1bbc11061d82bf3f7cd3cf8e7b2f4bda

SHA1
87bbc3453f4ff6449fddffe7cc4715206023b6da

SHA256
cf3fe0632fdb93445f9f27fb18fd9d558f08eef58b28806e3fbb803ce08f8717

SHA512
0dbb6ac5d54007a5e504076d0e9bd0b3635551f35674d4651781239d0cf86ce039ad71c63451338bbff2efb2da30b90888180669e5c368d981d3e0112e769e32

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14801.exe

Filesize
468KB

MD5
d79d8fd7328d8ac4ec29a49a208659ff

SHA1
e7e6004cc5cceaff98467a9ab0b78409c1d6c49f

SHA256
2a9fc6f6071cb29828ddc53adcf90307ec7844ea8812d1d7a257d937dc2e1a90

SHA512
85883345a2dd802c264f8fb11f2a37aa3f78a77fb1ed990c52fd19af4bf44ef80e2db46e9b0619a7a26ee760595fd7667fb8b1a653d7a2ecabcee9f7a5fcb694

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16670.exe

Filesize
468KB

MD5
0fdbe908e43f2c9d2acd4c6aed7ce379

SHA1
91357de2be17d0e8143e635538e2b3e8b814ecee

SHA256
6803363c73f4bb7108006e5c12ee06f318c13a6d3c59ae9fe696c9e843a34167

SHA512
d1e045085c36e83f7b24fbe6b33c19fd552f96568f3c04887496a25be82decd87d709743d53f186e480668447bb5aff583b50a4090bf925a5f32a0fcb16636e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20446.exe

Filesize
468KB

MD5
107dd65eda0b4890cf3fa6201d4e91a2

SHA1
fcbf97e02951d9239ce97b4de30a0ae9be63d13f

SHA256
ccc54d7687432a26a95b3e05ddfeea470821264cf7d7c843726a62e5ffd96b35

SHA512
0cd8cb4e50f7c64df35e77fdae8652325c23d4aeb1ab014cee99ee980fd325d9f10a2e3cc8a56cb65e32810e360cfe708ffaf643b67e2f3c9cae09979191637b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22937.exe

Filesize
468KB

MD5
376f349313f7995008c2fe79c3af7bf7

SHA1
356409473cc24b790ff82134823265fa25b038aa

SHA256
de47b0120363436ba98c318f746623c4e0ba66a19c1f2e00ba50800403554144

SHA512
7724a81929a2a58d0bb44e03baf2493a35afa6917b7b7772b85641fda205318de88ac653075d70360586411801bb1a62d11693257cbc540f46265cbc93da7e79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27750.exe

Filesize
468KB

MD5
4d4a8297de2f2e7c6dd1cd1382b3cda9

SHA1
cf0c2fc393e2c32af604c7e742e721a92412c5c3

SHA256
d5deee8b027dc5e1448f5e0e1c93aa844ecef48e60ca601ffd076ee043a4a5bf

SHA512
62c88f8d8ae0340812dbf122888495316d59317290909b93c9af27e79ed931317249cddde591a9246c7f12a45126e3d61237e7189b7e5f730c068f390457089e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28043.exe

Filesize
468KB

MD5
12aaf5e9a8e25f0fe08f259602b27b26

SHA1
21c3d907aeb577564e3c26aad129ea6d77e37bff

SHA256
7b5d5eebc03f05f1dc6f70def837716a991cc5efcdc9573e6fe22c7115c4cfbc

SHA512
b481e6ab42a4920bb7808ad1106fd3efb072065f2f48f63b093718d212f5a375d593f013e1003d9e0d593f6e8bcb43c798c0a23cb5d2a2fd6f84406080a9e509

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30820.exe

Filesize
468KB

MD5
546e908460060ca7031f225b3054c99d

SHA1
f85eb027f55f70dba45bc434957ed4a8752fe8a5

SHA256
aec38165cb75c591a2aecd4d281c3488e859eafece5edc87bdba23de9088dbd2

SHA512
ac0c503cc2bdb002ca2841c546d9ad47606a6ca73833cf795830161877442fc8fa41e1e029ca54ad9c04de3375d0b8d452027ba61fde6b057a028c1bb1d8f7de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30843.exe

Filesize
468KB

MD5
67f5afb08037cf482945f05bddb61e99

SHA1
a3cedd78ad84a69a6e3d683f3b9d96c7785ff129

SHA256
368a3ef6d8066e94f4086e46a23b108d519885c5c55c758116263a4ba9141cba

SHA512
b3217b9ddeaf98e30669846b7203f185ecd211e091a7c56505fabc2c7899a572ec20e80134f171240e0c71886b072eabe63ff02d3647a9f3bfefe127b4ef8351

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32246.exe

Filesize
468KB

MD5
1bbedabb95cc341d365763090daacbe4

SHA1
ce6fbbe0ee3f8ae84ce3d28144bf33948d35a75f

SHA256
c3f3f90dc7e71e3fef2fe0d2a2a1f2520b56ee327b48a69e00d68756e5458724

SHA512
76d31438ade2b1c786f2a9ca045748e819e5f997b829219859ebde5bc5776b3366132022c087cf73b31ad0102dec812deb648be01c815b478d12196e7fb38428

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33310.exe

Filesize
468KB

MD5
0ec2b0f5f155e9056e79d7ec2ded1115

SHA1
89c366e55bbc37d5b87b171e89ba102bd7de2320

SHA256
839de317ddd2b1db72df4a5f3e0d300ca7a15793c3eaa4617f6d6b94c8c8411f

SHA512
f52b8b34a0ac5e0dc857da7a4dc49a2b9172d5d8c783d3d98521117ff43a106c57d92625b5c4cc316bb34f25215bd2fdd011515491bdc27a71a2d49c7e4bf8ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33444.exe

Filesize
468KB

MD5
5d1068fe87db4256827c692a2c612586

SHA1
8d4972c8fa2e22fc541a97c68893bd0cfa4ed8a4

SHA256
7427a4d24e164e500dfde616cb7d4cd210b9186300c12bf7108ca03b80bc9fc8

SHA512
c3ef95125d7939aab7ca0dae5364bcd3f9d39bfac9aac07870cba3433bb9c19d17588534b03d67c8c99357218d2bbd6d6f5d06efb166aaa28fffb7d40cdc4013

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33719.exe

Filesize
468KB

MD5
36a97ff7f074bf86aa4757aa54a551e7

SHA1
cbbe0325b4c101216d2474a5d9663658100527f1

SHA256
016d35357c2e1a500fa54b8b14abc5efb0a03c5e376d86358739262fed894d1f

SHA512
55635ec4c45bb30cce5c65595fbc21043cfd7ab367c5bdaf9f58347771f9c20f9f87632dff3345d2f1f52bdeabbb9db32b19c12dbf10529b593e139617376231

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38519.exe

Filesize
468KB

MD5
d81463812022ae9b667cea21b2678fa3

SHA1
b5b921893fb88e80dca67e5d3c9a2f36efd0388f

SHA256
d5090e4cf9b006deccf67dead65e890db0731c6171fe2cd05e5edb4f47bd35cb

SHA512
33a34ae9cc1ffcc0cc8533f07f1387a1b81004df1b2b04d807d2405675570aaccf10936bf67d9ca55cba4215f6ea9cbc5eb7052e76e4238317ff0e89e6c3e1cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41317.exe

Filesize
468KB

MD5
00e75ee357f70293a15ff2e05596bfc3

SHA1
de3b02c2840ed78c82c21bf8b70fadb00aa19f8a

SHA256
3335980d4f268a9740b9e724cdca8ebc30fe731da92d8f1bcd36b0313fea0630

SHA512
275440a61680470faeb85e3891066b721084076cbc3c99a6d7820e9b43e69f23d67951355faf169f0146c82a47cc3b5bc81a86a5794f2d2d95edb71c091a799b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42926.exe

Filesize
468KB

MD5
acbaa6333ea267edace1d847833d186d

SHA1
8ed10ece2db36d3b0a729a0fb3667fb551ea8e78

SHA256
d551e2bc533ba3996de3d6502c45623b2b4370051e86f15b7a2fcdd007ce59dc

SHA512
734de918a5081150dba15c048d720d14b0ab3b5f2f491da18c4e38b7a57faee050071829eb21c863610d110b410f1274272b13915d718cc1f96b6280e99c925f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44270.exe

Filesize
468KB

MD5
e5975440aaef507600cffdec4df9574c

SHA1
19b0f6383ceb938509549959bd641b00c2642ac0

SHA256
bf9bd6b84b0a77365dc1ec2f027efec8adfb6debd0606242ee8ceaa8955ebef7

SHA512
dc22502dd68dc54c770ab96ac83ad5f1db12bcd32881e82cf4690aa0053e881e538d5946398c5c71e7bc3e59d96cd4d8c8aaa4fa36832386c2260b28e1afd202

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49646.exe

Filesize
468KB

MD5
b1e1ad6ca37c0fba582dea7807a612b8

SHA1
b5b14eee3cd6d73d8ec8e0083a4c12f36199c6c9

SHA256
153532b953a8b97e7821dba39b5142f302d55550c8286f61bb14a26a0fecd227

SHA512
f1ccf670b3f3a5a9858c4c176f35315126a899cbb27cc5894201017ccee436b589057a058a35f1c762b1a49bf9350a2252e0f7a2100f12ec6b4912a9975fafd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53310.exe

Filesize
468KB

MD5
179d3797f817b19b5ff748e65f9e0f12

SHA1
b539b38b4072114ad0f71dbc923d2214882b2b50

SHA256
e41a05ee5b693e08e6d9b31c83ce47d7b5b598acadf760be8c5db97d24cee110

SHA512
1eae1778549302de6602e040ce86c7ddb22a872eea6bb38c2b6f864902145e1f9b961257a84d5764a7d21c9ad7ad199e057239b9c19e094fa83d70d8e2c154dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53320.exe

Filesize
468KB

MD5
517dabed2efa4da2e7230b369bb73cff

SHA1
5f6dec044c2666d25551d0489c572f4c3130501a

SHA256
c71fe8f225979a3bb0ce088c66b754f9d87631972c1f1c03735f3003bcd51934

SHA512
695dbbbf22f6c4b462c785ea35f5e954cb59db2abe053a515f207fc5aff786c24e599374a1f8e9e0b7d21c4f43a7aa80f2372b40a358cc016ecaf461b4092622

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53393.exe

Filesize
468KB

MD5
842aeb27690815d0c1ce792bbee5bea6

SHA1
bb443380b28a658e3e1bdf2f54c26c06bb22f8ca

SHA256
f0dc7c0e6b095ad3d82329566ce5fd3dc97f0119c9b510519b9549b4f78d6f11

SHA512
bf0d0d152d82446528638424574a085742791390a66a11660e825251a247bba85e70741d07a6bb1dbd4ede2966bf77f781ddacda7dfbcd2fc3943ad156066496

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53585.exe

Filesize
468KB

MD5
0608dd036076a09b781f33ecca5ecfd4

SHA1
939c3c6a942dc74321360329fe1d988f781cb176

SHA256
1637285949ffaf40ed33997d2596f9a6abebd8f07d21c753e3a7b5a079ff4900

SHA512
b47f23d79ec49ccf83542c0da810d1278db34f851442c43d6e4121c42e08877db7d0943c62468a6e2d13e154cd6e0963da404766a5fabddc4479bd3c9d878085

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe

Filesize
468KB

MD5
bfb54e25d7e94c180caae9deaa88d295

SHA1
e8f9cd0557914a2da07e47fcd3d16816a8e2e5ac

SHA256
72891c5a18cda0e92f12ffa1ca026bec6676be73ddf94be74f4c4954b4964368

SHA512
7f1d6d5abf467aae2dfe2083c98e4348b4ef1284d9c81197a200fe6806853fb5a11adaf42c72e39248794a92446674f91083a7ce5618390f784e06274a13af3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58312.exe

Filesize
468KB

MD5
5a946931d44e3b1b89ecff19d1d72b02

SHA1
c4b7659b9a822439b7f85b3cb6426e8ad17eaafa

SHA256
d8001bc034f720344b47fe60f6eb7cfb994493c89a49a6d8e4611c5039c66f69

SHA512
cc4ce8d9bc87a72c47fb68de9958bde2213ee14448ea973287fae49097a34c333408d8f006bd7581f6c0a99637006bd678e981ba404f7f400cd8c2b068836569

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58385.exe

Filesize
468KB

MD5
a3af8d15a7e5ea1979402659e29ce324

SHA1
0293f8766ef682c8c24e20a7f294a34c5b9e87ae

SHA256
cfd4926beb404ee437d3288041bdb181b2bf65d079a0f371ca887ca79636c39f

SHA512
b6414e2d2caa9409f354ed44185e4472ad1443ea6fbb6ace8f9c7724b119201e932d93b4ae097bd4367f239479160ff9ea99505c40901ca276c762cd9d3d7d80

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60703.exe

Filesize
468KB

MD5
d9a30f6a0d1ff10b29703cfe3cfb6803

SHA1
f2f2659df5926eb9b24a1bc59afc8cfb580c2578

SHA256
c6acd5523ab1277259bce83086147fca8ae679ae73ad8718668a5f833b3f0c7e

SHA512
a900f28fed53eab295814df518167557397f4bbd47d23aee0197faffa27bc40c90e98de793b84827f6743354d1b697be1bf7b587bd24fa68db42a06032e1dbd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60798.exe

Filesize
468KB

MD5
06f45f47c581dc5596ff88123d2fe634

SHA1
db2be8b30ac69326f83475d76d1c8f068bfebcaa

SHA256
0a9e1263abb9e42e0852f773dc00e6c57adfc711802f017fbc602b87c5d4458d

SHA512
dfcda8d43e1a4ec98cb7ccc8b3f9a4d2168b745a6127df3a55344a2feabdd4ba1046b2159712d88f02bcba587832476c73d4cbf157e2f3424df877b61e5178c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61670.exe

Filesize
468KB

MD5
3d36c14b018c68cc51e7ea7ddbf6d315

SHA1
8e87a4c45db97d7db98c30eb6e40ae52078fb254

SHA256
22b1bdbcee9a27107996245d19d3334b7f862314658a55ae71219a880ea10ec2

SHA512
6e71fcf6d6a2b26c393f423f24a6d66ac05801e0f9e91092ebb855771afc52ffb41eb311b55998fe52f86b4dfc3f9d46b68053ef3072be96bc4f8ff188f20301

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61773.exe

Filesize
468KB

MD5
20d19e1cb7553b76716d25f1c54efc0e

SHA1
ed035e9afb356002395a7111a564ddef7a6fb3b6

SHA256
0f16976935d27a2410a0a0d2ebd098123458f2ccd88113e42d10d6ec0f506115

SHA512
86e63767e7ac2c6b7c137f687506406d9535f8f4c3dc159d134bbe1b9b9223cd40bd9383d3f9f5d1e7deb9e276824291d7a65b05bf7b08beff1e4d94e19aeb18

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62630.exe

Filesize
468KB

MD5
059f454dd357fc64fc1a6a1e0b95ec37

SHA1
b3619c42de55c5203aa39574e6e71f1ea3bf5164

SHA256
2aaa107b18c7e77f5423fb2d5f00b8ed2c1845d47443e1fd3f8e31480b47c146

SHA512
2defdd757b4bb42c4e49e24287840d56606042d1cd4a8f9b395b9df87c6f5d034b9702a00c1a4ffcaf5fd234f18e55de780c1a368f3f1907056d446a7ee46242

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads