1459f9a9ac33f7f842599a44c8cd4479da3c35a361909caaa7caffc46043c4cd

Analysis

max time kernel
111s
max time network
109s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 11:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1459f9a9ac33f7f842599a44c8cd4479da3c35a361909caaa7caffc46043c4cdN.exe
Size

468KB
MD5

47c7edc5998f7f1815ac48fa137ac490
SHA1

a7d7f528058f66561e933dcb5b1c495f4cc4b9c5
SHA256

1459f9a9ac33f7f842599a44c8cd4479da3c35a361909caaa7caffc46043c4cd
SHA512

6c3e23016c9acea49e17b3b584bf00e58b2307bea84672c81a23f89eb1130415f1fa9c432e7d72b99091620e874ee605a27e6342332ccf22e86b8db6d454f615
SSDEEP

3072:4belogxaIU57tbYZPzcfmbfD/n2DnsIH/QmyeQVuvuUKkni3u3Yl+:4b4oCc7tCP4fmbfra1juUDi3u3

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3160	Unicorn-54183.exe
1228	Unicorn-65366.exe
2344	Unicorn-19695.exe
3576	Unicorn-13638.exe
2392	Unicorn-15676.exe
2572	Unicorn-43571.exe
4064	Unicorn-23705.exe
408	Unicorn-8926.exe
3684	Unicorn-1313.exe
2228	Unicorn-33166.exe
1392	Unicorn-33431.exe
2204	Unicorn-53659.exe
4288	Unicorn-53659.exe
1932	Unicorn-58490.exe
3708	Unicorn-6688.exe
3764	Unicorn-36467.exe
4588	Unicorn-28853.exe
2660	Unicorn-3794.exe
684	Unicorn-7878.exe
832	Unicorn-15284.exe
3964	Unicorn-24215.exe
1680	Unicorn-36275.exe
3760	Unicorn-30144.exe
1940	Unicorn-36010.exe
3968	Unicorn-44443.exe
3376	Unicorn-32745.exe
5004	Unicorn-28661.exe
664	Unicorn-28661.exe
1292	Unicorn-50565.exe
752	Unicorn-56695.exe
388	Unicorn-64022.exe
4128	Unicorn-1822.exe
3720	Unicorn-38387.exe
4512	Unicorn-46555.exe
1992	Unicorn-51386.exe
4080	Unicorn-62189.exe
4260	Unicorn-15034.exe
3220	Unicorn-7421.exe
3176	Unicorn-27287.exe
3520	Unicorn-47515.exe
2244	Unicorn-14577.exe
4476	Unicorn-7229.exe
4000	Unicorn-7229.exe
4736	Unicorn-63659.exe
4776	Unicorn-58806.exe
5092	Unicorn-32295.exe
1800	Unicorn-61075.exe
2012	Unicorn-59029.exe
1156	Unicorn-53462.exe
1036	Unicorn-36187.exe
4856	Unicorn-40271.exe
4904	Unicorn-60883.exe
2924	Unicorn-64967.exe
3284	Unicorn-19851.exe
1596	Unicorn-61438.exe
3788	Unicorn-27064.exe
764	Unicorn-19851.exe
3956	Unicorn-39814.exe
1988	Unicorn-33948.exe
1716	Unicorn-20213.exe
60	Unicorn-33948.exe
1048	Unicorn-40847.exe
1376	Unicorn-55329.exe
3008	Unicorn-40655.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
5536	636	WerFault.exe	156
9992	6484	WerFault.exe	277
9764	6484	WerFault.exe	277

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22236.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28146.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57347.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10305.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15071.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27288.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1765.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15281.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33959.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51566.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48491.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22157.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8034.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-868.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19993.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58496.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55085.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35199.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32057.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50249.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62998.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47811.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27451.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5598.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36802.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14129.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57465.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48603.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21041.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22437.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36962.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39594.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51219.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6486.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9962.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57222.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17656	dwm.exe
Token: SeChangeNotifyPrivilege	17656	dwm.exe
Token: 33	17656	dwm.exe
Token: SeIncBasePriorityPrivilege	17656	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5020	1459f9a9ac33f7f842599a44c8cd4479da3c35a361909caaa7caffc46043c4cdN.exe
3160	Unicorn-54183.exe
1228	Unicorn-65366.exe
2344	Unicorn-19695.exe
3576	Unicorn-13638.exe
2392	Unicorn-15676.exe
2572	Unicorn-43571.exe
4064	Unicorn-23705.exe
408	Unicorn-8926.exe
2228	Unicorn-33166.exe
3684	Unicorn-1313.exe
3708	Unicorn-6688.exe
2204	Unicorn-53659.exe
1392	Unicorn-33431.exe
4288	Unicorn-53659.exe
1932	Unicorn-58490.exe
3764	Unicorn-36467.exe
4588	Unicorn-28853.exe
2660	Unicorn-3794.exe
3760	Unicorn-30144.exe
1680	Unicorn-36275.exe
684	Unicorn-7878.exe
832	Unicorn-15284.exe
1940	Unicorn-36010.exe
3376	Unicorn-32745.exe
664	Unicorn-28661.exe
3964	Unicorn-24215.exe
3968	Unicorn-44443.exe
1292	Unicorn-50565.exe
5004	Unicorn-28661.exe
752	Unicorn-56695.exe
388	Unicorn-64022.exe
4128	Unicorn-1822.exe
3720	Unicorn-38387.exe
4512	Unicorn-46555.exe
1992	Unicorn-51386.exe
4080	Unicorn-62189.exe
4260	Unicorn-15034.exe
3176	Unicorn-27287.exe
3220	Unicorn-7421.exe
3520	Unicorn-47515.exe
2244	Unicorn-14577.exe
4476	Unicorn-7229.exe
4736	Unicorn-63659.exe
4000	Unicorn-7229.exe
5092	Unicorn-32295.exe
4776	Unicorn-58806.exe
1800	Unicorn-61075.exe
2012	Unicorn-59029.exe
1156	Unicorn-53462.exe
1036	Unicorn-36187.exe
4856	Unicorn-40271.exe
4904	Unicorn-60883.exe
1596	Unicorn-61438.exe
2924	Unicorn-64967.exe
3788	Unicorn-27064.exe
764	Unicorn-19851.exe
3956	Unicorn-39814.exe
3284	Unicorn-19851.exe
60	Unicorn-33948.exe
1988	Unicorn-33948.exe
1716	Unicorn-20213.exe
1048	Unicorn-40847.exe
1376	Unicorn-55329.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 3160	5020	1459f9a9ac33f7f842599a44c8cd4479da3c35a361909caaa7caffc46043c4cdN.exe	86
PID 5020 wrote to memory of 3160	5020	1459f9a9ac33f7f842599a44c8cd4479da3c35a361909caaa7caffc46043c4cdN.exe	86
PID 5020 wrote to memory of 3160	5020	1459f9a9ac33f7f842599a44c8cd4479da3c35a361909caaa7caffc46043c4cdN.exe	86
PID 5020 wrote to memory of 1228	5020	1459f9a9ac33f7f842599a44c8cd4479da3c35a361909caaa7caffc46043c4cdN.exe	87
PID 5020 wrote to memory of 1228	5020	1459f9a9ac33f7f842599a44c8cd4479da3c35a361909caaa7caffc46043c4cdN.exe	87
PID 5020 wrote to memory of 1228	5020	1459f9a9ac33f7f842599a44c8cd4479da3c35a361909caaa7caffc46043c4cdN.exe	87
PID 3160 wrote to memory of 2344	3160	Unicorn-54183.exe	88
PID 3160 wrote to memory of 2344	3160	Unicorn-54183.exe	88
PID 3160 wrote to memory of 2344	3160	Unicorn-54183.exe	88
PID 1228 wrote to memory of 3576	1228	Unicorn-65366.exe	89
PID 1228 wrote to memory of 3576	1228	Unicorn-65366.exe	89
PID 1228 wrote to memory of 3576	1228	Unicorn-65366.exe	89
PID 5020 wrote to memory of 2392	5020	1459f9a9ac33f7f842599a44c8cd4479da3c35a361909caaa7caffc46043c4cdN.exe	90
PID 5020 wrote to memory of 2392	5020	1459f9a9ac33f7f842599a44c8cd4479da3c35a361909caaa7caffc46043c4cdN.exe	90
PID 5020 wrote to memory of 2392	5020	1459f9a9ac33f7f842599a44c8cd4479da3c35a361909caaa7caffc46043c4cdN.exe	90
PID 2344 wrote to memory of 2572	2344	Unicorn-19695.exe	91
PID 2344 wrote to memory of 2572	2344	Unicorn-19695.exe	91
PID 2344 wrote to memory of 2572	2344	Unicorn-19695.exe	91
PID 3160 wrote to memory of 4064	3160	Unicorn-54183.exe	92
PID 3160 wrote to memory of 4064	3160	Unicorn-54183.exe	92
PID 3160 wrote to memory of 4064	3160	Unicorn-54183.exe	92
PID 3576 wrote to memory of 408	3576	Unicorn-13638.exe	93
PID 3576 wrote to memory of 408	3576	Unicorn-13638.exe	93
PID 3576 wrote to memory of 408	3576	Unicorn-13638.exe	93
PID 1228 wrote to memory of 3684	1228	Unicorn-65366.exe	94
PID 1228 wrote to memory of 3684	1228	Unicorn-65366.exe	94
PID 1228 wrote to memory of 3684	1228	Unicorn-65366.exe	94
PID 5020 wrote to memory of 2228	5020	1459f9a9ac33f7f842599a44c8cd4479da3c35a361909caaa7caffc46043c4cdN.exe	95
PID 5020 wrote to memory of 2228	5020	1459f9a9ac33f7f842599a44c8cd4479da3c35a361909caaa7caffc46043c4cdN.exe	95
PID 5020 wrote to memory of 2228	5020	1459f9a9ac33f7f842599a44c8cd4479da3c35a361909caaa7caffc46043c4cdN.exe	95
PID 2392 wrote to memory of 1392	2392	Unicorn-15676.exe	96
PID 2392 wrote to memory of 1392	2392	Unicorn-15676.exe	96
PID 2392 wrote to memory of 1392	2392	Unicorn-15676.exe	96
PID 2572 wrote to memory of 2204	2572	Unicorn-43571.exe	97
PID 2572 wrote to memory of 2204	2572	Unicorn-43571.exe	97
PID 2572 wrote to memory of 2204	2572	Unicorn-43571.exe	97
PID 4064 wrote to memory of 4288	4064	Unicorn-23705.exe	98
PID 4064 wrote to memory of 4288	4064	Unicorn-23705.exe	98
PID 4064 wrote to memory of 4288	4064	Unicorn-23705.exe	98
PID 2344 wrote to memory of 1932	2344	Unicorn-19695.exe	99
PID 2344 wrote to memory of 1932	2344	Unicorn-19695.exe	99
PID 2344 wrote to memory of 1932	2344	Unicorn-19695.exe	99
PID 3160 wrote to memory of 3708	3160	Unicorn-54183.exe	100
PID 3160 wrote to memory of 3708	3160	Unicorn-54183.exe	100
PID 3160 wrote to memory of 3708	3160	Unicorn-54183.exe	100
PID 408 wrote to memory of 3764	408	Unicorn-8926.exe	101
PID 408 wrote to memory of 3764	408	Unicorn-8926.exe	101
PID 408 wrote to memory of 3764	408	Unicorn-8926.exe	101
PID 3576 wrote to memory of 4588	3576	Unicorn-13638.exe	102
PID 3576 wrote to memory of 4588	3576	Unicorn-13638.exe	102
PID 3576 wrote to memory of 4588	3576	Unicorn-13638.exe	102
PID 2228 wrote to memory of 2660	2228	Unicorn-33166.exe	103
PID 2228 wrote to memory of 2660	2228	Unicorn-33166.exe	103
PID 2228 wrote to memory of 2660	2228	Unicorn-33166.exe	103
PID 3708 wrote to memory of 684	3708	Unicorn-6688.exe	104
PID 3708 wrote to memory of 684	3708	Unicorn-6688.exe	104
PID 3708 wrote to memory of 684	3708	Unicorn-6688.exe	104
PID 5020 wrote to memory of 832	5020	1459f9a9ac33f7f842599a44c8cd4479da3c35a361909caaa7caffc46043c4cdN.exe	105
PID 5020 wrote to memory of 832	5020	1459f9a9ac33f7f842599a44c8cd4479da3c35a361909caaa7caffc46043c4cdN.exe	105
PID 5020 wrote to memory of 832	5020	1459f9a9ac33f7f842599a44c8cd4479da3c35a361909caaa7caffc46043c4cdN.exe	105
PID 2204 wrote to memory of 3964	2204	Unicorn-53659.exe	106
PID 2204 wrote to memory of 3964	2204	Unicorn-53659.exe	106
PID 2204 wrote to memory of 3964	2204	Unicorn-53659.exe	106
PID 3160 wrote to memory of 1940	3160	Unicorn-54183.exe	109

C:\Users\Admin\AppData\Local\Temp\1459f9a9ac33f7f842599a44c8cd4479da3c35a361909caaa7caffc46043c4cdN.exe
"C:\Users\Admin\AppData\Local\Temp\1459f9a9ac33f7f842599a44c8cd4479da3c35a361909caaa7caffc46043c4cdN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54183.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54183.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19695.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19695.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43571.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53659.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24215.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60883.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2694.exe
        8⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57043.exe
        9⤵
        
        PID:7032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44363.exe
        10⤵
        
        PID:8700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23243.exe
        11⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19174.exe
        11⤵
        
        PID:18300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50362.exe
        10⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37829.exe
        10⤵
        
        PID:16736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14270.exe
        10⤵
        
        PID:18536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18405.exe
        9⤵
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5716.exe
        9⤵
        
        PID:12376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59210.exe
        9⤵
        
        PID:17256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49274.exe
        9⤵
        
        PID:4500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39481.exe
        8⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51549.exe
        8⤵
        
        PID:10488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39506.exe
        8⤵
        
        PID:14956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65034.exe
        8⤵
        
        PID:16348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15117.exe
        7⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-250.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22703.exe
        9⤵
        
        PID:9400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13553.exe
        9⤵
        
        PID:13476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30952.exe
        9⤵
        
        PID:16472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6294.exe
        9⤵
        
        PID:18308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31809.exe
        8⤵
        
        PID:9836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
        8⤵
        
        PID:13284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61961.exe
        7⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23243.exe
        8⤵
        
        PID:11456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39786.exe
        8⤵
        
        PID:18456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25702.exe
        7⤵
        
        PID:10912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40545.exe
        7⤵
        
        PID:14596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61438.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43343.exe
        7⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8610.exe
        8⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19475.exe
        9⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19993.exe
        9⤵
        
        PID:13016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7844.exe
        9⤵
        
        PID:16548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20481.exe
        9⤵
        
        PID:16800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61858.exe
        9⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51566.exe
        8⤵
        
        PID:15288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38750.exe
        8⤵
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52502.exe
        7⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8442.exe
        8⤵
        
        PID:14792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        7⤵
        
        PID:11656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22236.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62235.exe
        7⤵
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62677.exe
        6⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1594.exe
        7⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23243.exe
        8⤵
        
        PID:4952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6922.exe
        8⤵
        
        PID:18384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54777.exe
        7⤵
        
        PID:10356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30326.exe
        7⤵
        
        PID:15608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20633.exe
        7⤵
        
        PID:8
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21373.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63845.exe
        6⤵
        
        PID:11388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18337.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1978.exe
        6⤵
        
        PID:796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43125.exe
        6⤵
        
        PID:18816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28661.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40271.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63571.exe
        7⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45559.exe
        8⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52147.exe
        9⤵
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15525.exe
        9⤵
        
        PID:11860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3184.exe
        9⤵
        
        PID:17304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22297.exe
        8⤵
        
        PID:9980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60153.exe
        8⤵
        
        PID:12476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1640.exe
        8⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42738.exe
        8⤵
        
        PID:17780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22908.exe
        7⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27711.exe
        8⤵
        
        PID:15092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39246.exe
        8⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35946.exe
        7⤵
        
        PID:10676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50249.exe
        7⤵
        
        PID:15708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20434.exe
        7⤵
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61194.exe
        6⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17555.exe
        7⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39667.exe
        8⤵
        
        PID:13208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5977.exe
        8⤵
        
        PID:17300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52910.exe
        7⤵
        
        PID:11460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58285.exe
        7⤵
        
        PID:16372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10305.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42746.exe
        7⤵
        
        PID:18068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26792.exe
        6⤵
        
        PID:8444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33381.exe
        6⤵
        
        PID:12568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33948.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6202.exe
        6⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45559.exe
        7⤵
        
        PID:6128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5494.exe
        8⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20709.exe
        8⤵
        
        PID:13764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56933.exe
        8⤵
        
        PID:17276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-398.exe
        8⤵
        
        PID:17952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61830.exe
        7⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42665.exe
        7⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50850.exe
        7⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1640.exe
        7⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34570.exe
        7⤵
        
        PID:17764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39673.exe
        6⤵
        
        PID:6976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18632.exe
        6⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39667.exe
        7⤵
        
        PID:13192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5977.exe
        7⤵
        
        PID:17352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35946.exe
        6⤵
        
        PID:10456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50249.exe
        6⤵
        
        PID:15716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9666.exe
        6⤵
        
        PID:16952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55906.exe
        5⤵
        
        PID:5856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44363.exe
        6⤵
        
        PID:8688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13116.exe
        6⤵
        
        PID:13220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18136.exe
        5⤵
        
        PID:8388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49421.exe
        5⤵
        
        PID:11904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19798.exe
        5⤵
        
        PID:15932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57769.exe
        5⤵
        
        PID:5244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58490.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56695.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64967.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54178.exe
        7⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18131.exe
        8⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9137.exe
        8⤵
        
        PID:11580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37481.exe
        8⤵
        
        PID:15476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51219.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37849.exe
        7⤵
        
        PID:8984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51078.exe
        7⤵
        
        PID:12552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13404.exe
        7⤵
        
        PID:16068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36305.exe
        6⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21639.exe
        7⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37851.exe
        8⤵
        
        PID:14560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49681.exe
        7⤵
        
        PID:12156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9049.exe
        7⤵
        
        PID:17336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8957.exe
        7⤵
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41357.exe
        6⤵
        
        PID:8272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41758.exe
        6⤵
        
        PID:11840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15184.exe
        6⤵
        
        PID:16364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4482.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20213.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14562.exe
        6⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51947.exe
        7⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23243.exe
        8⤵
        
        PID:9764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27342.exe
        8⤵
        
        PID:18396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11145.exe
        7⤵
        
        PID:11256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57133.exe
        7⤵
        
        PID:15916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56543.exe
        7⤵
        
        PID:15408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58950.exe
        6⤵
        
        PID:7924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17444.exe
        6⤵
        
        PID:11492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43538.exe
        6⤵
        
        PID:16188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50841.exe
        6⤵
        
        PID:5104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42354.exe
        6⤵
        
        PID:18548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25536.exe
        5⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38359.exe
        6⤵
        
        PID:8176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22157.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57709.exe
        6⤵
        
        PID:16380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22631.exe
        6⤵
        
        PID:17824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49029.exe
        5⤵
        
        PID:9252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14969.exe
        5⤵
        
        PID:2168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21288.exe
        5⤵
        
        PID:16212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-406.exe
        5⤵
        
        PID:18180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50565.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59487.exe
        6⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-634.exe
        7⤵
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53875.exe
        8⤵
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20569.exe
        8⤵
        
        PID:13240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42594.exe
        8⤵
        
        PID:16500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32413.exe
        8⤵
        
        PID:19224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44638.exe
        7⤵
        
        PID:9944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56993.exe
        7⤵
        
        PID:14256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20481.exe
        7⤵
        
        PID:17328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7421.exe
        7⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51926.exe
        6⤵
        
        PID:5056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15390.exe
        7⤵
        
        PID:8952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33959.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46138.exe
        8⤵
        
        PID:15152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31477.exe
        7⤵
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16204.exe
        7⤵
        
        PID:15576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29016.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33154.exe
        6⤵
        
        PID:13508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28152.exe
        6⤵
        
        PID:16792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22598.exe
        6⤵
        
        PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61194.exe
        5⤵
        
        PID:5712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24711.exe
        6⤵
        
        PID:9208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19993.exe
        6⤵
        
        PID:12932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20936.exe
        5⤵
        
        PID:8376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9085.exe
        5⤵
        
        PID:11916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19268.exe
        5⤵
        
        PID:15580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49790.exe
        5⤵
        
        PID:17432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39814.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54178.exe
        5⤵
        
        PID:6344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60507.exe
        6⤵
        
        PID:8720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18841.exe
        6⤵
        
        PID:12220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14668.exe
        6⤵
        
        PID:16852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17622.exe
        6⤵
        
        PID:18096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33764.exe
        5⤵
        
        PID:9000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30658.exe
        5⤵
        
        PID:12628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13404.exe
        5⤵
        
        PID:16224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57959.exe
        5⤵
        
        PID:18152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6592.exe
      4⤵
      PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13846.exe
        5⤵
        
        PID:7356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46351.exe
        6⤵
        
        PID:14832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45598.exe
        5⤵
        
        PID:10648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55213.exe
        5⤵
        
        PID:14684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13730.exe
        5⤵
        
        PID:6928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53350.exe
      4⤵
      PID:6236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63263.exe
        5⤵
        
        PID:15936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21374.exe
        5⤵
        
        PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15174.exe
      4⤵
      PID:11500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13872.exe
      4⤵
      PID:16276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48350.exe
      4⤵
      PID:3012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23705.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23705.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53659.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36275.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15034.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49591.exe
        7⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16099.exe
        8⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13470.exe
        9⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49681.exe
        9⤵
        
        PID:12292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62334.exe
        9⤵
        
        PID:17356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45714.exe
        9⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35109.exe
        8⤵
        
        PID:9728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40170.exe
        8⤵
        
        PID:12364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19024.exe
        8⤵
        
        PID:1536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1794.exe
        8⤵
        
        PID:16612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25256.exe
        7⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4461.exe
        8⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54882.exe
        8⤵
        
        PID:14736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28146.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39865.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2170.exe
        7⤵
        
        PID:2356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33997.exe
        7⤵
        
        PID:18116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1137.exe
        6⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44495.exe
        7⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12245.exe
        8⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35317.exe
        8⤵
        
        PID:12164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31442.exe
        8⤵
        
        PID:16684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53882.exe
        8⤵
        
        PID:17644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35109.exe
        7⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40170.exe
        7⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50642.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27708.exe
        7⤵
        
        PID:19228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12044.exe
        6⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9682.exe
        7⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42141.exe
        7⤵
        
        PID:13420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10305.exe
        7⤵
        
        PID:15400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42746.exe
        7⤵
        
        PID:18084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46366.exe
        6⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23383.exe
        7⤵
        
        PID:15424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        7⤵
        
        PID:18724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31504.exe
        6⤵
        
        PID:13256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51371.exe
        6⤵
        
        PID:4200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42165.exe
        6⤵
        
        PID:18188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7229.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5434.exe
        6⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
        7⤵
        
        PID:6892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14129.exe
        8⤵
        
        PID:10116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35687.exe
        9⤵
        
        PID:14972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40642.exe
        9⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51566.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55278.exe
        8⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
        7⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51566.exe
        7⤵
        
        PID:15328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22989.exe
        7⤵
        
        PID:3732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        6⤵
        
        PID:7944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35946.exe
        6⤵
        
        PID:10336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50249.exe
        6⤵
        
        PID:15648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46557.exe
        6⤵
        
        PID:1208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39192.exe
        6⤵
        
        PID:18128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37213.exe
        5⤵
        
        PID:4376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35471.exe
        6⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17939.exe
        7⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20709.exe
        7⤵
        
        PID:13740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56933.exe
        7⤵
        
        PID:17332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40470.exe
        7⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61830.exe
        6⤵
        
        PID:8620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54882.exe
        6⤵
        
        PID:14728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45678.exe
        5⤵
        
        PID:6792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18567.exe
        6⤵
        
        PID:10208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46138.exe
        6⤵
        
        PID:14788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64509.exe
        5⤵
        
        PID:10304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25405.exe
        5⤵
        
        PID:15004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17930.exe
        5⤵
        
        PID:16128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45878.exe
        5⤵
        
        PID:7840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28661.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19851.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63955.exe
        6⤵
        
        PID:1660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8034.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27259.exe
        8⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62599.exe
        9⤵
        
        PID:16520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20657.exe
        9⤵
        
        PID:808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21860.exe
        8⤵
        
        PID:12908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9697.exe
        7⤵
        
        PID:8264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34304.exe
        7⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27690.exe
        7⤵
        
        PID:16504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63166.exe
        7⤵
        
        PID:18220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10656.exe
        6⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48603.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35946.exe
        6⤵
        
        PID:10956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50249.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31534.exe
        6⤵
        
        PID:15340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48942.exe
        5⤵
        
        PID:5676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57235.exe
        6⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-590.exe
        7⤵
        
        PID:9304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20569.exe
        7⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59314.exe
        7⤵
        
        PID:15472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14541.exe
        7⤵
        
        PID:19136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15089.exe
        6⤵
        
        PID:9420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27062.exe
        6⤵
        
        PID:15212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38750.exe
        6⤵
        
        PID:652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45049.exe
        5⤵
        
        PID:6708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7030.exe
        6⤵
        
        PID:9012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27201.exe
        6⤵
        
        PID:12668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16204.exe
        6⤵
        
        PID:16708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34882.exe
        5⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52423.exe
        6⤵
        
        PID:17724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24488.exe
        5⤵
        
        PID:13816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47102.exe
        5⤵
        
        PID:4444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33948.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:60
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59487.exe
        5⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27997.exe
        6⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35199.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6169.exe
        7⤵
        
        PID:16940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14408.exe
        6⤵
        
        PID:10820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49210.exe
        6⤵
        
        PID:14708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1912.exe
        5⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43648.exe
        6⤵
        
        PID:18440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35946.exe
        5⤵
        
        PID:10608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50249.exe
        5⤵
        
        PID:15768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41129.exe
        5⤵
        
        PID:13348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18771.exe
        5⤵
        
        PID:17972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36446.exe
      4⤵
      PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1594.exe
        5⤵
        
        PID:7448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60087.exe
        6⤵
        
        PID:13264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26188.exe
        5⤵
        
        PID:3384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59106.exe
        5⤵
        
        PID:15524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28801.exe
        5⤵
        
        PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24960.exe
      4⤵
      PID:7516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47309.exe
      4⤵
      PID:11400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35403.exe
      4⤵
      PID:16236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18325.exe
      4⤵
      PID:4456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6688.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6688.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7878.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27287.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46851.exe
        6⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58823.exe
        7⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44939.exe
        8⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19993.exe
        8⤵
        
        PID:12952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49578.exe
        7⤵
        
        PID:8232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33728.exe
        7⤵
        
        PID:13008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7908.exe
        6⤵
        
        PID:7212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57222.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55153.exe
        6⤵
        
        PID:14356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46246.exe
        6⤵
        
        PID:18856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2289.exe
        5⤵
        
        PID:1408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54547.exe
        6⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14129.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51566.exe
        7⤵
        
        PID:15280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17945.exe
        7⤵
        
        PID:1640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33049.exe
        6⤵
        
        PID:8664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33728.exe
        6⤵
        
        PID:12976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9688.exe
        5⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36195.exe
        6⤵
        
        PID:8640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13116.exe
        6⤵
        
        PID:13228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25578.exe
        6⤵
        
        PID:17276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38006.exe
        5⤵
        
        PID:9872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2916.exe
        5⤵
        
        PID:13164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58195.exe
        5⤵
        
        PID:10596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30105.exe
        5⤵
        
        PID:17892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7229.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62803.exe
        5⤵
        
        PID:1868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-442.exe
        6⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53875.exe
        7⤵
        
        PID:9316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20569.exe
        7⤵
        
        PID:11376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30534.exe
        7⤵
        
        PID:4060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59082.exe
        7⤵
        
        PID:1200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19941.exe
        6⤵
        
        PID:10212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56993.exe
        6⤵
        
        PID:14264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48418.exe
        5⤵
        
        PID:7620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        5⤵
        
        PID:11292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17384.exe
        5⤵
        
        PID:15964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22629.exe
        5⤵
        
        PID:15412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49273.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49273.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57619.exe
        5⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57347.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19557.exe
        5⤵
        
        PID:9888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37804.exe
        5⤵
        
        PID:15828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20050.exe
        5⤵
        
        PID:4608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47406.exe
      4⤵
      PID:7532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60087.exe
        5⤵
        
        PID:12184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23657.exe
        5⤵
        
        PID:16512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61961.exe
      4⤵
      PID:10700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11949.exe
      4⤵
      PID:15168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36187.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60063.exe
        5⤵
        
        PID:1424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8610.exe
        6⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2474.exe
        7⤵
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42873.exe
        7⤵
        
        PID:13588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56698.exe
        6⤵
        
        PID:9620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35997.exe
        6⤵
        
        PID:13544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44334.exe
        5⤵
        
        PID:7660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37031.exe
        6⤵
        
        PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        5⤵
        
        PID:11300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17384.exe
        5⤵
        
        PID:15972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28218.exe
        5⤵
        
        PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52066.exe
      4⤵
      PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8034.exe
        5⤵
        
        PID:6872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27451.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23117.exe
        6⤵
        
        PID:12692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16204.exe
        6⤵
        
        PID:16596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17622.exe
        6⤵
        
        PID:18344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53662.exe
        5⤵
        
        PID:8500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33728.exe
        5⤵
        
        PID:13000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49325.exe
      4⤵
      PID:7132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39231.exe
        5⤵
        
        PID:8560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13553.exe
        5⤵
        
        PID:13464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30952.exe
        5⤵
        
        PID:16492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44010.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44010.exe
      4⤵
      PID:10376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21520.exe
      4⤵
      PID:14796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27064.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27064.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22539.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22539.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41091.exe
        5⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53875.exe
        6⤵
        
        PID:9328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20569.exe
        6⤵
        
        PID:12444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6221.exe
        6⤵
        
        PID:4268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63166.exe
        6⤵
        
        PID:18168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32193.exe
        5⤵
        
        PID:10232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56993.exe
        5⤵
        
        PID:14240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exe
      4⤵
      PID:7728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64761.exe
      4⤵
      PID:10868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37150.exe
      4⤵
      PID:15052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63166.exe
      4⤵
      PID:18228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15329.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15329.exe
    3⤵
    PID:1616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13846.exe
      4⤵
      PID:7500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39667.exe
        5⤵
        
        PID:12176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3237.exe
        5⤵
        
        PID:17380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54290.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:19280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42857.exe
      4⤵
      PID:10876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43345.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43345.exe
      4⤵
      PID:12412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13238.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13238.exe
    3⤵
    PID:2412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exe
      4⤵
      PID:16976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42844.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42844.exe
    3⤵
    PID:11368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8537.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8537.exe
    3⤵
    PID:16304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64611.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64611.exe
    3⤵
    PID:5884
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65366.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65366.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13638.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13638.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8926.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36467.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1822.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40655.exe
        7⤵
        Executes dropped EXE
        
        PID:3008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15522.exe
        8⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1594.exe
        9⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18967.exe
        10⤵
        
        PID:4960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31426.exe
        10⤵
        
        PID:18660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51026.exe
        9⤵
        
        PID:10844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43345.exe
        9⤵
        
        PID:14532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46698.exe
        8⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1108.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43538.exe
        8⤵
        
        PID:16256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47302.exe
        8⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33181.exe
        7⤵
        
        PID:4796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51955.exe
        8⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27201.exe
        8⤵
        
        PID:12660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16204.exe
        8⤵
        
        PID:16744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25022.exe
        7⤵
        
        PID:9360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18583.exe
        8⤵
        
        PID:14696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31504.exe
        7⤵
        
        PID:12408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51371.exe
        7⤵
        
        PID:3240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1133.exe
        7⤵
        
        PID:17904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49570.exe
        6⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3078.exe
        7⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61511.exe
        8⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27711.exe
        9⤵
        
        PID:15080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62599.exe
        9⤵
        
        PID:15484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31809.exe
        8⤵
        
        PID:9972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
        8⤵
        
        PID:13260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44334.exe
        7⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exe
        8⤵
        
        PID:17252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45.exe
        8⤵
        
        PID:18876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60642.exe
        7⤵
        
        PID:9296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29444.exe
        7⤵
        
        PID:15992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18514.exe
        7⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34664.exe
        6⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28847.exe
        7⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60855.exe
        8⤵
        
        PID:13180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11373.exe
        8⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16345.exe
        7⤵
        
        PID:10680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53049.exe
        7⤵
        
        PID:15692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25215.exe
        7⤵
        
        PID:6292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47222.exe
        6⤵
        
        PID:8280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33092.exe
        6⤵
        
        PID:11820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62878.exe
        6⤵
        
        PID:1956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9487.exe
        6⤵
        
        PID:18056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51386.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9326.exe
        6⤵
        
        PID:4448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15138.exe
        7⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29799.exe
        8⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49791.exe
        9⤵
        
        PID:9560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20569.exe
        9⤵
        
        PID:13292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34011.exe
        9⤵
        
        PID:16480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28109.exe
        8⤵
        
        PID:8588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56993.exe
        8⤵
        
        PID:14272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56586.exe
        7⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        7⤵
        
        PID:11664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22236.exe
        7⤵
        
        PID:15836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49790.exe
        7⤵
        
        PID:18236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61770.exe
        6⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26107.exe
        7⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34151.exe
        8⤵
        
        PID:14224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45998.exe
        8⤵
        
        PID:16712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21041.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:18884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57465.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22069.exe
        7⤵
        
        PID:15452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32804.exe
        6⤵
        
        PID:8540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16869.exe
        6⤵
        
        PID:12136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27052.exe
        6⤵
        
        PID:16564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37346.exe
        6⤵
        
        PID:17620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11364.exe
        5⤵
        
        PID:2300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3078.exe
        6⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40899.exe
        7⤵
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60087.exe
        8⤵
        
        PID:11888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31809.exe
        7⤵
        
        PID:9896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
        7⤵
        
        PID:10152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27805.exe
        6⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11478.exe
        7⤵
        
        PID:16804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16050.exe
        7⤵
        
        PID:19180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        6⤵
        
        PID:11284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45973.exe
        6⤵
        
        PID:15868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29562.exe
        6⤵
        
        PID:6736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44230.exe
        5⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21639.exe
        6⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29260.exe
        6⤵
        
        PID:12212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9049.exe
        6⤵
        
        PID:17364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11816.exe
        6⤵
        
        PID:16232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3906.exe
        6⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30004.exe
        5⤵
        
        PID:8548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57206.exe
        5⤵
        
        PID:12128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27583.exe
        5⤵
        
        PID:16600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53493.exe
        5⤵
        
        PID:18248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28853.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46555.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62611.exe
        6⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47811.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58963.exe
        8⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25791.exe
        9⤵
        
        PID:12928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9033.exe
        8⤵
        
        PID:10600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62037.exe
        8⤵
        
        PID:13416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10378.exe
        8⤵
        
        PID:18264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26085.exe
        7⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1108.exe
        7⤵
        
        PID:11424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43538.exe
        7⤵
        
        PID:16284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47302.exe
        7⤵
        
        PID:1236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45626.exe
        6⤵
        
        PID:4620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1594.exe
        7⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22437.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31284.exe
        7⤵
        
        PID:15040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5562.exe
        7⤵
        
        PID:4604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27760.exe
        6⤵
        
        PID:7344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20569.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34680.exe
        6⤵
        
        PID:15468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18514.exe
        6⤵
        
        PID:404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54998.exe
        5⤵
        
        PID:4452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61599.exe
        6⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50611.exe
        7⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62931.exe
        8⤵
        
        PID:13652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45894.exe
        7⤵
        
        PID:11608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25036.exe
        7⤵
        
        PID:15704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63471.exe
        7⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27621.exe
        6⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35893.exe
        6⤵
        
        PID:11848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17009.exe
        6⤵
        
        PID:13340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50642.exe
        6⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59804.exe
        6⤵
        
        PID:17740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55085.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41047.exe
        6⤵
        
        PID:7632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19993.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20481.exe
        6⤵
        
        PID:16720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28609.exe
        6⤵
        
        PID:2664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38670.exe
        5⤵
        
        PID:8524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-881.exe
        6⤵
        
        PID:12112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47274.exe
        6⤵
        
        PID:17820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36.exe
        5⤵
        
        PID:12104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31129.exe
        5⤵
        
        PID:16644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17847.exe
        5⤵
        
        PID:6112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62189.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-774.exe
        5⤵
        
        PID:1356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65299.exe
        6⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29371.exe
        7⤵
        
        PID:9604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20569.exe
        7⤵
        
        PID:13700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59733.exe
        7⤵
        
        PID:16812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60243.exe
        7⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35109.exe
        6⤵
        
        PID:9704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40170.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25753.exe
        6⤵
        
        PID:16512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27272.exe
        6⤵
        
        PID:18124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42117.exe
        5⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9962.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-969.exe
        6⤵
        
        PID:11552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37481.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25983.exe
        6⤵
        
        PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25788.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58670.exe
        5⤵
        
        PID:9992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7592.exe
        5⤵
        
        PID:17072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41430.exe
        5⤵
        
        PID:17596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49326.exe
      4⤵
      PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28543.exe
        5⤵
        
        PID:3588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62863.exe
        6⤵
        
        PID:7496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21005.exe
        6⤵
        
        PID:11704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25036.exe
        6⤵
        
        PID:15752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14462.exe
        6⤵
        
        PID:18280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7201.exe
        5⤵
        
        PID:8368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3220.exe
        5⤵
        
        PID:11900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27934.exe
        5⤵
        
        PID:15824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62434.exe
        5⤵
        
        PID:2600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32440.exe
      4⤵
      PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52339.exe
        5⤵
        
        PID:8708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58530.exe
        5⤵
        
        PID:12188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25576.exe
        5⤵
        
        PID:16664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54379.exe
        5⤵
        
        PID:7116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59738.exe
      4⤵
      PID:8760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1718.exe
      4⤵
      PID:12264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56404.exe
      4⤵
      PID:16864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27546.exe
      4⤵
      PID:17608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1313.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1313.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64022.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40847.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56555.exe
        6⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4526.exe
        7⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23559.exe
        8⤵
        
        PID:8924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35561.exe
        8⤵
        
        PID:12532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16204.exe
        8⤵
        
        PID:15908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
        7⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51566.exe
        7⤵
        
        PID:15304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9969.exe
        7⤵
        
        PID:1636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51926.exe
        6⤵
        
        PID:4976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9682.exe
        7⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50502.exe
        7⤵
        
        PID:13448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30534.exe
        7⤵
        
        PID:16520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5797.exe
        7⤵
        
        PID:18372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14024.exe
        6⤵
        
        PID:10320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50606.exe
        6⤵
        
        PID:14924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22598.exe
        6⤵
        
        PID:944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40581.exe
        5⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54879.exe
        6⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4705.exe
        7⤵
        
        PID:17808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49682.exe
        6⤵
        
        PID:10632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62037.exe
        6⤵
        
        PID:13200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6486.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19592.exe
        5⤵
        
        PID:7472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6973.exe
        5⤵
        
        PID:11416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34872.exe
        5⤵
        
        PID:16200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25945.exe
        5⤵
        
        PID:16236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44236.exe
        5⤵
        
        PID:18784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55329.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47126.exe
        5⤵
        
        PID:6400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64591.exe
        6⤵
        
        PID:8744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56558.exe
        6⤵
        
        PID:11848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56469.exe
        6⤵
        
        PID:17292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1094.exe
        6⤵
        
        PID:17584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63313.exe
        5⤵
        
        PID:8228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39594.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62413.exe
        5⤵
        
        PID:16412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40530.exe
      4⤵
      PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24563.exe
        5⤵
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10258.exe
        6⤵
        
        PID:9748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41949.exe
        6⤵
        
        PID:13616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59733.exe
        6⤵
        
        PID:4876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53227.exe
        6⤵
        
        PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31809.exe
        5⤵
        
        PID:9916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15768.exe
        5⤵
        
        PID:13236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51185.exe
      4⤵
      PID:7568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1478.exe
        5⤵
        
        PID:14392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45425.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45425.exe
      4⤵
      PID:10904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29015.exe
      4⤵
      PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58693.exe
      4⤵
      PID:18500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30144.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30144.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47515.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26431.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44687.exe
        6⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21639.exe
        7⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2718.exe
        8⤵
        
        PID:11544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54986.exe
        8⤵
        
        PID:17372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49681.exe
        7⤵
        
        PID:12028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9049.exe
        7⤵
        
        PID:17344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35109.exe
        6⤵
        
        PID:9712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40170.exe
        6⤵
        
        PID:12336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17834.exe
        6⤵
        
        PID:17392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21505.exe
        5⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21439.exe
        6⤵
        
        PID:2320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24239.exe
        7⤵
        
        PID:10348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64254.exe
        7⤵
        
        PID:14668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20709.exe
        6⤵
        
        PID:10248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
        6⤵
        
        PID:14536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41541.exe
        5⤵
        
        PID:7520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5089.exe
        5⤵
        
        PID:11020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40545.exe
        5⤵
        
        PID:14676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38853.exe
      4⤵
      PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35855.exe
        5⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62863.exe
        6⤵
        
        PID:7508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20709.exe
        6⤵
        
        PID:13772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45302.exe
        5⤵
        
        PID:8776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6714.exe
        6⤵
        
        PID:13356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15666.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:19376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63469.exe
        5⤵
        
        PID:12396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26730.exe
        5⤵
        
        PID:16420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12849.exe
        5⤵
        
        PID:18520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44089.exe
      4⤵
      PID:6668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54067.exe
        5⤵
        
        PID:9220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18620.exe
        6⤵
        
        PID:7020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20569.exe
        5⤵
        
        PID:804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10305.exe
        5⤵
        
        PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5797.exe
        5⤵
        
        PID:5408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64238.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64238.exe
      4⤵
      PID:9932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54193.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54193.exe
      4⤵
      PID:14296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60818.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60818.exe
      4⤵
      PID:15600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34916.exe
      4⤵
      PID:18032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14577.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14577.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54443.exe
      4⤵
      PID:2692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
        5⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13854.exe
        6⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48899.exe
        7⤵
        
        PID:3344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3606.exe
        7⤵
        
        PID:19152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20709.exe
        6⤵
        
        PID:13756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56933.exe
        6⤵
        
        PID:1708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63159.exe
        6⤵
        
        PID:18896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12296.exe
        5⤵
        
        PID:9520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61550.exe
        5⤵
        
        PID:13608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56933.exe
        5⤵
        
        PID:17272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28026.exe
        5⤵
        
        PID:5548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31313.exe
      4⤵
      PID:6972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9682.exe
        5⤵
        
        PID:10004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42141.exe
        5⤵
        
        PID:13428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10305.exe
        5⤵
        
        PID:372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51106.exe
        5⤵
        
        PID:17864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1772.exe
      4⤵
      PID:10312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18317.exe
      4⤵
      PID:14688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46473.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46473.exe
    3⤵
    PID:5236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40899.exe
      4⤵
      PID:4680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25287.exe
        5⤵
        
        PID:9596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20569.exe
        5⤵
        
        PID:12940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10305.exe
        5⤵
        
        PID:16532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17665.exe
        5⤵
        
        PID:18624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15857.exe
      4⤵
      PID:9372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52717.exe
      4⤵
      PID:12904
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29989.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29989.exe
    3⤵
    PID:7124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41047.exe
      4⤵
      PID:7988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19993.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19993.exe
      4⤵
      PID:12984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20481.exe
      4⤵
      PID:16836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49030.exe
      4⤵
      PID:6560
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22662.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22662.exe
    3⤵
    PID:8788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3488.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3488.exe
    3⤵
    PID:13496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe
    3⤵
    PID:17084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34870.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34870.exe
    3⤵
    PID:5608
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15676.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15676.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33431.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33431.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44443.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61075.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55595.exe
        6⤵
        
        PID:1224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48491.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13854.exe
        8⤵
        
        PID:940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20709.exe
        8⤵
        
        PID:13680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56933.exe
        8⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7606.exe
        8⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8545.exe
        7⤵
        
        PID:3040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42665.exe
        7⤵
        
        PID:12688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14477.exe
        7⤵
        
        PID:4656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35042.exe
        7⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1912.exe
        6⤵
        
        PID:5892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35946.exe
        6⤵
        
        PID:9736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50249.exe
        6⤵
        
        PID:15640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36962.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32413.exe
        5⤵
        
        PID:5640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31335.exe
        6⤵
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54777.exe
        6⤵
        
        PID:10408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62998.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7997.exe
        6⤵
        
        PID:15456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7148.exe
        5⤵
        
        PID:7940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35391.exe
        6⤵
        
        PID:12116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54986.exe
        6⤵
        
        PID:17324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23310.exe
        5⤵
        
        PID:11484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34872.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45898.exe
        5⤵
        
        PID:17484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53462.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53462.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56555.exe
        5⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-634.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42739.exe
        7⤵
        
        PID:9664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50310.exe
        7⤵
        
        PID:13640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44638.exe
        6⤵
        
        PID:9996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56993.exe
        6⤵
        
        PID:14284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2296.exe
        5⤵
        
        PID:7948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31691.exe
        6⤵
        
        PID:13172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35946.exe
        5⤵
        
        PID:10784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50249.exe
        5⤵
        
        PID:15664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13284.exe
      4⤵
      PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61703.exe
        5⤵
        
        PID:6320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32023.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56470.exe
        6⤵
        
        PID:14464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36802.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31809.exe
        5⤵
        
        PID:9864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19853.exe
        5⤵
        
        PID:384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5065.exe
        5⤵
        
        PID:6960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55958.exe
      4⤵
      PID:7396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61675.exe
        5⤵
        
        PID:11528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23745.exe
        5⤵
        
        PID:15596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11757.exe
        5⤵
        
        PID:18444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11608.exe
      4⤵
      PID:11056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19925.exe
      4⤵
      PID:14864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32745.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32745.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32295.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34983.exe
        5⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6254.exe
        6⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60123.exe
        7⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27201.exe
        7⤵
        
        PID:12728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16204.exe
        7⤵
        
        PID:16244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17622.exe
        7⤵
        
        PID:18144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
        6⤵
        
        PID:9260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51566.exe
        6⤵
        
        PID:15272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51002.exe
        6⤵
        
        PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53906.exe
        5⤵
        
        PID:8116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30080.exe
        5⤵
        
        PID:10260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58914.exe
        5⤵
        
        PID:15628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8573.exe
        5⤵
        
        PID:5976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36689.exe
      4⤵
      PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48299.exe
        5⤵
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2754.exe
        6⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40576.exe
        7⤵
        
        PID:17980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23117.exe
        6⤵
        
        PID:12680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16204.exe
        6⤵
        
        PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
        5⤵
        
        PID:6984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51566.exe
        5⤵
        
        PID:15312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1706.exe
        5⤵
        
        PID:17996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44473.exe
      4⤵
      PID:7232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3185.exe
        5⤵
        
        PID:14364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12681.exe
        5⤵
        
        PID:17924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16381.exe
      4⤵
      PID:10584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59237.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59237.exe
      4⤵
      PID:12148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36962.exe
      4⤵
      PID:17308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59029.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59029.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9518.exe
      4⤵
      PID:2532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65211.exe
        5⤵
        
        PID:6912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52339.exe
        6⤵
        
        PID:8680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11441.exe
        6⤵
        
        PID:11600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56469.exe
        6⤵
        
        PID:17312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62547.exe
        6⤵
        
        PID:17632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38825.exe
        5⤵
        
        PID:9908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5716.exe
        5⤵
        
        PID:13156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21868.exe
        5⤵
        
        PID:16412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5598.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:18016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47650.exe
      4⤵
      PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35811.exe
        5⤵
        
        PID:8936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35561.exe
        5⤵
        
        PID:12524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16204.exe
        5⤵
        
        PID:15680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52561.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52561.exe
      4⤵
      PID:9880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11581.exe
      4⤵
      PID:13124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5333.exe
      4⤵
      PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15071.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:19116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55138.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55138.exe
    3⤵
    PID:5224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44407.exe
      4⤵
      PID:6948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24711.exe
        5⤵
        
        PID:852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
        5⤵
        
        PID:12896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65213.exe
        5⤵
        
        PID:16488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25599.exe
        5⤵
        
        PID:17960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
      4⤵
      PID:9056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51566.exe
      4⤵
      PID:15264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26497.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26497.exe
      4⤵
      PID:4540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37588.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37588.exe
    3⤵
    PID:7248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44273.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44273.exe
    3⤵
    PID:10548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59767.exe
    3⤵
    PID:12472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64978.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64978.exe
    3⤵
    PID:1744
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33166.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33166.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3794.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38387.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41999.exe
        5⤵
        
        PID:4220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32819.exe
        6⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28647.exe
        7⤵
        
        PID:6484
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6484 -s 632
        8⤵
        Program crash
        
        PID:9992
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6484 -s 632
        8⤵
        Program crash
        
        PID:9764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27725.exe
        7⤵
        
        PID:9988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52318.exe
        7⤵
        
        PID:17240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58496.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27805.exe
        6⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49179.exe
        7⤵
        
        PID:12300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21276.exe
        6⤵
        
        PID:16052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29562.exe
        6⤵
        
        PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25256.exe
        5⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62671.exe
        6⤵
        
        PID:1064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20709.exe
        6⤵
        
        PID:13748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15900.exe
        6⤵
        
        PID:3604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52339.exe
        6⤵
        
        PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17045.exe
        5⤵
        
        PID:7676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31504.exe
        5⤵
        
        PID:13280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2489.exe
        5⤵
        
        PID:16560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18667.exe
        5⤵
        
        PID:4068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63166.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63166.exe
      4⤵
      PID:636
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 484
        5⤵
        Program crash
        
        PID:5536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4976.exe
      4⤵
      PID:7420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42038.exe
      4⤵
      PID:10856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28484.exe
      4⤵
      PID:15020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37346.exe
      4⤵
      PID:18480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7421.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7421.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
      4⤵
      PID:4116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50463.exe
        5⤵
        
        PID:6464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15390.exe
        6⤵
        
        PID:8968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31477.exe
        6⤵
        
        PID:12640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16204.exe
        6⤵
        
        PID:16716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33049.exe
        5⤵
        
        PID:8676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33728.exe
        5⤵
        
        PID:12968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5541.exe
        5⤵
        
        PID:16504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11816.exe
        5⤵
        
        PID:17264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8374.exe
        5⤵
        
        PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61490.exe
      4⤵
      PID:6992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53263.exe
        5⤵
        
        PID:12172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58373.exe
      4⤵
      PID:9924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62858.exe
      4⤵
      PID:12964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16024.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16024.exe
    3⤵
    PID:4008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58091.exe
      4⤵
      PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53470.exe
        5⤵
        
        PID:8752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14268.exe
        5⤵
        
        PID:12480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1417.exe
        5⤵
        
        PID:2288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19069.exe
      4⤵
      PID:8532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2836.exe
      4⤵
      PID:12096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35718.exe
      4⤵
      PID:16552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53882.exe
      4⤵
      PID:18488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1765.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1765.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35427.exe
      4⤵
      PID:8220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55022.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55022.exe
      4⤵
      PID:11920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22068.exe
      4⤵
      PID:16080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63471.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16548.exe
    3⤵
    PID:8612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14969.exe
    3⤵
    PID:6680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-868.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-868.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56866.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56866.exe
    3⤵
    PID:18712
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15284.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15284.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63659.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63659.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1542.exe
      4⤵
      PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61895.exe
        5⤵
        
        PID:4316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56527.exe
        6⤵
        
        PID:10392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10585.exe
        6⤵
        
        PID:14804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14616.exe
        6⤵
        
        PID:15364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59579.exe
        6⤵
        
        PID:18324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7200.exe
        5⤵
        
        PID:10896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37150.exe
        5⤵
        
        PID:15200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22325.exe
        5⤵
        
        PID:18212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56586.exe
      4⤵
      PID:7692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12142.exe
        5⤵
        
        PID:14880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65059.exe
        5⤵
        
        PID:19196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3081.exe
      4⤵
      PID:11276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37612.exe
      4⤵
      PID:16072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36386.exe
      4⤵
      PID:5960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60618.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60618.exe
    3⤵
    PID:216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53535.exe
      4⤵
      PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9682.exe
        5⤵
        
        PID:9960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46418.exe
        5⤵
        
        PID:12388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26258.exe
        5⤵
        
        PID:16980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32413.exe
        5⤵
        
        PID:19292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57658.exe
      4⤵
      PID:10276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53485.exe
      4⤵
      PID:14992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62111.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62111.exe
      4⤵
      PID:1172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37265.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37265.exe
    3⤵
    PID:7828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14985.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14985.exe
    3⤵
    PID:10948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37228.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37228.exe
    3⤵
    PID:15456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36002.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36002.exe
    3⤵
    PID:5208
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58806.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58806.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9518.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9518.exe
    3⤵
    PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52959.exe
      4⤵
      PID:7044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32879.exe
        5⤵
        
        PID:9200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
        5⤵
        
        PID:12876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
      4⤵
      PID:9076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51566.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51566.exe
      4⤵
      PID:15296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51002.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35397.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35397.exe
    3⤵
    PID:6656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64467.exe
      4⤵
      PID:15204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22718.exe
      4⤵
      PID:5816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19068.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19068.exe
    3⤵
    PID:10460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1597.exe
    3⤵
    PID:14836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17976.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17976.exe
    3⤵
    PID:3712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9874.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9874.exe
    3⤵
    PID:17716
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14330.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14330.exe
  2⤵
  PID:5332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4526.exe
    3⤵
    PID:6168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19475.exe
      4⤵
      PID:9116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65302.exe
      4⤵
      PID:12888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15281.exe
    3⤵
    PID:8448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27288.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27288.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:13564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36818.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36818.exe
    3⤵
    PID:15636
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25524.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25524.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33647.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33647.exe
    3⤵
    PID:9288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20569.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20569.exe
    3⤵
    PID:12620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21824.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21824.exe
    3⤵
    PID:17348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19594.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19594.exe
    3⤵
    PID:4964
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
  2⤵
  PID:10184
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32057.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32057.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:14332
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27482.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27482.exe
  2⤵
  PID:17392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41451.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41451.exe
  2⤵
  PID:5516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 636 -ip 636
1⤵
PID:1108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 6484 -ip 6484
1⤵
PID:9864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 6484 -ip 6484
1⤵
PID:10356

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1313.exe

Filesize
468KB

MD5
7918f57b4c70f4f99c8a2a7e9a4beb36

SHA1
0e59a61f1d9e7c37f79875f0058907466c986251

SHA256
168d62e6175d6390b42dd934fd7affff6b970ec83474f8154718b43ee7143131

SHA512
0ad2da0491045ded130781ecbab5ca265d0572b3ee0c4fb03394aeb8afe406c6b2fd3d145fa1ba27d8addd163ee381ca8214247b17d44d393ab285661dfb2972

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13638.exe

Filesize
468KB

MD5
86fec81af042d6c0152b19c76507405f

SHA1
8461cc5fa51e006c011b8be02f8e98628d6727cb

SHA256
9b349563a66179403182e50f5749e59d574dedc5e94c38afc68f824b4fc7cbbc

SHA512
b041c345b8216b912aa080b7c765b2547ba76bb8a59523bb5294644781f393afc447ae74e03d9739226cb6a7038ddc154b302a6e2102805ffefca804cb944d23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15284.exe

Filesize
468KB

MD5
dd38ccc1a186942a0254fbba04b0952f

SHA1
807d5d5146d051c956fd8a72e2a75214a5a07721

SHA256
73c1743376c02e80ce5e9a0ffa00739ad275161facda0c279cd67a39d87ea753

SHA512
1f673ea13d9f494384443c714ec3059c2482d4f4485d0a32bd563f702aa79fc9c14a80776fcfa8a2953fa7dc697945eb27f87cf63fe9d6dc72f52edef81e1e4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15676.exe

Filesize
468KB

MD5
7c5c2474a7519dc5675d6d674dec4421

SHA1
c27824cf74128147cf1ae8033613fdb46f3e2654

SHA256
915f4b4fbfe20b03be4eaf180404ab533cad69a98c85d1e8527b750b17eb4fa6

SHA512
9a634c381d66fd08e96ee989ac98b35417e0ff3d6bb0891a318d9a1685068fc6e51127bca0be58b01d7e9160a0c41f292659cc886bfd38c9ad7be4af387445bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1822.exe

Filesize
468KB

MD5
699e037f60e3f6e2a36f308e3e2fabc6

SHA1
d5fdf21e8ddd390257b4eeef1ba0da1b75d909e4

SHA256
09e5ae89db15bfa51d42d4616280f46318102edfd3917439447ccd104c6c6328

SHA512
0cb794e004f87edfffe8a6ebddf77683227de45faf5569b28f24d157befa04d9d36c542fcc9e92ce777868e600fd03dd12ffb3db21637c4d4f0741e5ed1b3e8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19695.exe

Filesize
468KB

MD5
208c4154f77c936b2e330fa3efa9b1f2

SHA1
00e3436f0010adb0fac203d4abd6b25fb7568fb8

SHA256
be75a2a6b904f3eedfddf23fe5e7cbc917e946ef5db622426522c76bbd0b7ad9

SHA512
bf2f87cc481033f8179bc4ba067b6e41f3ecc51275a5bb7988f8570332e2fe370715c4a4ec5be9d0929124df6323c55a450ddb7e38e8c2146c2cb73fcf5126a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23705.exe

Filesize
468KB

MD5
44e15e8899d1f358b9347e42316fcd20

SHA1
089b8b0a6968daf77670fe4569c66b44d5f0e7f1

SHA256
b219aaefa007248c6c4b11b6c9e02497b329cbe8656cb72588e8c69fe67cd3bb

SHA512
68d4b7aecf2c4a3da0718c7dd772a87f64cb69211c7042e830cdab88fcbdbb43392d73d0752c5d6e44326bb67235f304f8bf23d6ed1aa4435c7cc0d1ca734345

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24215.exe

Filesize
468KB

MD5
849f80102d3d1b3aff839d70e179bbaf

SHA1
a60d2224622c230478cdff79353e49a5a3b038bf

SHA256
5e565671073b997801a524953a88c629963b61364aa2e471455246da3d67a80b

SHA512
d197c2ea2ce8a92c7420ea7c3e889472f97da5fbb5fec91c2777c43721e4cd519333f9fab048e703cec0e326c7bfd9541a113194db06056b94e6230ae93230bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28661.exe

Filesize
468KB

MD5
0c620003c4c7eb416112549cc5fa344e

SHA1
e13dc705adfcccd5696e9f2233d3ad8094d0acc5

SHA256
2dd6a245500181a598f85c19009e45cb4f6e9fe56aa6a231bd0e26b5b83c2dc1

SHA512
4c3e1601e5f410c165cc69fc150c0394fe104ca09327082190f9424fd94879f206910e52344b39df95dde92b5b49bf46450da80127c97a0b9a9354b967fdd7eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28853.exe

Filesize
468KB

MD5
dbcfdf116af9700fdd9dc920e31d25cd

SHA1
2cd9f1668980cb80a82ea2b1ff88ebf1ec0f3375

SHA256
6b9cb02c7d76a47355d0bec5a57f82ddc94301f663d66cc1ceb0e61c65d96ef4

SHA512
08b0d7d421ee8328d80f3d31c4e7cd27e8c1a865cb3a9dbd5a549b9ab5811aba4b39faabd45b64d7475bb0cb2c793c131e42939bbe387a015257c1ada9676a4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30144.exe

Filesize
468KB

MD5
918daa26a090aa3ca2d29745e9deae36

SHA1
0232cad9f1a0d1890d6b8b3ef513e0626a59d4cf

SHA256
03753c53f4bd8f8a9d22d70211206884bc7e1dc6ab25b3e02b5ed8debbe51c19

SHA512
ffb338ee5da4da6c215a81dbd5b8a7f7cac99750aa6460cf78d1c6a88cca555e6bf63bcdb5584537d6840d5570c92c87d0307c544b1ef8fcfaf72c01f0e09860

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32745.exe

Filesize
468KB

MD5
639c84961f3101544921efadc858901e

SHA1
e22c3de9a198f49a6bdc7df9eae83a8c357dcddf

SHA256
5afea23ac29107dddaf8d7730fd72fdfbe8a45c752185c6f37d48638452077e3

SHA512
50806654adf5aa6a88bcdba3ac3c36da57a3012e87c7e5f0513bb1541b338585fc1af32cfa2eb0c086c75b08e0cc085162e8634d02c54c48149c12a353db86ac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33166.exe

Filesize
468KB

MD5
59b6912cd9624c2c5037cdb978b27dc3

SHA1
ab11a4396271a9291c50b0267fd29602d2406f8b

SHA256
052719e8ff615208a824c070aafb1d7d20e4bf12ad79ddb29587e5edd34377de

SHA512
6eae00af9c3fb74f93af2b3ec18124bcfc44d9271cfc6e3c718a97ea63d6d7655dca271e418388678479d8374512fda91cb15e32b727c990519502816c373472

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33431.exe

Filesize
468KB

MD5
cc1b4bf65564c345f1e95d48ee6def30

SHA1
73666c3ed7363bfb7fabc53c2b3550d954bf5b5f

SHA256
28b8d6206003fbc1cde5443edd706afadf2cdf4d2b46eff387c1992544b0eaea

SHA512
83e007ec685702db58e56df9330c0a4d5febec6ab19daeec4528a5676cffb4fe243e5a2ceb928be508b64c0ff6dd3386119477aa8ab77d47c8068c17f419c7be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36010.exe

Filesize
468KB

MD5
604f2c4c75e736ab851835e2c76909ee

SHA1
be0be97d6eeb5141cc68f8a64bbcc82285ec5af3

SHA256
04fc54ea43465422ecd53c1c9e9d2627c5b9c31d70d65c7ef2a53437be31d0d9

SHA512
753e71f9a12f8e75f8336ab5f87868b2f1029705dbbe88c57c7e9f422364f5376ec17303898f0a0829af91b2a1b51ac44ab729f76f1e848a252a1e5719a7a4da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36275.exe

Filesize
468KB

MD5
6022156802786adbb4adf2d94c7917ae

SHA1
5753be3e1cdddadfb4bee320543b99642574cb1c

SHA256
dfcd02aac54634d717ecb14b853c99fcb0b62d77b2ac3eb5a0d5762a46da9e90

SHA512
a5e5b31322dac95333285568ef443bb7da792cf5a37d0f290e80d11f06ee09a017f436a7b7351130376c82040408572a9614ce28d99644395bb76cd601844a33

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36467.exe

Filesize
468KB

MD5
28d25844237abfed52fa922a683debc4

SHA1
bb7024389fcb107c41305acd9fa64f70efd25e9e

SHA256
360f10d845777074fa7b36052655ad7019045f941266bfd26077d8481ee611ec

SHA512
e9ba15a0db368f3f8282e461929d8f42b22f941af73fbb1d24ebb188302b32f8c68587ee16bae0942bd3a7e15ac925c60a0703b70b063babaa612bb4fd4a4bae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3794.exe

Filesize
468KB

MD5
9f1bb5c7e2dd6910257db885152b5b38

SHA1
704b22fef72d54189125e5a589d12fc3093823ef

SHA256
f7f53e48e9d2ac8d4c3c1c7da660960022b264f1452dbe396dd5c9e0a934b949

SHA512
49ee8df2bd27514928461eacd3fc1dddfb35022514b64c32389ecd34d959167ddc4293fdffbd42108e840085ea35793119a7cc490151ec3227733e5f0d79df56

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38387.exe

Filesize
468KB

MD5
0ee2b8d936865d152d4195318363a704

SHA1
f1c900f38ea3bf6b4d3c7498bb6a37f11ba601d2

SHA256
b9cc1d466198e3f8320234b67a89f2737263332bd5ea44e5c6a4c728cacdabc6

SHA512
fcd9ee7a51432e8375eb3f599ca8557301b5296f71910e4b8fd1475aa4dc6689f1bc16f2ea7e810d473e903388f99a821249aca4162977897dbb866603f6cedd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43571.exe

Filesize
468KB

MD5
0c92b25ff866688885effcb404f045c4

SHA1
d38cc813f7044cef4a63e4299aeaadf0320f970f

SHA256
e1768912b2d03380b47354ddb329cc822cfd4c933bbe5dd44d07b0b97a497b2c

SHA512
b140c1aa864c891c8f37b45aef73bf844e06fedf20f33c422377036fca6a91d7d80d20b3a3975bf557f665273c2bfa8661eaaa651f44fabbfacb76485c51a737

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44443.exe

Filesize
468KB

MD5
c1d7042e54bacd2030a206265d207145

SHA1
2d835674f72241b4cd5f9724039feb77e0e5d307

SHA256
882e90caa466813cde21b8b920315e57a41edbfaa9130c9db4167fbc8743a8e2

SHA512
695d7396b401d8e030d56a9bffd20a62441f96bb62e45a7df813537dc48c20f9cf0397044a4519d928e95b12a403f315ed62966b38f25efaa02b9236bc908b40

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50565.exe

Filesize
468KB

MD5
f99ca1a0e30f377d3611a0c3ec9e50aa

SHA1
1da033fce94dd934f6456a67bb77d67fc97f9507

SHA256
1331be0825e7890decf8fa29c1dc048289dbb53ca2288ea63041f9ca4e81efd0

SHA512
fce5bad059527da321be3fc403d5ff3f53804428e78020aef0db56721d1e1db41572af6193e650f571a992a1d9bff9d6ecddcdfa93ba8abb1b8a2b66fcaf9c52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53659.exe

Filesize
468KB

MD5
5e7eafa9dd80081ec0068ffcdee41bd9

SHA1
794e8a8d7aa4c9beea82a5e31ff1e7d4472258e2

SHA256
6d4af5eae8d558f6e49a8d4906dd8118d92be8a2d40e09a61f2b17d5fb7a4d60

SHA512
25b7a99ebe2c87311ab7e3fd0b15f8a0e73d4609bebca82f4e197b1d6e41d15fae78db3dd1470943c55657485bc9d35ef7b17db0f5088b3a640181444cd17e2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54183.exe

Filesize
468KB

MD5
db03a492ffb0f7f7aaf62d2b21dc48ca

SHA1
195d7f0e39b312ae2e4108eeb11e6e74f21cc7f2

SHA256
3d6aa240ead200eaa72fa6214789b481e4b27076503f3ea5b7178152665bc6b4

SHA512
a06620f782e46256e85ac09db0e8b6d60750d4b4b5e404e4a1c6c767416863795e31ad1e03fd67dd36427e69a54c1a54e0cb7f8f85699f50cfe9614afce93c34

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56695.exe

Filesize
468KB

MD5
cf33a908f2b3ce1542b45e51ab3bebbd

SHA1
5ca959cdea781344f5293837cb4a6fac1274ba1e

SHA256
19edb4477699eaa8af97646c20849259f8adeac4c247632373d0daf4b1fe3da7

SHA512
975afa339fe42553c590fe9a03c888e34949c2ef970e11d05027a5f68495f183b1c734a26cfd2007b80250a35546f2e4030f41c21d2e546f472aeeebcf94fcdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58490.exe

Filesize
468KB

MD5
1f02820e60bda146febf23053e9efe92

SHA1
706d54957d3d1ffbd691f1c17be6a196f459886e

SHA256
7346bc28db9883e5c01198f29f9dab339b8ffb70059f05e0a91f29c1019db5bd

SHA512
4622c464b5a4bc62ec2bc0db440e02f95d7a652a2e0866e53286caa93a9dd56a1ff68cb01f7ebeb2ddea7edb761f4eb3620b24feda0c043311eb73536bd89f77

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64022.exe

Filesize
468KB

MD5
780340c810c3cb6c83b378561136dd93

SHA1
13797ca4569e1f74b786d7e9a8371bc5c2c83fd6

SHA256
caf1241809c336db4932ac65678f705350574cd9de9743ec122a6a05a2b256eb

SHA512
adfb055589ba31e2d4b3e6293045008d0999e90c4b9cb67a517988ae0e3b3a41047593666c32272acf6d76902295735c21304bb779ad02feaaca445793c2e542

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65366.exe

Filesize
468KB

MD5
3ab07323168c3866b074e97e731ee3db

SHA1
e7e038c7b63112d543ff4436fa161be380a7fd40

SHA256
a46c649f32ecefaa8f12f79c7b0568367de63f265dcb7684725df093ebfae57e

SHA512
f3716eded584adf26d38f3695f1c827f626fc832aa73c13e7cc517408bff70d94219c90d87332b14d13bee7f8b3c5b39bedeec04e92f9198c0ad072d99efc70a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6688.exe

Filesize
468KB

MD5
7529901cd0eafab6a0c2d9311de64e54

SHA1
9f57292ccbef9b6e3aa61ca6a65f81db6f335029

SHA256
ec3b90658e8374ec19f7613b1844e93475f18004f244cdbdb6e6ae457af5345f

SHA512
dd2d6a1693ea3ed21f534848e44929bf9efed449d0a633fa2f1db3118f49693ad58a71e6d2f01218390d222373892ff54a8869588321c4a7deb35b15809fe5d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7878.exe

Filesize
468KB

MD5
e530cf9610749bc44dd9494ed2705c23

SHA1
7494a7a4102f9a58a9160d2f386daf80f481de16

SHA256
5d52902eaa239125d2e3070e2bf69d0f97f66eb59252b0a1fe5856fb45a19093

SHA512
d05d918fde617e0a9e4be4b3b5be458b145531a45dd29fc6a377f9c1789fa0128ff3aa028d4e3fcfdb86527703143c7c775e534feed00fb988a813c5e0f395c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8926.exe

Filesize
468KB

MD5
9a7f53195a913fe498b00b6187012e8c

SHA1
ff71d9210bb667fe02227f3e5c8d8c84122e5c6c

SHA256
3e9014bb19a61d7811595ce74aff2d48eee543b455f9134d141a9e4e7535dd88

SHA512
f6d59035afb4ff3de98272843d9fae8db7d5893ffca57300d9ee1987ae6582fb7d96763eec625f3ed1c98e83f91de6c0bf363b5ac2b529d155dd3b73f90ee153

Download Submit
memory/7496-1069-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15596-2730-0x00000000773B0000-0x00000000773D4000-memory.dmp

Filesize
144KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads