5f42509942c29636ecdf90552b4d87497bd32ed1279d20a094b9ee64e9fc4e16

Analysis

max time kernel
110s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2024, 14:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f42509942c29636ecdf90552b4d87497bd32ed1279d20a094b9ee64e9fc4e16N.exe
Size

468KB
MD5

a7d7736aac718baf6a0ca5f97196c0f0
SHA1

d75222f33143bf10ebcf55fce200f582f130e7c1
SHA256

5f42509942c29636ecdf90552b4d87497bd32ed1279d20a094b9ee64e9fc4e16
SHA512

a828685163028c925e4ef3fb22321d2fabd990897ed034f6cb854d797c53e3c911fdb6d1f60a063974fe100d0665284a8d8ab67d0e309f59b5c73918e8f90de2
SSDEEP

3072:4belogxaIU57tbYZPzcymbfD/n2DnsIH/QmyeQVqAr/fkoi3ux/lj:4b4oCc7tCP4ymbfra1wr/sP3ux

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1464	Unicorn-54519.exe
2316	Unicorn-19455.exe
3504	Unicorn-7757.exe
220	Unicorn-42371.exe
2944	Unicorn-44409.exe
1016	Unicorn-50539.exe
1568	Unicorn-26589.exe
3704	Unicorn-9070.exe
2824	Unicorn-5541.exe
1180	Unicorn-57695.exe
3344	Unicorn-57695.exe
3776	Unicorn-28915.exe
3972	Unicorn-9049.exe
3220	Unicorn-22784.exe
4948	Unicorn-28650.exe
3156	Unicorn-15038.exe
3256	Unicorn-15038.exe
404	Unicorn-11509.exe
2340	Unicorn-50901.exe
3636	Unicorn-7446.exe
1048	Unicorn-7446.exe
2760	Unicorn-15614.exe
3456	Unicorn-19699.exe
2224	Unicorn-43938.exe
2976	Unicorn-38073.exe
2272	Unicorn-35272.exe
1496	Unicorn-44203.exe
3240	Unicorn-24337.exe
1612	Unicorn-24337.exe
2144	Unicorn-17321.exe
1776	Unicorn-30747.exe
468	Unicorn-30747.exe
2156	Unicorn-35001.exe
4600	Unicorn-30917.exe
1344	Unicorn-54867.exe
384	Unicorn-54867.exe
1852	Unicorn-5401.exe
4768	Unicorn-65073.exe
3576	Unicorn-47851.exe
2796	Unicorn-56190.exe
2632	Unicorn-60835.exe
5100	Unicorn-19803.exe
2468	Unicorn-65474.exe
2792	Unicorn-19803.exe
228	Unicorn-32055.exe
2620	Unicorn-45246.exe
4000	Unicorn-65111.exe
1400	Unicorn-58981.exe
4812	Unicorn-13864.exe
2208	Unicorn-19995.exe
4060	Unicorn-36331.exe
4120	Unicorn-24079.exe
828	Unicorn-32247.exe
4844	Unicorn-54321.exe
316	Unicorn-60186.exe
3688	Unicorn-34985.exe
2648	Unicorn-55605.exe
636	Unicorn-44670.exe
4588	Unicorn-29507.exe
380	Unicorn-33591.exe
5020	Unicorn-54395.exe
1360	Unicorn-58479.exe
4496	Unicorn-1110.exe
2320	Unicorn-59034.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2788	3776	WerFault.exe	97
14200	7728	WerFault.exe	355

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26502.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55605.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45830.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13969.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16874.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37601.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12400.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48973.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25264.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25472.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7757.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19975.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29472.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2293.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50937.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61850.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2649.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47398.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45071.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14288.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56141.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62959.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19488.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28426.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44670.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15614.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37692.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46236.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30446.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42062.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8823.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63646.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16504.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3134.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10065.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	2920	dwm.exe
Token: SeChangeNotifyPrivilege	2920	dwm.exe
Token: 33	2920	dwm.exe
Token: SeIncBasePriorityPrivilege	2920	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
676	5f42509942c29636ecdf90552b4d87497bd32ed1279d20a094b9ee64e9fc4e16N.exe
1464	Unicorn-54519.exe
3504	Unicorn-7757.exe
2316	Unicorn-19455.exe
1016	Unicorn-50539.exe
220	Unicorn-42371.exe
2944	Unicorn-44409.exe
1568	Unicorn-26589.exe
3704	Unicorn-9070.exe
2824	Unicorn-5541.exe
3776	Unicorn-28915.exe
4948	Unicorn-28650.exe
3344	Unicorn-57695.exe
3220	Unicorn-22784.exe
3972	Unicorn-9049.exe
1180	Unicorn-57695.exe
3156	Unicorn-15038.exe
3256	Unicorn-15038.exe
404	Unicorn-11509.exe
2340	Unicorn-50901.exe
3636	Unicorn-7446.exe
1612	Unicorn-24337.exe
2760	Unicorn-15614.exe
3456	Unicorn-19699.exe
1048	Unicorn-7446.exe
2976	Unicorn-38073.exe
1496	Unicorn-44203.exe
2272	Unicorn-35272.exe
3240	Unicorn-24337.exe
2224	Unicorn-43938.exe
2144	Unicorn-17321.exe
468	Unicorn-30747.exe
1776	Unicorn-30747.exe
1852	Unicorn-5401.exe
4600	Unicorn-30917.exe
384	Unicorn-54867.exe
2156	Unicorn-35001.exe
1344	Unicorn-54867.exe
4768	Unicorn-65073.exe
3576	Unicorn-47851.exe
2796	Unicorn-56190.exe
2632	Unicorn-60835.exe
5100	Unicorn-19803.exe
2468	Unicorn-65474.exe
2792	Unicorn-19803.exe
228	Unicorn-32055.exe
4000	Unicorn-65111.exe
4120	Unicorn-24079.exe
1400	Unicorn-58981.exe
2620	Unicorn-45246.exe
828	Unicorn-32247.exe
2208	Unicorn-19995.exe
4812	Unicorn-13864.exe
4060	Unicorn-36331.exe
4844	Unicorn-54321.exe
3688	Unicorn-34985.exe
2648	Unicorn-55605.exe
316	Unicorn-60186.exe
636	Unicorn-44670.exe
4588	Unicorn-29507.exe
1360	Unicorn-58479.exe
380	Unicorn-33591.exe
5020	Unicorn-54395.exe
2320	Unicorn-59034.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 676 wrote to memory of 1464	676	5f42509942c29636ecdf90552b4d87497bd32ed1279d20a094b9ee64e9fc4e16N.exe	86
PID 676 wrote to memory of 1464	676	5f42509942c29636ecdf90552b4d87497bd32ed1279d20a094b9ee64e9fc4e16N.exe	86
PID 676 wrote to memory of 1464	676	5f42509942c29636ecdf90552b4d87497bd32ed1279d20a094b9ee64e9fc4e16N.exe	86
PID 1464 wrote to memory of 2316	1464	Unicorn-54519.exe	87
PID 1464 wrote to memory of 2316	1464	Unicorn-54519.exe	87
PID 1464 wrote to memory of 2316	1464	Unicorn-54519.exe	87
PID 676 wrote to memory of 3504	676	5f42509942c29636ecdf90552b4d87497bd32ed1279d20a094b9ee64e9fc4e16N.exe	88
PID 676 wrote to memory of 3504	676	5f42509942c29636ecdf90552b4d87497bd32ed1279d20a094b9ee64e9fc4e16N.exe	88
PID 676 wrote to memory of 3504	676	5f42509942c29636ecdf90552b4d87497bd32ed1279d20a094b9ee64e9fc4e16N.exe	88
PID 3504 wrote to memory of 220	3504	Unicorn-7757.exe	89
PID 3504 wrote to memory of 220	3504	Unicorn-7757.exe	89
PID 3504 wrote to memory of 220	3504	Unicorn-7757.exe	89
PID 676 wrote to memory of 2944	676	5f42509942c29636ecdf90552b4d87497bd32ed1279d20a094b9ee64e9fc4e16N.exe	90
PID 676 wrote to memory of 2944	676	5f42509942c29636ecdf90552b4d87497bd32ed1279d20a094b9ee64e9fc4e16N.exe	90
PID 676 wrote to memory of 2944	676	5f42509942c29636ecdf90552b4d87497bd32ed1279d20a094b9ee64e9fc4e16N.exe	90
PID 2316 wrote to memory of 1016	2316	Unicorn-19455.exe	91
PID 2316 wrote to memory of 1016	2316	Unicorn-19455.exe	91
PID 2316 wrote to memory of 1016	2316	Unicorn-19455.exe	91
PID 1464 wrote to memory of 1568	1464	Unicorn-54519.exe	92
PID 1464 wrote to memory of 1568	1464	Unicorn-54519.exe	92
PID 1464 wrote to memory of 1568	1464	Unicorn-54519.exe	92
PID 1016 wrote to memory of 3704	1016	Unicorn-50539.exe	93
PID 1016 wrote to memory of 3704	1016	Unicorn-50539.exe	93
PID 1016 wrote to memory of 3704	1016	Unicorn-50539.exe	93
PID 2316 wrote to memory of 2824	2316	Unicorn-19455.exe	94
PID 2316 wrote to memory of 2824	2316	Unicorn-19455.exe	94
PID 2316 wrote to memory of 2824	2316	Unicorn-19455.exe	94
PID 220 wrote to memory of 1180	220	Unicorn-42371.exe	95
PID 220 wrote to memory of 1180	220	Unicorn-42371.exe	95
PID 220 wrote to memory of 1180	220	Unicorn-42371.exe	95
PID 2944 wrote to memory of 3344	2944	Unicorn-44409.exe	96
PID 2944 wrote to memory of 3344	2944	Unicorn-44409.exe	96
PID 2944 wrote to memory of 3344	2944	Unicorn-44409.exe	96
PID 1568 wrote to memory of 3776	1568	Unicorn-26589.exe	97
PID 1568 wrote to memory of 3776	1568	Unicorn-26589.exe	97
PID 1568 wrote to memory of 3776	1568	Unicorn-26589.exe	97
PID 3504 wrote to memory of 3972	3504	Unicorn-7757.exe	98
PID 3504 wrote to memory of 3972	3504	Unicorn-7757.exe	98
PID 3504 wrote to memory of 3972	3504	Unicorn-7757.exe	98
PID 1464 wrote to memory of 3220	1464	Unicorn-54519.exe	99
PID 1464 wrote to memory of 3220	1464	Unicorn-54519.exe	99
PID 1464 wrote to memory of 3220	1464	Unicorn-54519.exe	99
PID 676 wrote to memory of 4948	676	5f42509942c29636ecdf90552b4d87497bd32ed1279d20a094b9ee64e9fc4e16N.exe	100
PID 676 wrote to memory of 4948	676	5f42509942c29636ecdf90552b4d87497bd32ed1279d20a094b9ee64e9fc4e16N.exe	100
PID 676 wrote to memory of 4948	676	5f42509942c29636ecdf90552b4d87497bd32ed1279d20a094b9ee64e9fc4e16N.exe	100
PID 2824 wrote to memory of 3256	2824	Unicorn-5541.exe	106
PID 3704 wrote to memory of 3156	3704	Unicorn-9070.exe	105
PID 2824 wrote to memory of 3256	2824	Unicorn-5541.exe	106
PID 2824 wrote to memory of 3256	2824	Unicorn-5541.exe	106
PID 3704 wrote to memory of 3156	3704	Unicorn-9070.exe	105
PID 3704 wrote to memory of 3156	3704	Unicorn-9070.exe	105
PID 1016 wrote to memory of 404	1016	Unicorn-50539.exe	107
PID 1016 wrote to memory of 404	1016	Unicorn-50539.exe	107
PID 1016 wrote to memory of 404	1016	Unicorn-50539.exe	107
PID 2316 wrote to memory of 2340	2316	Unicorn-19455.exe	108
PID 2316 wrote to memory of 2340	2316	Unicorn-19455.exe	108
PID 2316 wrote to memory of 2340	2316	Unicorn-19455.exe	108
PID 1180 wrote to memory of 3636	1180	Unicorn-57695.exe	110
PID 1180 wrote to memory of 3636	1180	Unicorn-57695.exe	110
PID 1180 wrote to memory of 3636	1180	Unicorn-57695.exe	110
PID 3344 wrote to memory of 1048	3344	Unicorn-57695.exe	109
PID 3344 wrote to memory of 1048	3344	Unicorn-57695.exe	109
PID 3344 wrote to memory of 1048	3344	Unicorn-57695.exe	109
PID 3220 wrote to memory of 3456	3220	Unicorn-22784.exe	111

C:\Users\Admin\AppData\Local\Temp\5f42509942c29636ecdf90552b4d87497bd32ed1279d20a094b9ee64e9fc4e16N.exe
"C:\Users\Admin\AppData\Local\Temp\5f42509942c29636ecdf90552b4d87497bd32ed1279d20a094b9ee64e9fc4e16N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:676
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54519.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54519.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19455.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19455.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50539.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9070.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15038.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30747.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29507.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23451.exe
        9⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36959.exe
        10⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54014.exe
        11⤵
        
        PID:10432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52805.exe
        11⤵
        
        PID:14220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51702.exe
        11⤵
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60625.exe
        10⤵
        
        PID:9368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32715.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:13796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57102.exe
        10⤵
        
        PID:3004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
        10⤵
        
        PID:17892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2293.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10065.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:13488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45830.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29629.exe
        9⤵
        
        PID:10808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36111.exe
        9⤵
        
        PID:14736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15454.exe
        9⤵
        
        PID:17180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4545.exe
        8⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20623.exe
        9⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46718.exe
        10⤵
        
        PID:11316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25472.exe
        10⤵
        
        PID:14708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        10⤵
        
        PID:17544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36312.exe
        9⤵
        
        PID:9808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32715.exe
        9⤵
        
        PID:13844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36563.exe
        9⤵
        
        PID:10444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16827.exe
        8⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47728.exe
        8⤵
        
        PID:11420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30550.exe
        8⤵
        
        PID:16032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3153.exe
        8⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59034.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17203.exe
        8⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17499.exe
        9⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46526.exe
        10⤵
        
        PID:12084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9712.exe
        10⤵
        
        PID:16184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3448.exe
        9⤵
        
        PID:9468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32715.exe
        9⤵
        
        PID:13700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36563.exe
        9⤵
        
        PID:544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17323.exe
        8⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38913.exe
        8⤵
        
        PID:9764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46008.exe
        8⤵
        
        PID:14888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7618.exe
        8⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9257.exe
        7⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46718.exe
        8⤵
        
        PID:11192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25472.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        8⤵
        
        PID:17580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30335.exe
        7⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13380.exe
        7⤵
        
        PID:13788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53051.exe
        7⤵
        
        PID:16640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35001.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54395.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
        8⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6173.exe
        9⤵
        
        PID:14004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49754.exe
        9⤵
        
        PID:17204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        9⤵
        
        PID:17876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21267.exe
        8⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe
        8⤵
        
        PID:13500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42062.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
        7⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21267.exe
        7⤵
        
        PID:9492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46540.exe
        8⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54315.exe
        7⤵
        
        PID:1116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55857.exe
        6⤵
        
        PID:776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53575.exe
        7⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31046.exe
        8⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58461.exe
        8⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33867.exe
        8⤵
        
        PID:14012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35551.exe
        8⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58601.exe
        7⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37708.exe
        7⤵
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46121.exe
        7⤵
        
        PID:15496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14285.exe
        7⤵
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31266.exe
        6⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38202.exe
        7⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1513.exe
        8⤵
        
        PID:14208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43614.exe
        8⤵
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20516.exe
        7⤵
        
        PID:12440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14399.exe
        7⤵
        
        PID:16836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10962.exe
        7⤵
        
        PID:2688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34507.exe
        6⤵
        
        PID:8904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53925.exe
        6⤵
        
        PID:10696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36938.exe
        6⤵
        
        PID:16164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15405.exe
        6⤵
        
        PID:8552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11509.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54867.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58479.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12158.exe
        8⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47832.exe
        9⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43573.exe
        9⤵
        
        PID:10984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1083.exe
        9⤵
        
        PID:15384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3534.exe
        9⤵
        
        PID:3600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51494.exe
        8⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29629.exe
        8⤵
        
        PID:10816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15307.exe
        8⤵
        
        PID:14724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15454.exe
        8⤵
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30201.exe
        7⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28791.exe
        8⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59944.exe
        8⤵
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39733.exe
        8⤵
        
        PID:14116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17565.exe
        8⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24149.exe
        7⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9769.exe
        8⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41808.exe
        8⤵
        
        PID:1840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10617.exe
        8⤵
        
        PID:8528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26739.exe
        7⤵
        
        PID:10772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58253.exe
        7⤵
        
        PID:15428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20599.exe
        7⤵
        
        PID:8324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37741.exe
        6⤵
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52911.exe
        7⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45218.exe
        8⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17414.exe
        9⤵
        
        PID:15328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
        9⤵
        
        PID:8828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57500.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12400.exe
        8⤵
        
        PID:16648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20069.exe
        8⤵
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19488.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
        7⤵
        
        PID:12176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25229.exe
        7⤵
        
        PID:14924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1665.exe
        6⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19126.exe
        7⤵
        
        PID:9008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38528.exe
        7⤵
        
        PID:11416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39208.exe
        7⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45071.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16163.exe
        6⤵
        
        PID:8420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54885.exe
        6⤵
        
        PID:13028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54234.exe
        6⤵
        
        PID:16900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56437.exe
        6⤵
        
        PID:17692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65073.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41567.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3134.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61850.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40308.exe
        8⤵
        
        PID:11752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22417.exe
        8⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17480.exe
        7⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63646.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
        8⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16851.exe
        7⤵
        
        PID:13296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1876.exe
        7⤵
        
        PID:17096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
        7⤵
        
        PID:17716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45144.exe
        6⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30190.exe
        7⤵
        
        PID:11280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25472.exe
        7⤵
        
        PID:15984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26953.exe
        7⤵
        
        PID:8356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16800.exe
        6⤵
        
        PID:10324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31259.exe
        6⤵
        
        PID:14432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63059.exe
        6⤵
        
        PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16605.exe
        5⤵
        
        PID:1932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19471.exe
        6⤵
        
        PID:4080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43438.exe
        7⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6240.exe
        7⤵
        
        PID:11060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19363.exe
        7⤵
        
        PID:14984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16482.exe
        7⤵
        
        PID:740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25264.exe
        6⤵
        
        PID:8616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45789.exe
        6⤵
        
        PID:13588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8347.exe
        6⤵
        
        PID:10220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32880.exe
        5⤵
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9053.exe
        6⤵
        
        PID:15088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
        6⤵
        
        PID:7856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38598.exe
        5⤵
        
        PID:10628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51675.exe
        5⤵
        
        PID:14840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5654.exe
        5⤵
        
        PID:7452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5541.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15038.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30747.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33591.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16243.exe
        8⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4094.exe
        9⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60625.exe
        9⤵
        
        PID:9380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40884.exe
        9⤵
        
        PID:13612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe
        9⤵
        
        PID:17612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2293.exe
        8⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7237.exe
        9⤵
        
        PID:15084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
        9⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21459.exe
        8⤵
        
        PID:9920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46365.exe
        8⤵
        
        PID:14072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60689.exe
        8⤵
        
        PID:3680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe
        8⤵
        
        PID:17884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30009.exe
        7⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4094.exe
        8⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23034.exe
        9⤵
        
        PID:11096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35072.exe
        9⤵
        
        PID:14744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57314.exe
        9⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59944.exe
        8⤵
        
        PID:9644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39733.exe
        8⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62490.exe
        8⤵
        
        PID:14876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65229.exe
        7⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52826.exe
        8⤵
        
        PID:14000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20610.exe
        8⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27325.exe
        7⤵
        
        PID:9928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37699.exe
        7⤵
        
        PID:14108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36936.exe
        7⤵
        
        PID:7480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25785.exe
        6⤵
        
        PID:3620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23555.exe
        7⤵
        
        PID:5660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39354.exe
        8⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59525.exe
        8⤵
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19363.exe
        8⤵
        
        PID:16224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16482.exe
        8⤵
        
        PID:17488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13396.exe
        7⤵
        
        PID:8556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45789.exe
        7⤵
        
        PID:12356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        7⤵
        
        PID:17756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35681.exe
        6⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe
        7⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46236.exe
        6⤵
        
        PID:10640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56141.exe
        6⤵
        
        PID:14800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32520.exe
        6⤵
        
        PID:14292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30917.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25615.exe
        6⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8458.exe
        7⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38111.exe
        8⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47398.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-826.exe
        9⤵
        
        PID:13268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60817.exe
        8⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32715.exe
        8⤵
        
        PID:13820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52707.exe
        8⤵
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47218.exe
        7⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16402.exe
        8⤵
        
        PID:11348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31336.exe
        8⤵
        
        PID:16120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22869.exe
        8⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25543.exe
        7⤵
        
        PID:9884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46365.exe
        7⤵
        
        PID:14064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60689.exe
        7⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe
        7⤵
        
        PID:5796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33045.exe
        6⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49686.exe
        7⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45545.exe
        7⤵
        
        PID:10344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7583.exe
        7⤵
        
        PID:15660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32819.exe
        7⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37308.exe
        6⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3153.exe
        7⤵
        
        PID:15048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62419.exe
        7⤵
        
        PID:6436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13588.exe
        6⤵
        
        PID:10604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36407.exe
        6⤵
        
        PID:14284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56819.exe
        6⤵
        
        PID:8940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51773.exe
        5⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34655.exe
        6⤵
        
        PID:2756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31740.exe
        7⤵
        
        PID:8488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64132.exe
        7⤵
        
        PID:11684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48005.exe
        7⤵
        
        PID:16312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61914.exe
        7⤵
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        6⤵
        
        PID:8232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe
        6⤵
        
        PID:11320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50937.exe
        6⤵
        
        PID:16112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31989.exe
        6⤵
        
        PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20741.exe
        5⤵
        
        PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63392.exe
        5⤵
        
        PID:9284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13380.exe
        5⤵
        
        PID:13812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61219.exe
        5⤵
        
        PID:17208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56437.exe
        5⤵
        
        PID:17848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50901.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54867.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1110.exe
        6⤵
        Executes dropped EXE
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19279.exe
        7⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37050.exe
        8⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20516.exe
        8⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14399.exe
        8⤵
        
        PID:4088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe
        8⤵
        
        PID:17972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7236.exe
        7⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3064.exe
        7⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9355.exe
        7⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35866.exe
        7⤵
        
        PID:10228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61850.exe
        7⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44533.exe
        7⤵
        
        PID:12672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6535.exe
        7⤵
        
        PID:16500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16482.exe
        7⤵
        
        PID:8844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36068.exe
        6⤵
        
        PID:2020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26993.exe
        6⤵
        
        PID:11960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5463.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe
        6⤵
        
        PID:17640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21701.exe
        5⤵
        
        PID:2608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41707.exe
        6⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47832.exe
        7⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37258.exe
        8⤵
        
        PID:14576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4718.exe
        8⤵
        
        PID:17252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43573.exe
        7⤵
        
        PID:11048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37455.exe
        7⤵
        
        PID:15484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3534.exe
        7⤵
        
        PID:8332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39817.exe
        6⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40382.exe
        7⤵
        
        PID:14172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50603.exe
        7⤵
        
        PID:7300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6659.exe
        6⤵
        
        PID:9672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39925.exe
        6⤵
        
        PID:14444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14057.exe
        6⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1088.exe
        5⤵
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29038.exe
        6⤵
        
        PID:12100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5628.exe
        6⤵
        
        PID:16248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        6⤵
        
        PID:8300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        5⤵
        
        PID:8400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5883.exe
        5⤵
        
        PID:13036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37168.exe
        5⤵
        
        PID:16888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        5⤵
        
        PID:17768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5401.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25615.exe
        5⤵
        
        PID:5108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29455.exe
        6⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2649.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38602.exe
        8⤵
        
        PID:14236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2649.exe
        7⤵
        
        PID:10728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2649.exe
        7⤵
        
        PID:14912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2649.exe
        7⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        6⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57448.exe
        7⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37708.exe
        6⤵
        
        PID:11044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46121.exe
        6⤵
        
        PID:15504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20069.exe
        6⤵
        
        PID:8328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11665.exe
        5⤵
        
        PID:5548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37974.exe
        6⤵
        
        PID:11824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25472.exe
        6⤵
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        6⤵
        
        PID:17604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31023.exe
        5⤵
        
        PID:7944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6764.exe
        5⤵
        
        PID:12688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3735.exe
        5⤵
        
        PID:16456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56819.exe
        5⤵
        
        PID:8928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48973.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19471.exe
        5⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43438.exe
        6⤵
        
        PID:8944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62736.exe
        6⤵
        
        PID:12412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        6⤵
        
        PID:14292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61530.exe
        6⤵
        
        PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25264.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45789.exe
        5⤵
        
        PID:12376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16345.exe
      4⤵
      PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4533.exe
        5⤵
        
        PID:12004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60885.exe
        5⤵
        
        PID:15528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10617.exe
        5⤵
        
        PID:17416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56522.exe
      4⤵
      PID:9736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8915.exe
      4⤵
      PID:13776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18325.exe
      4⤵
      PID:15996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27567.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27567.exe
      4⤵
      PID:17924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26589.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28915.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3776
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3776 -s 488
        5⤵
        Program crash
        
        PID:2788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17321.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19995.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30659.exe
        6⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4094.exe
        7⤵
        
        PID:6820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6121.exe
        8⤵
        
        PID:11200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35072.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22869.exe
        8⤵
        
        PID:8388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59944.exe
        7⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49088.exe
        8⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39733.exe
        7⤵
        
        PID:13784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5313.exe
        7⤵
        
        PID:15392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10461.exe
        6⤵
        
        PID:7792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28426.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-966.exe
        7⤵
        
        PID:17556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33711.exe
        6⤵
        
        PID:9960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46365.exe
        6⤵
        
        PID:14056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60689.exe
        6⤵
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe
        6⤵
        
        PID:17940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6901.exe
        5⤵
        
        PID:1508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20623.exe
        6⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42634.exe
        7⤵
        
        PID:12276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5628.exe
        7⤵
        
        PID:15140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56541.exe
        6⤵
        
        PID:9356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32715.exe
        6⤵
        
        PID:13740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62027.exe
        6⤵
        
        PID:5456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23189.exe
        5⤵
        
        PID:7632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30247.exe
        5⤵
        
        PID:10460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29472.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24683.exe
        5⤵
        
        PID:17272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54321.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2646.exe
        5⤵
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55651.exe
        6⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32582.exe
        7⤵
        
        PID:8036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29038.exe
        8⤵
        
        PID:12048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5628.exe
        8⤵
        
        PID:13748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        8⤵
        
        PID:17956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15804.exe
        7⤵
        
        PID:10912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12051.exe
        7⤵
        
        PID:15444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61067.exe
        7⤵
        
        PID:10336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe
        6⤵
        
        PID:7244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18248.exe
        6⤵
        
        PID:12400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3735.exe
        6⤵
        
        PID:16488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19870.exe
        6⤵
        
        PID:2124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38089.exe
        5⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42634.exe
        6⤵
        
        PID:12252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29556.exe
        6⤵
        
        PID:15948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        6⤵
        
        PID:17980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20115.exe
        5⤵
        
        PID:8760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37621.exe
        5⤵
        
        PID:13368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23925.exe
        5⤵
        
        PID:16728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        5⤵
        
        PID:17868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30394.exe
      4⤵
      PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48827.exe
        5⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29038.exe
        6⤵
        
        PID:12064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5628.exe
        6⤵
        
        PID:16172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        6⤵
        
        PID:17572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45685.exe
        5⤵
        
        PID:4596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8683.exe
        5⤵
        
        PID:13044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
        5⤵
        
        PID:16880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
        5⤵
        
        PID:17724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42201.exe
      4⤵
      PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29230.exe
        5⤵
        
        PID:11792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28404.exe
        5⤵
        
        PID:16272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34789.exe
        5⤵
        
        PID:2148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39456.exe
      4⤵
      PID:9752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30446.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53486.exe
      4⤵
      PID:6960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22784.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22784.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19699.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2433.exe
        5⤵
        
        PID:1908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31723.exe
        6⤵
        
        PID:4760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23188.exe
        7⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51880.exe
        7⤵
        
        PID:11600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48005.exe
        7⤵
        
        PID:16256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54706.exe
        7⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe
        6⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63364.exe
        6⤵
        
        PID:9236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2312.exe
        6⤵
        
        PID:15988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20069.exe
        6⤵
        
        PID:8384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51009.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61420.exe
        5⤵
        
        PID:10316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18808.exe
        5⤵
        
        PID:14404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64364.exe
        5⤵
        
        PID:6428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44670.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2262.exe
        5⤵
        
        PID:1228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49211.exe
        6⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13085.exe
        7⤵
        
        PID:11804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12260.exe
        7⤵
        
        PID:14932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22869.exe
        7⤵
        
        PID:8180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47692.exe
        6⤵
        
        PID:9844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39733.exe
        6⤵
        
        PID:14196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25157.exe
        6⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27181.exe
        5⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18950.exe
        6⤵
        
        PID:11136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35072.exe
        6⤵
        
        PID:14748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8113.exe
        6⤵
        
        PID:1544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58792.exe
        5⤵
        
        PID:9684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe
        5⤵
        
        PID:13632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36511.exe
        5⤵
        
        PID:16800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15454.exe
        5⤵
        
        PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42401.exe
      4⤵
      PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15963.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62862.exe
        6⤵
        
        PID:12200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5052.exe
        6⤵
        
        PID:14440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13012.exe
        5⤵
        
        PID:9020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21127.exe
        5⤵
        
        PID:11940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14128.exe
        5⤵
        
        PID:17004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
        5⤵
        
        PID:17740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18001.exe
      4⤵
      PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63776.exe
      4⤵
      PID:9848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25248.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25248.exe
      4⤵
      PID:14084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61219.exe
      4⤵
      PID:4612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56437.exe
      4⤵
      PID:17932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43938.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43938.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36331.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59439.exe
        5⤵
        
        PID:2036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53295.exe
        6⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59944.exe
        6⤵
        
        PID:2604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39733.exe
        6⤵
        
        PID:14380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47498.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32033.exe
        5⤵
        
        PID:7844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54516.exe
        5⤵
        
        PID:9996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54533.exe
        5⤵
        
        PID:14188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56819.exe
        5⤵
        
        PID:5876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31597.exe
      4⤵
      PID:3924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48827.exe
        5⤵
        
        PID:5968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61829.exe
        6⤵
        
        PID:12172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3795.exe
        6⤵
        
        PID:17304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20566.exe
        6⤵
        
        PID:17536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45685.exe
        5⤵
        
        PID:8684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45789.exe
        5⤵
        
        PID:11788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        5⤵
        
        PID:17748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45001.exe
      4⤵
      PID:6404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64657.exe
      4⤵
      PID:9720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29915.exe
      4⤵
      PID:13680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45075.exe
      4⤵
      PID:17136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56437.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56437.exe
      4⤵
      PID:17832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55605.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55605.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44255.exe
      4⤵
      PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36959.exe
        5⤵
        
        PID:6736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37450.exe
        6⤵
        
        PID:15124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
        6⤵
        
        PID:8704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59944.exe
        5⤵
        
        PID:9604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39733.exe
        5⤵
        
        PID:14048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62682.exe
        5⤵
        
        PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51494.exe
      4⤵
      PID:7676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29629.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15307.exe
      4⤵
      PID:14716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15454.exe
      4⤵
      PID:5420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35317.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35317.exe
    3⤵
    PID:5268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20623.exe
      4⤵
      PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42634.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58337.exe
        5⤵
        
        PID:16436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55860.exe
      4⤵
      PID:3996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39733.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13289.exe
      4⤵
      PID:5964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62959.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62959.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1409.exe
      4⤵
      PID:12144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5628.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63196.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63196.exe
    3⤵
    PID:9936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11364.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11364.exe
    3⤵
    PID:14120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23483.exe
    3⤵
    PID:17500
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7757.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7757.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42371.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42371.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57695.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7446.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47851.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33207.exe
        7⤵
        
        PID:3676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23555.exe
        8⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53386.exe
        9⤵
        
        PID:7924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42634.exe
        10⤵
        
        PID:12260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17304.exe
        10⤵
        
        PID:14400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15804.exe
        9⤵
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12051.exe
        9⤵
        
        PID:15416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20994.exe
        9⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63069.exe
        8⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6187.exe
        8⤵
        
        PID:11272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50937.exe
        8⤵
        
        PID:16136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62874.exe
        8⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38281.exe
        7⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61990.exe
        8⤵
        
        PID:10360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7688.exe
        8⤵
        
        PID:13728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63318.exe
        8⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58792.exe
        7⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe
        7⤵
        
        PID:13836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23925.exe
        7⤵
        
        PID:14292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        7⤵
        
        PID:17908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38229.exe
        6⤵
        
        PID:436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17203.exe
        7⤵
        
        PID:5860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20623.exe
        8⤵
        
        PID:6832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62862.exe
        9⤵
        
        PID:12220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9328.exe
        9⤵
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10617.exe
        9⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47692.exe
        8⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39733.exe
        8⤵
        
        PID:14092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54514.exe
        8⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59662.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29629.exe
        7⤵
        
        PID:10792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15307.exe
        7⤵
        
        PID:14764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15454.exe
        7⤵
        
        PID:17368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38037.exe
        6⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18934.exe
        7⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39104.exe
        7⤵
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19363.exe
        7⤵
        
        PID:16240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16482.exe
        7⤵
        
        PID:17456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45441.exe
        6⤵
        
        PID:7160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18519.exe
        6⤵
        
        PID:12712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52737.exe
        6⤵
        
        PID:16424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8347.exe
        6⤵
        
        PID:17480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56190.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12978.exe
        6⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60503.exe
        7⤵
        
        PID:5604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41134.exe
        8⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62530.exe
        9⤵
        
        PID:15260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
        9⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28248.exe
        8⤵
        
        PID:11196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3307.exe
        8⤵
        
        PID:15564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32819.exe
        8⤵
        
        PID:4684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23572.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7723.exe
        7⤵
        
        PID:11244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45073.exe
        7⤵
        
        PID:3756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exe
        7⤵
        
        PID:17464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55194.exe
        6⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-885.exe
        7⤵
        
        PID:15244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
        7⤵
        
        PID:9116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57832.exe
        6⤵
        
        PID:9544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe
        6⤵
        
        PID:13768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36177.exe
        6⤵
        
        PID:17128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        6⤵
        
        PID:17948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10932.exe
        5⤵
        
        PID:3160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39699.exe
        6⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5685.exe
        7⤵
        
        PID:11484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25472.exe
        7⤵
        
        PID:15756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33432.exe
        6⤵
        
        PID:8648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45789.exe
        6⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        6⤵
        
        PID:17684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62158.exe
        5⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42634.exe
        6⤵
        
        PID:12268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17304.exe
        6⤵
        
        PID:14976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10617.exe
        6⤵
        
        PID:17440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29700.exe
        5⤵
        
        PID:10672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7669.exe
        5⤵
        
        PID:14776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-457.exe
        5⤵
        
        PID:13272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24337.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19803.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29891.exe
        6⤵
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59735.exe
        7⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10765.exe
        8⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46400.exe
        8⤵
        
        PID:12708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        8⤵
        
        PID:2432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40150.exe
        8⤵
        
        PID:13240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12472.exe
        7⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50048.exe
        8⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27759.exe
        7⤵
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12400.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exe
        7⤵
        
        PID:17472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50342.exe
        6⤵
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28283.exe
        6⤵
        
        PID:9052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45789.exe
        6⤵
        
        PID:13316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        6⤵
        
        PID:17732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6133.exe
        5⤵
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35423.exe
        6⤵
        
        PID:4028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31740.exe
        7⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10847.exe
        7⤵
        
        PID:11712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48005.exe
        7⤵
        
        PID:16296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4929.exe
        7⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34480.exe
        6⤵
        
        PID:7072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30883.exe
        6⤵
        
        PID:11224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51513.exe
        6⤵
        
        PID:15936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20069.exe
        6⤵
        
        PID:9148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31596.exe
        5⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12789.exe
        6⤵
        
        PID:10352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20324.exe
        6⤵
        
        PID:14392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30261.exe
        6⤵
        
        PID:7552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46236.exe
        5⤵
        
        PID:10652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56141.exe
        5⤵
        
        PID:14820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13864.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52423.exe
        5⤵
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15386.exe
        6⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8653.exe
        7⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37974.exe
        8⤵
        
        PID:11592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25472.exe
        8⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39206.exe
        8⤵
        
        PID:10372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57500.exe
        7⤵
        
        PID:12360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12400.exe
        7⤵
        
        PID:16444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exe
        7⤵
        
        PID:17508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23572.exe
        6⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3064.exe
        6⤵
        
        PID:2880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9355.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3194.exe
        6⤵
        
        PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63362.exe
        5⤵
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21586.exe
        6⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61253.exe
        6⤵
        
        PID:11332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12155.exe
        6⤵
        
        PID:17388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20566.exe
        6⤵
        
        PID:17520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33135.exe
        5⤵
        
        PID:9580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe
        5⤵
        
        PID:13732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8347.exe
        5⤵
        
        PID:8532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48266.exe
      4⤵
      PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55983.exe
        5⤵
        
        PID:7912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12000.exe
        5⤵
        
        PID:10040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48668.exe
        5⤵
        
        PID:14176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55047.exe
        5⤵
        
        PID:17212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
        5⤵
        
        PID:17964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60600.exe
      4⤵
      PID:8112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14288.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2579.exe
      4⤵
      PID:16044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47018.exe
      4⤵
      PID:13260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9049.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9049.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15614.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24079.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64675.exe
        6⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60067.exe
        7⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40780.exe
        7⤵
        
        PID:9988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48668.exe
        7⤵
        
        PID:14272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
        7⤵
        
        PID:17708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        6⤵
        
        PID:7752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29539.exe
        6⤵
        
        PID:10744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17916.exe
        6⤵
        
        PID:15404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24153.exe
        6⤵
        
        PID:8596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40917.exe
        5⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36575.exe
        6⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32095.exe
        7⤵
        
        PID:16432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49769.exe
        6⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58446.exe
        7⤵
        
        PID:15052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
        7⤵
        
        PID:8276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45789.exe
        6⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        6⤵
        
        PID:17672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40917.exe
        5⤵
        
        PID:6676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46236.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56141.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60709.exe
      4⤵
      PID:860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31723.exe
        5⤵
        
        PID:396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3381.exe
        6⤵
        
        PID:10588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35264.exe
        6⤵
        
        PID:15000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58658.exe
        6⤵
        
        PID:10232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33432.exe
        5⤵
        
        PID:8664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45789.exe
        5⤵
        
        PID:12248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        5⤵
        
        PID:17792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57882.exe
      4⤵
      PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46718.exe
        5⤵
        
        PID:12212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9136.exe
        5⤵
        
        PID:15104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        5⤵
        
        PID:17840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
      4⤵
      PID:9744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13380.exe
      4⤵
      PID:13512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49849.exe
      4⤵
      PID:392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38073.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38073.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32247.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47379.exe
        5⤵
        
        PID:668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44743.exe
        6⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44834.exe
        7⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59176.exe
        8⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15804.exe
        7⤵
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12051.exe
        7⤵
        
        PID:15760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17870.exe
        7⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51009.exe
        6⤵
        
        PID:8256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe
        6⤵
        
        PID:11284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50937.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45002.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27181.exe
        5⤵
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62286.exe
        6⤵
        
        PID:11816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48441.exe
        6⤵
        
        PID:15392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10617.exe
        6⤵
        
        PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58792.exe
        5⤵
        
        PID:9700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe
        5⤵
        
        PID:13640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46146.exe
        5⤵
        
        PID:15476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7861.exe
      4⤵
      PID:5192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11229.exe
        5⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9399.exe
        6⤵
        
        PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18911.exe
        5⤵
        
        PID:10380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6868.exe
        5⤵
        
        PID:12076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62682.exe
        5⤵
        
        PID:5496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12904.exe
      4⤵
      PID:7936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57256.exe
        5⤵
        
        PID:1572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31601.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31601.exe
      4⤵
      PID:10048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45868.exe
      4⤵
      PID:14324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
      4⤵
      PID:17652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60186.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60186.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23643.exe
      4⤵
      PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52527.exe
        5⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43993.exe
        6⤵
        
        PID:8496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64132.exe
        6⤵
        
        PID:11704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48005.exe
        6⤵
        
        PID:16288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26504.exe
        5⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41534.exe
        6⤵
        
        PID:14368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
        6⤵
        
        PID:8228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11851.exe
        5⤵
        
        PID:12696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43172.exe
        5⤵
        
        PID:17104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12423.exe
        5⤵
        
        PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62440.exe
      4⤵
      PID:7952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14813.exe
        5⤵
        
        PID:13220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47813.exe
        5⤵
        
        PID:16956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38913.exe
      4⤵
      PID:11252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46008.exe
      4⤵
      PID:14896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3534.exe
      4⤵
      PID:14480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51853.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51853.exe
    3⤵
    PID:5276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31723.exe
      4⤵
      PID:5832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21866.exe
        5⤵
        
        PID:7852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57870.exe
        6⤵
        
        PID:14240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13218.exe
        6⤵
        
        PID:9136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49629.exe
        5⤵
        
        PID:10928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61984.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29547.exe
        5⤵
        
        PID:3748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19155.exe
      4⤵
      PID:7500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17200.exe
      4⤵
      PID:11920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15359.exe
      4⤵
      PID:17212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15454.exe
      4⤵
      PID:7516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32681.exe
    3⤵
    PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62286.exe
      4⤵
      PID:11832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28404.exe
      4⤵
      PID:16264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58466.exe
      4⤵
      PID:3776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56522.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56522.exe
    3⤵
    PID:9652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8915.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8915.exe
    3⤵
    PID:13720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22409.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22409.exe
    3⤵
    PID:4512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27567.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27567.exe
    3⤵
    PID:17860
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44409.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44409.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57695.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57695.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7446.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60835.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18023.exe
        6⤵
        
        PID:2752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31723.exe
        7⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18950.exe
        8⤵
        
        PID:11124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35072.exe
        8⤵
        
        PID:14772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57314.exe
        8⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33432.exe
        7⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45789.exe
        7⤵
        
        PID:12380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36936.exe
        7⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21945.exe
        6⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51134.exe
        7⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63329.exe
        7⤵
        
        PID:10636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34975.exe
        7⤵
        
        PID:13532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9591.exe
        6⤵
        
        PID:9776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe
        6⤵
        
        PID:13828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52521.exe
        6⤵
        
        PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18577.exe
        5⤵
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22787.exe
        6⤵
        
        PID:2580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45410.exe
        7⤵
        
        PID:7908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20516.exe
        7⤵
        
        PID:12416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59708.exe
        7⤵
        
        PID:16996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60895.exe
        7⤵
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15596.exe
        6⤵
        
        PID:9032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11231.exe
        6⤵
        
        PID:11772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45073.exe
        6⤵
        
        PID:16012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exe
        6⤵
        
        PID:8748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51825.exe
        5⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40190.exe
        6⤵
        
        PID:14360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44923.exe
        6⤵
        
        PID:8084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34149.exe
        5⤵
        
        PID:9244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33999.exe
        5⤵
        
        PID:14020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37978.exe
        5⤵
        
        PID:6100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65474.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14706.exe
        5⤵
        
        PID:4024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39699.exe
        6⤵
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43993.exe
        7⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64132.exe
        7⤵
        
        PID:11696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48005.exe
        7⤵
        
        PID:16280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20069.exe
        7⤵
        
        PID:9124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43224.exe
        6⤵
        
        PID:7756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11851.exe
        6⤵
        
        PID:12424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63401.exe
        6⤵
        
        PID:16816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        6⤵
        
        PID:17900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42557.exe
        5⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        6⤵
        
        PID:11064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5332.exe
        6⤵
        
        PID:14420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22869.exe
        6⤵
        
        PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58792.exe
        5⤵
        
        PID:9708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe
        5⤵
        
        PID:13468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30386.exe
        5⤵
        
        PID:7232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8768.exe
      4⤵
      PID:4852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22787.exe
        5⤵
        
        PID:4796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1445.exe
        6⤵
        
        PID:7788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8299.exe
        6⤵
        
        PID:12432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12400.exe
        6⤵
        
        PID:16472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exe
        6⤵
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37168.exe
        5⤵
        
        PID:9056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11231.exe
        5⤵
        
        PID:11764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45073.exe
        5⤵
        
        PID:1232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exe
        5⤵
        
        PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57690.exe
      4⤵
      PID:6620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60330.exe
        5⤵
        
        PID:15364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62419.exe
        5⤵
        
        PID:8672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17315.exe
      4⤵
      PID:7804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16504.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16504.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51102.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51102.exe
      4⤵
      PID:17624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24337.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24337.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19803.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5578.exe
        5⤵
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5874.exe
        6⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31740.exe
        7⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14931.exe
        7⤵
        
        PID:11744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48005.exe
        7⤵
        
        PID:16304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37601.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30588.exe
        6⤵
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34096.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe
        6⤵
        
        PID:11296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50937.exe
        6⤵
        
        PID:16144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30969.exe
        6⤵
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17093.exe
        5⤵
        
        PID:6724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50610.exe
        6⤵
        
        PID:12040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5628.exe
        6⤵
        
        PID:15120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10617.exe
        6⤵
        
        PID:17448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-272.exe
        5⤵
        
        PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31067.exe
        5⤵
        
        PID:14244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14242.exe
        5⤵
        
        PID:6800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23621.exe
      4⤵
      PID:2496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55651.exe
        5⤵
        
        PID:1384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41326.exe
        6⤵
        
        PID:7880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20516.exe
        6⤵
        
        PID:12464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14399.exe
        6⤵
        
        PID:16804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe
        6⤵
        
        PID:17816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64797.exe
        5⤵
        
        PID:9000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52264.exe
        5⤵
        
        PID:11440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45073.exe
        5⤵
        
        PID:16024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24153.exe
        5⤵
        
        PID:7504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55910.exe
      4⤵
      PID:8056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30154.exe
        5⤵
        
        PID:16536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62419.exe
        5⤵
        
        PID:17424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3859.exe
      4⤵
      PID:10296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14724.exe
      4⤵
      PID:14460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43752.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58981.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58981.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59439.exe
      4⤵
      PID:4464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21007.exe
        5⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4621.exe
        6⤵
        
        PID:10256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16240.exe
        6⤵
        
        PID:14340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30261.exe
        6⤵
        
        PID:7548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59944.exe
        5⤵
        
        PID:9636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39733.exe
        5⤵
        
        PID:14296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51006.exe
        5⤵
        
        PID:6560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17323.exe
      4⤵
      PID:8032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38913.exe
      4⤵
      PID:9912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46008.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46008.exe
      4⤵
      PID:14624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7618.exe
      4⤵
      PID:17384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26502.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26502.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39647.exe
      4⤵
      PID:7828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27938.exe
        5⤵
        
        PID:13280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-826.exe
        5⤵
        
        PID:17328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53033.exe
      4⤵
      PID:10016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48668.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48668.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exe
      4⤵
      PID:17528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23651.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23651.exe
    3⤵
    PID:7744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10204.exe
    3⤵
    PID:10776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9781.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9781.exe
    3⤵
    PID:15456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7473.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7473.exe
    3⤵
    PID:5392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28650.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28650.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44203.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44203.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32055.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59823.exe
        5⤵
        
        PID:2540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39507.exe
        6⤵
        
        PID:4132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29038.exe
        7⤵
        
        PID:12124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5628.exe
        7⤵
        
        PID:16328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        7⤵
        
        PID:17596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33432.exe
        6⤵
        
        PID:8652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45789.exe
        6⤵
        
        PID:12392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
        6⤵
        
        PID:17808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5993.exe
        5⤵
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
        6⤵
        
        PID:4624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58792.exe
        5⤵
        
        PID:9660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17222.exe
        6⤵
        
        PID:15060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
        6⤵
        
        PID:8288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe
        5⤵
        
        PID:13572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45954.exe
        5⤵
        
        PID:5812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59994.exe
      4⤵
      PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53295.exe
        5⤵
        
        PID:6780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59944.exe
        5⤵
        
        PID:452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39733.exe
        5⤵
        
        PID:14280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5313.exe
        5⤵
        
        PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49277.exe
      4⤵
      PID:7172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19156.exe
      4⤵
      PID:9868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37699.exe
      4⤵
      PID:14100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38014.exe
      4⤵
      PID:13272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
      4⤵
      PID:17800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45246.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45246.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10814.exe
      4⤵
      PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18703.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54538.exe
        6⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9245.exe
        7⤵
        
        PID:15272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
        7⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-620.exe
        6⤵
        
        PID:11308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32819.exe
        6⤵
        
        PID:16028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17294.exe
        6⤵
        
        PID:15396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12472.exe
        5⤵
        
        PID:9100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27759.exe
        5⤵
        
        PID:12316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12400.exe
        5⤵
        
        PID:16464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exe
        5⤵
        
        PID:8992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1141.exe
      4⤵
      PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1409.exe
        5⤵
        
        PID:12112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41808.exe
        5⤵
        
        PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
        5⤵
        
        PID:17564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8823.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe
      4⤵
      PID:13804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52521.exe
      4⤵
      PID:16512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe
      4⤵
      PID:17776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53309.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53309.exe
    3⤵
    PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48827.exe
      4⤵
      PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49686.exe
        5⤵
        
        PID:7728
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7728 -s 720
        6⤵
        Program crash
        
        PID:14200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45545.exe
        5⤵
        
        PID:10976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7583.exe
        5⤵
        
        PID:15652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28735.exe
        5⤵
        
        PID:4436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23572.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53786.exe
        5⤵
        
        PID:13660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
        5⤵
        
        PID:7472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19975.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25229.exe
      4⤵
      PID:15132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50866.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50866.exe
    3⤵
    PID:6420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46718.exe
      4⤵
      PID:11356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42960.exe
      4⤵
      PID:16624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14701.exe
      4⤵
      PID:17588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55992.exe
    3⤵
    PID:10092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37692.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37692.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:14228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56437.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56437.exe
    3⤵
    PID:17700
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35272.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35272.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65111.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65111.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30659.exe
      4⤵
      PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32875.exe
        5⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6121.exe
        6⤵
        
        PID:11184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35072.exe
        6⤵
        
        PID:14752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22869.exe
        6⤵
        
        PID:9212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36312.exe
        5⤵
        
        PID:9432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32715.exe
        5⤵
        
        PID:13760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62027.exe
        5⤵
        
        PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39241.exe
      4⤵
      PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43438.exe
        5⤵
        
        PID:8952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56630.exe
        6⤵
        
        PID:224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62419.exe
        6⤵
        
        PID:9188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62736.exe
        5⤵
        
        PID:10536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18020.exe
        5⤵
        
        PID:15376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
        5⤵
        
        PID:17916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10411.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:4764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26993.exe
      4⤵
      PID:11948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5463.exe
      4⤵
      PID:16988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe
      4⤵
      PID:17784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6901.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6901.exe
    3⤵
    PID:3988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65163.exe
      4⤵
      PID:6156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30190.exe
        5⤵
        
        PID:9760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25472.exe
        5⤵
        
        PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25456.exe
      4⤵
      PID:8728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16851.exe
      4⤵
      PID:13068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62369.exe
      4⤵
      PID:16872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11901.exe
      4⤵
      PID:17664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57253.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57253.exe
    3⤵
    PID:6928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57050.exe
      4⤵
      PID:11548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16152.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16152.exe
      4⤵
      PID:16228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22921.exe
      4⤵
      PID:6704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46236.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46236.exe
    3⤵
    PID:10680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56141.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56141.exe
    3⤵
    PID:14808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44185.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44185.exe
    3⤵
    PID:8756
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34985.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34985.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64675.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64675.exe
    3⤵
    PID:4980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64011.exe
      4⤵
      PID:5944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33158.exe
        5⤵
        
        PID:8004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26696.exe
        6⤵
        
        PID:8592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20516.exe
        5⤵
        
        PID:12668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14399.exe
        5⤵
        
        PID:16828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60355.exe
        5⤵
        
        PID:5112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3344.exe
      4⤵
      PID:8980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15316.exe
      4⤵
      PID:11340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50388.exe
      4⤵
      PID:17340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60903.exe
      4⤵
      PID:17632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13969.exe
    3⤵
    PID:6988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16874.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20324.exe
      4⤵
      PID:14468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26177.exe
      4⤵
      PID:7308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21267.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21267.exe
    3⤵
    PID:9508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38581.exe
    3⤵
    PID:13752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52848.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52848.exe
    3⤵
    PID:17252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15454.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15454.exe
    3⤵
    PID:5452
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52383.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52383.exe
  2⤵
  PID:5284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48827.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48827.exe
    3⤵
    PID:5628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43438.exe
      4⤵
      PID:8920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59525.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59525.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19363.exe
      4⤵
      PID:14940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16482.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16482.exe
      4⤵
      PID:17432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
    3⤵
    PID:4872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45789.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45789.exe
    3⤵
    PID:1340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63287.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63287.exe
    3⤵
    PID:5640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12431.exe
    3⤵
    PID:17824
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17116.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17116.exe
  2⤵
  PID:6504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41534.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41534.exe
    3⤵
    PID:15344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9134.exe
    3⤵
    PID:8052
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29656.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29656.exe
  2⤵
  PID:8636
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37904.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37904.exe
  2⤵
  PID:13332
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20979.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20979.exe
  2⤵
  PID:5428

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3776 -ip 3776
1⤵
PID:4336

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 356 -p 7728 -ip 7728
1⤵
PID:15104

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11509.exe

Filesize
468KB

MD5
8ea2b421a601ce818f6517de83f9720e

SHA1
9a3322a941cee9e28b4ae39e007d18e436fa216f

SHA256
b3981290a8cec305555688a5282db489019348759eb7e726314d7d9b697d280c

SHA512
434043481d193bb2a6dbe33848b3b06b7e309baa7be1b07f6c0b8c3673048ad2c25dd34b39919905582133c3cc6f2cfcbb8328be9fc9e5678748ae15eed83be0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15038.exe

Filesize
468KB

MD5
b578172f688b147056f2f584643f1379

SHA1
025b4b21306a636140eed98065a8819d84fb9b6e

SHA256
785ecbf5dda03e185b115d7e0dbcc69303d8d5155c54f5c223de040ad4e36b36

SHA512
231fc96d955ecfd03361a859b1561312e865a34762d795726ade830b84cd6f41168a2780a969f738559de50257cbd849771e9d5096c496bd0f7671efa09ae4de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15614.exe

Filesize
468KB

MD5
7cecbfd9e2e170e2bd17bba17b3f008c

SHA1
1f26ec55df109d9338fcf4efda46e527bcb51bb3

SHA256
effa3a3b061749a4961e32db8eae928a093f6c0e61331e814b6e4c0e121844b0

SHA512
d41f403d9c700f2ef97c0322ebefa013e4c61a15dec6090a1f8aa4bd1ac5ef913e9ddb8ad2f6d5ced1fa2e40cf969df655529ec9c40c6ddbe4502909cbf9a178

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17321.exe

Filesize
468KB

MD5
a1f81001e9d41ea5f8ae213faba19392

SHA1
b9492305e9776116da4c5c8443e067bfb05f0d6b

SHA256
712ea7f21eee74538a3e47bbca32e2192dbbbffe459418f0904821a5e1147632

SHA512
ca046fd433bca13cfca71ee7988cd37c2fa70c511676e45cad251e6efd3ad76f2d2330c1b9789fbaa2de31938285c3c64e76fffec7455a1794fac4559dcc8033

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19455.exe

Filesize
468KB

MD5
56a98a8a61e6358f2a9e5f898f856853

SHA1
823a7c48a1036f8223830f216ceec14c3878f8e0

SHA256
6c78104c216795a8d8ad200c15dbf9eef287dfebddc0e8e70edc2e8b99ed741c

SHA512
3018025a222d2b6a14da973be07faa988b453260d689a7f8a8fcf7384ec69dd98d367b7fa263bd9757ab8a2603991782fa5889e42f0a9586d6e6179b58758ce4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19699.exe

Filesize
468KB

MD5
9901975615ba8f89d7ec77b5d1d88813

SHA1
7e4c01abd926211ca1820a22aa35c72ab5e909cb

SHA256
d6dcdc159f1ef7ec077551679bdbb6caf9c4138958529aa65ab17f82be082b59

SHA512
81dbc5a8c1d681c129c925c07fdadb41c515e2f4355afe8fb9ea9e5c67f0b99153a4e3c91549e31e104fdb128a7f45b983c4d39b836be7904e881c2108867246

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22784.exe

Filesize
468KB

MD5
7c2ccf11e5bc959e768e487e4328988e

SHA1
68c6979a0e0052ee808b147c4af5ba1248d38ab8

SHA256
126c22f16b8a18fb16f1e69dd72682d0624e0c05f21c68d51ac27f19b6b311a1

SHA512
450c4c60976120e48571f46f03b146965bc0a321305ae7e8d13d9c04fa63f718c09e1ba7f32105f8df4e49ac03f02e0174d2f43a76723915d28c7b4e793ecc48

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24337.exe

Filesize
468KB

MD5
01f8c3c6e6acd8978707a93e28211525

SHA1
d84513df5b0d30bd364b52161f51158fd9ae6e02

SHA256
2cc63cab77bc3887d87aa08c8573a40cd9e37a1a341a638200e052c62833f22a

SHA512
1127f1778c95e519bb09cfeaa5aa150a846b27bb4f810f589d047f952d6087c0dc85d094e5df3256d0b3d9a874fe89d44536c7f35f021d54439310e788586ddc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26589.exe

Filesize
468KB

MD5
e0b87bded4bf77eddf118511ff102269

SHA1
194e0ab3a1c96e7522aea1cba7bffe500debca5a

SHA256
0e8974bd87244ff1604943e6eb59dc150c70f5e2290d737a911ee4bbdb9b9db0

SHA512
a63be939253c9a7c85f9a6ae8ba04d45f62330c10bc51e46b0e6c6b17d93ceffb783cdc75c67b441a7f70d71c4ec33dcdce71643a7a09f9de18e8380efe54c40

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28650.exe

Filesize
468KB

MD5
16d0ec1a218d0048f034ab5e8d1654a8

SHA1
1c3928bd76532ed6bd733fddee2c156fb346f593

SHA256
406570121c778f3fd9f4fe1215ddbb1b8ce9963447f66fa04d633e2dad7873a6

SHA512
bd06d9fb4c7952a51b26b438bc06b5c729125c7383cbf6db3d075758a90c56a767b169f36077067eefa6611e179c5846ea68713a3182530dd710954eec647ee9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28915.exe

Filesize
468KB

MD5
54381ede9ac6133b8dbd98dd08b2334e

SHA1
586005a62ca73cf92b41627426c9a4bfb6131555

SHA256
8691462d2431523407898445ce55b6f7d684bbcc8ba86cab65b1b44f10da6c54

SHA512
75a78a6fc833cc7a0fa182e031b3942c1e0d1ffd40f4c7fcf240babdeb2464d8b37a0a23910e2dfbb025783d37f62c27b4baa1cf4182af94335ca6b2d758048a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30747.exe

Filesize
468KB

MD5
cfe6d36c914d122799309fc1d0c54862

SHA1
e427389f74454820f08bc7f4d230163f653f6b85

SHA256
84e3dd03edbf034931ffb39d3c1a97842e67c31c41a0ef34d551eae0fd1535f3

SHA512
f807f3a95fd997c735defd7e5aea1fa41c0ea61a0af5640767037bbf611d444f2662b9fea64fae4e0134b557df2d6c4726f290f3746466da0461e525818f8edc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30917.exe

Filesize
468KB

MD5
46cdb523399d7f9828d4e6a1c9cabb9e

SHA1
769e33212357bb1ca39635ac8a38a3ef616bfad0

SHA256
8053d056474045037ba3c5401757b3392eccfa015472384c84da147770622f33

SHA512
912cd39ebfd95b306197fed3b80840fd1e39eb64f8eef19e7e9960c54c10287462d63ee822be2dc270c75fb84005afd0d9769e40136c0420c279c544d8aabf58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35001.exe

Filesize
468KB

MD5
7b72c4af7b47b2b22bdc18637b5a1683

SHA1
c7eda6ea3d5f7edb72aa5eea92e7d270491fc653

SHA256
a01fde8c4819fbc7227ebc188eb0adb3df2b5b012caefd68c21a8efddc1709b7

SHA512
3b259a88bc677994bcdd8668505634dc8f1ed85113e9d62d04c876ca4ef96e2411627d303ead5c527103657494ff546312afafdd6c7a059121b67d4cbd88407a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35272.exe

Filesize
468KB

MD5
a1075a7b8be6c8823b46c971278b700a

SHA1
30c18baf128abaf93cab60d959b55a1e93ced47f

SHA256
6f390083a4cf8d0ad3527e42216c09710db9ce4cd4b96acecee1998f0628a6b2

SHA512
1c906d27abb51639e667b5e6d903c160906a82ddab076f9129338c0de85f9b3fa2d855ac4bdf89f95066f93e743d9db1aa2674186327a6240da5e194c3e0e3ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37601.exe

Filesize
468KB

MD5
c94da78f27fc186657516cb0ca6a988b

SHA1
1cce740b082af02265d98e79f1768a701367841e

SHA256
4efc030975186192afe62eee32a507012ca567e07f96d0067905a4b27d99dc92

SHA512
c4bbb501ed1666f9c0b7029ed13fa067684b68f451b0f353f27d5e08865998d829d26d44ba67e64788c3b3d4c86c90214ab71a20bc1edd45e917aefe2ad5ba4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38073.exe

Filesize
468KB

MD5
26d1563d13fb22373417d8d203690de6

SHA1
c03ac21eb9fdab7604dab7c5acabc6e72202a0b5

SHA256
a29edd54c4c14bfe2e2f7a81e21057e86a37398079831adbdf43e9cd47d3da2a

SHA512
092a3ced0c96b08da465744ce558603989f97422d636ae6d5c1c7e96241645dd006275925b39cc0e11c92d8fcd88603ae9b99240ade3ca7e0c4150eaa12a1267

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42371.exe

Filesize
468KB

MD5
621bfc55ea4264f4c9daccfa79ac0fae

SHA1
bdcb2824665c167b3ac3d7bbc059dfd79467583b

SHA256
6648eedf38a7f410a292021dc2f239396fd5cf1a9ef16c10a2e6fbcb9a294bf6

SHA512
41178ef54a1df9949d8dd8977114f2e97bc42cc658c0196d1fd886a069a0a03d21971762c422556b38e11eafeab9fee8ca27452f662064eee31269f72a4bdf7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43938.exe

Filesize
468KB

MD5
69bb74f130aa416d270c4fd5a6f3a3a9

SHA1
4fe87947f9c943b68fe062942d573691ab068f51

SHA256
c94763fee7a88016e9f0e3f09edc4b731362c13418beaeaa861ab68f8882f80c

SHA512
55b693dabd0696bd444f3cecf4a8261443353fa2fb8730921b097712659648baead01a667e01cf6d336ca3116ec25a879093ce60fb6d63487c9dcd5d38a52671

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44203.exe

Filesize
468KB

MD5
7d1a1bd29ddf693ab568076ec5f8943c

SHA1
1ba9a5c5b2afa06a0805595a3f13727631a9ed27

SHA256
4629ac593a06fb853b13a836d040d94fb4778e96c677c205a4534232eb305e91

SHA512
2ed8e7024f11f3ab94f23989fc1f3c43b88921c0f7d2fd7404dd38c3f72fe7eac3db30695c6d38afc4f6b625728cc79d11fa6e825e30de7512c4e57b6701b134

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44409.exe

Filesize
468KB

MD5
2f292f1c795855848cafd42c36ba6bc2

SHA1
b0f4ac617b16c0632ed559869728fd9a5173e5e8

SHA256
f955e2bfd66da0d8de9eba70efe6e5cb9ffc1f70bea709c7c36b545ea1b97ef8

SHA512
204c0b0e5462bab1f7611156b4ca7761fd8ce4bdbae0e800336b66dcfcdb52cffe6cf7f0d19357796597c971bc10354ff1168ce6656084792b2b3a6c36165fd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50539.exe

Filesize
468KB

MD5
11b1a87910730a6375119f5e4e7988b1

SHA1
e099afd9c2e328d6080ae71ec4135b2a8ca176ac

SHA256
5beab01809accf0399355b32f82420da8127e38aa4ae8b8ca972be93dbf5a340

SHA512
b3d0ef8a8e2a85c9925316214dd3682a2d08250259caece8e207f92d4a9aa34f193686b27570bcebf2d414a7d2a04e9fe988e38a77535620b40e88c36b4f539a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50901.exe

Filesize
468KB

MD5
9a5d7a348c9f99bb71b7df09d55ffc1e

SHA1
dc4cb3cc9da1a0f4716726b3d1471d02d7a049d8

SHA256
9144126ac7a1d9e380d5c4f93079fca73054106d7c8e360c8a4e622e67d40614

SHA512
c92cc1e1098914fdcfa126bc3159c103545fd9936231b050783fd9e7c4b10cf2929cccb37f81ceb17e985799adf72afa217ed7cfa249f93ab5e66e0765070609

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54519.exe

Filesize
468KB

MD5
85a3c8e5015e63fad7cc79ce09221d03

SHA1
4ff257d064c899c8b691a8ec016d26d860a45c99

SHA256
e9a31df65baf1808daaf968914a73260482f207addb3599d35a6da644c00c157

SHA512
6dd1e76a9b0d277c580947ffcb3b3ed0c1d9765cbf94258b68405521d6c82e80c738d025c76a816815008595f5c4e0984a0a093a2908d56870d4eb5a30295d8d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54867.exe

Filesize
468KB

MD5
3c722f0ff52ee5bf2c6e305f95e57d77

SHA1
489c958fd204b3c131e346b50acb83812725461d

SHA256
2655f9c738f6f22dfc7c40baef77b2afedca78c5e41082a665f08d068f96d072

SHA512
671509ba8e0c90d70cfb448ab520f6e88721bb915bcc17c31ba4599a3e1e699ec2dd8553e5d8fa8d20396c32a8cb9bef4a27d0ba6f54aa402b5b44fe4b136275

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5541.exe

Filesize
468KB

MD5
6007043403915ec54f54fca8d87a0a4b

SHA1
295b10b460bb51352e03494fb583e5d4041c9226

SHA256
a9dc49f6da508a0a51a4025e8f6203c3864fb5f3715438cf4940b7f598e533c2

SHA512
c23a1631e66e84d1240b199851d1e4737947ac48512b9e9d0f8bbe0efa1a88cc0f0c512cd9d0f01baeefa83e0cf1860554f8dde22b74f9203605592201aac09d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57695.exe

Filesize
468KB

MD5
52564f48b4ccf85f8b666fefb572de23

SHA1
8209cf248fb2a2b8b1dbee514848ac7893398cf1

SHA256
5172dce608cbba13ed23bd42f2ea387597380e76c54ca9b80aa1687ec1e9fbf8

SHA512
8d897430d4d1f0e2a5405f1fe0c3aeba3eceb7688492ef38c452160ccc9d520a5e4ce4aca096b6ab909584719e4adf130408f27edd941e9b88e150d0f6e8bbb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-620.exe

Filesize
468KB

MD5
30708e0bb75e6f70f8de94c9d28d64e6

SHA1
b09d3c53079459f3555671bc8f090886c2d0e8a4

SHA256
915729c5feaebdbf14386b1eaabc16af53290aed4b032b2878e7a043ae4da3c0

SHA512
f0f0329b1e9434792a1adcef04b3bc4b38b00f4c14c5c3a5400cbe1d31e9b8d2932a6251cb93aed6e94e0bd896b6a6f718bced1f42977aa460757c271e15ed6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7446.exe

Filesize
468KB

MD5
8980a3ea9a8038cd093fb19e9e54155b

SHA1
c12923ff6c92c6dafe001eb23e6dd86ddcf9e87b

SHA256
cd2af4f2f2f0355b3e01456dc490d2516af728073b7be23b8eedb28968bed43c

SHA512
4f689524c92d02042cfe985091f677545d2a7a279932ca2aeebb19b213d30119b582a799e1fc4935e976d9d710736c3189a3fbb7e84f37591168dcc71751506d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7757.exe

Filesize
468KB

MD5
5e59dc5d02eb05041e0d3b62244aa37a

SHA1
3879d4e775c68ac8135765bd1a1cde9286aa7595

SHA256
3bda60a6d95b458bb938db4f85b778b796378a659045498dff0292843ec0498f

SHA512
0930f001d905aa3974f1f533072ebe288a01b32c326ae447805a84f3ae013001c2c6773e7c3768cbf52cf8356dc2230c56b6b59055569e8dbc98b109e904afe2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9049.exe

Filesize
468KB

MD5
d52fb36a9c146852e60ce36ed949a813

SHA1
f24b5080d35ea71ced9ee4fb35b3d3da24cbbc34

SHA256
c868f8c70f920917bd930b9940d13571ef1a404e5c852a7ce65a84b456380e52

SHA512
889e9dee7e8d0dfbbdfe9dbf3e361af69d45483430278e8f680b41309c09e237d90d99b1853e08b43f2ad60250de33e9660753206478b5a225369e810b766306

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9070.exe

Filesize
468KB

MD5
77cbc7c708ac49cbdfbdcab491108225

SHA1
1d228e148060928783f008c0b7b3049f8cf6f0c5

SHA256
bdc1cd7e855ea4416caecb371f47622aed71321719f789df25f31c956728a903

SHA512
d23d5328e41fbf0d154f06730bac0802d7d29cbae892b3fbb8861c6d980b90463123f41827fb8752f09e80e0dedb26beb842afccea31ebc725b8d2a136abaf69

Download Submit
memory/14292-2594-0x00007FFE2ED30000-0x00007FFE2EF25000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads