bcf51267659feadd8b63829ae237d219441773275f7d22c84c620407fc2a2a5f

Analysis

max time kernel
120s
max time network
116s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/10/2024, 03:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bcf51267659feadd8b63829ae237d219441773275f7d22c84c620407fc2a2a5fN.exe
Size

468KB
MD5

ea30e172fbf6242eec0ae8c5e6929f70
SHA1

21df1960e174eba077de0be87723a743475759b7
SHA256

bcf51267659feadd8b63829ae237d219441773275f7d22c84c620407fc2a2a5f
SHA512

d005213e03dccc5918a21c418e2eeec8bc418fff6c0de6004bf83e72f05f9a5b10c142309d2b66e87f4faceaca7ff63357b5f28f842fb4e835ae4a58fa2f6e8b
SSDEEP

3072:0F9aogBRj28I2bYnKz3Mqf8/oCbryIplPmHxvT6dZJH+TpGNBTlf:0FUoiXI28KDMqf10cyZJeNGNB

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3236	Unicorn-50454.exe
3708	Unicorn-4917.exe
2284	Unicorn-34745.exe
2536	Unicorn-1077.exe
4124	Unicorn-30905.exe
1596	Unicorn-49702.exe
4172	Unicorn-61169.exe
4928	Unicorn-53859.exe
2004	Unicorn-29747.exe
1952	Unicorn-55094.exe
3020	Unicorn-39251.exe
4592	Unicorn-38182.exe
2476	Unicorn-18316.exe
4020	Unicorn-2857.exe
2636	Unicorn-21772.exe
4432	Unicorn-56070.exe
3880	Unicorn-2572.exe
3520	Unicorn-22438.exe
4864	Unicorn-57450.exe
828	Unicorn-10434.exe
3860	Unicorn-9749.exe
1652	Unicorn-39385.exe
2964	Unicorn-51.exe
100	Unicorn-2851.exe
2404	Unicorn-8981.exe
3012	Unicorn-8981.exe
2648	Unicorn-35524.exe
2872	Unicorn-54653.exe
2568	Unicorn-52134.exe
4264	Unicorn-15740.exe
856	Unicorn-42835.exe
4936	Unicorn-20176.exe
4656	Unicorn-25622.exe
2068	Unicorn-54765.exe
4504	Unicorn-24854.exe
3712	Unicorn-48596.exe
3696	Unicorn-21328.exe
2188	Unicorn-6524.exe
1816	Unicorn-6524.exe
1116	Unicorn-61750.exe
4376	Unicorn-40732.exe
4356	Unicorn-30230.exe
4844	Unicorn-9980.exe
912	Unicorn-13317.exe
4788	Unicorn-24016.exe
4996	Unicorn-37075.exe
2168	Unicorn-36006.exe
3460	Unicorn-33737.exe
4968	Unicorn-53603.exe
1500	Unicorn-47473.exe
2348	Unicorn-19897.exe
3720	Unicorn-36307.exe
4216	Unicorn-35238.exe
1228	Unicorn-31900.exe
4352	Unicorn-10457.exe
4008	Unicorn-35658.exe
456	Unicorn-20931.exe
4816	Unicorn-52954.exe
3444	Unicorn-39763.exe
3148	Unicorn-384.exe
1720	Unicorn-6514.exe
2856	Unicorn-35657.exe
1832	Unicorn-40038.exe
3068	Unicorn-13717.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
3024	2648	WerFault.exe	126

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49731.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63654.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49962.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61169.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20176.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28362.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2802.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15712.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8736.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43235.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37389.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58733.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54345.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38627.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56051.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21500.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17336.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43322.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-984.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51162.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10073.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51530.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65265.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61213.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29954.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46461.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25643.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59602.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14809.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1252.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7419.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26002.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1169.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7800.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4336.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35297.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57203.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36328.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8980.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19494.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19696.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13932.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38182.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30448.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23350.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39686.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5013.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31523.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	14904	dwm.exe
Token: SeChangeNotifyPrivilege	14904	dwm.exe
Token: 33	14904	dwm.exe
Token: SeIncBasePriorityPrivilege	14904	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
764	bcf51267659feadd8b63829ae237d219441773275f7d22c84c620407fc2a2a5fN.exe
3236	Unicorn-50454.exe
3708	Unicorn-4917.exe
2284	Unicorn-34745.exe
4124	Unicorn-30905.exe
2536	Unicorn-1077.exe
1596	Unicorn-49702.exe
4172	Unicorn-61169.exe
4928	Unicorn-53859.exe
2004	Unicorn-29747.exe
3020	Unicorn-39251.exe
4592	Unicorn-38182.exe
1952	Unicorn-55094.exe
2636	Unicorn-21772.exe
4020	Unicorn-2857.exe
2476	Unicorn-18316.exe
4432	Unicorn-56070.exe
3880	Unicorn-2572.exe
3520	Unicorn-22438.exe
4864	Unicorn-57450.exe
828	Unicorn-10434.exe
3860	Unicorn-9749.exe
2872	Unicorn-54653.exe
1652	Unicorn-39385.exe
100	Unicorn-2851.exe
3012	Unicorn-8981.exe
2404	Unicorn-8981.exe
2964	Unicorn-51.exe
2648	Unicorn-35524.exe
2568	Unicorn-52134.exe
4264	Unicorn-15740.exe
856	Unicorn-42835.exe
4936	Unicorn-20176.exe
4656	Unicorn-25622.exe
3712	Unicorn-48596.exe
2068	Unicorn-54765.exe
4504	Unicorn-24854.exe
3696	Unicorn-21328.exe
1816	Unicorn-6524.exe
2188	Unicorn-6524.exe
1116	Unicorn-61750.exe
4376	Unicorn-40732.exe
4356	Unicorn-30230.exe
912	Unicorn-13317.exe
4844	Unicorn-9980.exe
4788	Unicorn-24016.exe
4996	Unicorn-37075.exe
2168	Unicorn-36006.exe
1500	Unicorn-47473.exe
3460	Unicorn-33737.exe
4968	Unicorn-53603.exe
2348	Unicorn-19897.exe
3720	Unicorn-36307.exe
4216	Unicorn-35238.exe
4352	Unicorn-10457.exe
1228	Unicorn-31900.exe
4008	Unicorn-35658.exe
4816	Unicorn-52954.exe
456	Unicorn-20931.exe
3444	Unicorn-39763.exe
1720	Unicorn-6514.exe
3148	Unicorn-384.exe
2856	Unicorn-35657.exe
1832	Unicorn-40038.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 3236	764	bcf51267659feadd8b63829ae237d219441773275f7d22c84c620407fc2a2a5fN.exe	89
PID 764 wrote to memory of 3236	764	bcf51267659feadd8b63829ae237d219441773275f7d22c84c620407fc2a2a5fN.exe	89
PID 764 wrote to memory of 3236	764	bcf51267659feadd8b63829ae237d219441773275f7d22c84c620407fc2a2a5fN.exe	89
PID 3236 wrote to memory of 3708	3236	Unicorn-50454.exe	95
PID 3236 wrote to memory of 3708	3236	Unicorn-50454.exe	95
PID 3236 wrote to memory of 3708	3236	Unicorn-50454.exe	95
PID 764 wrote to memory of 2284	764	bcf51267659feadd8b63829ae237d219441773275f7d22c84c620407fc2a2a5fN.exe	96
PID 764 wrote to memory of 2284	764	bcf51267659feadd8b63829ae237d219441773275f7d22c84c620407fc2a2a5fN.exe	96
PID 764 wrote to memory of 2284	764	bcf51267659feadd8b63829ae237d219441773275f7d22c84c620407fc2a2a5fN.exe	96
PID 3708 wrote to memory of 2536	3708	Unicorn-4917.exe	99
PID 3708 wrote to memory of 2536	3708	Unicorn-4917.exe	99
PID 3708 wrote to memory of 2536	3708	Unicorn-4917.exe	99
PID 3236 wrote to memory of 4124	3236	Unicorn-50454.exe	100
PID 3236 wrote to memory of 4124	3236	Unicorn-50454.exe	100
PID 3236 wrote to memory of 4124	3236	Unicorn-50454.exe	100
PID 2284 wrote to memory of 1596	2284	Unicorn-34745.exe	101
PID 2284 wrote to memory of 1596	2284	Unicorn-34745.exe	101
PID 2284 wrote to memory of 1596	2284	Unicorn-34745.exe	101
PID 764 wrote to memory of 4172	764	bcf51267659feadd8b63829ae237d219441773275f7d22c84c620407fc2a2a5fN.exe	102
PID 764 wrote to memory of 4172	764	bcf51267659feadd8b63829ae237d219441773275f7d22c84c620407fc2a2a5fN.exe	102
PID 764 wrote to memory of 4172	764	bcf51267659feadd8b63829ae237d219441773275f7d22c84c620407fc2a2a5fN.exe	102
PID 4124 wrote to memory of 4928	4124	Unicorn-30905.exe	107
PID 4124 wrote to memory of 4928	4124	Unicorn-30905.exe	107
PID 4124 wrote to memory of 4928	4124	Unicorn-30905.exe	107
PID 3236 wrote to memory of 2004	3236	Unicorn-50454.exe	108
PID 3236 wrote to memory of 2004	3236	Unicorn-50454.exe	108
PID 3236 wrote to memory of 2004	3236	Unicorn-50454.exe	108
PID 2536 wrote to memory of 1952	2536	Unicorn-1077.exe	109
PID 2536 wrote to memory of 1952	2536	Unicorn-1077.exe	109
PID 2536 wrote to memory of 1952	2536	Unicorn-1077.exe	109
PID 1596 wrote to memory of 3020	1596	Unicorn-49702.exe	110
PID 1596 wrote to memory of 3020	1596	Unicorn-49702.exe	110
PID 1596 wrote to memory of 3020	1596	Unicorn-49702.exe	110
PID 4172 wrote to memory of 4592	4172	Unicorn-61169.exe	111
PID 4172 wrote to memory of 4592	4172	Unicorn-61169.exe	111
PID 4172 wrote to memory of 4592	4172	Unicorn-61169.exe	111
PID 3708 wrote to memory of 2476	3708	Unicorn-4917.exe	112
PID 3708 wrote to memory of 2476	3708	Unicorn-4917.exe	112
PID 3708 wrote to memory of 2476	3708	Unicorn-4917.exe	112
PID 2284 wrote to memory of 4020	2284	Unicorn-34745.exe	113
PID 2284 wrote to memory of 4020	2284	Unicorn-34745.exe	113
PID 2284 wrote to memory of 4020	2284	Unicorn-34745.exe	113
PID 764 wrote to memory of 2636	764	bcf51267659feadd8b63829ae237d219441773275f7d22c84c620407fc2a2a5fN.exe	114
PID 764 wrote to memory of 2636	764	bcf51267659feadd8b63829ae237d219441773275f7d22c84c620407fc2a2a5fN.exe	114
PID 764 wrote to memory of 2636	764	bcf51267659feadd8b63829ae237d219441773275f7d22c84c620407fc2a2a5fN.exe	114
PID 4928 wrote to memory of 4432	4928	Unicorn-53859.exe	115
PID 4928 wrote to memory of 4432	4928	Unicorn-53859.exe	115
PID 4928 wrote to memory of 4432	4928	Unicorn-53859.exe	115
PID 4124 wrote to memory of 3880	4124	Unicorn-30905.exe	116
PID 4124 wrote to memory of 3880	4124	Unicorn-30905.exe	116
PID 4124 wrote to memory of 3880	4124	Unicorn-30905.exe	116
PID 2004 wrote to memory of 3520	2004	Unicorn-29747.exe	117
PID 2004 wrote to memory of 3520	2004	Unicorn-29747.exe	117
PID 2004 wrote to memory of 3520	2004	Unicorn-29747.exe	117
PID 3236 wrote to memory of 4864	3236	Unicorn-50454.exe	118
PID 3236 wrote to memory of 4864	3236	Unicorn-50454.exe	118
PID 3236 wrote to memory of 4864	3236	Unicorn-50454.exe	118
PID 4592 wrote to memory of 828	4592	Unicorn-38182.exe	119
PID 4592 wrote to memory of 828	4592	Unicorn-38182.exe	119
PID 4592 wrote to memory of 828	4592	Unicorn-38182.exe	119
PID 3020 wrote to memory of 3860	3020	Unicorn-39251.exe	120
PID 3020 wrote to memory of 3860	3020	Unicorn-39251.exe	120
PID 3020 wrote to memory of 3860	3020	Unicorn-39251.exe	120
PID 4172 wrote to memory of 1652	4172	Unicorn-61169.exe	121

C:\Users\Admin\AppData\Local\Temp\bcf51267659feadd8b63829ae237d219441773275f7d22c84c620407fc2a2a5fN.exe
"C:\Users\Admin\AppData\Local\Temp\bcf51267659feadd8b63829ae237d219441773275f7d22c84c620407fc2a2a5fN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:764
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50454.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50454.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4917.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4917.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1077.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1077.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55094.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36006.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24870.exe
        8⤵
        
        PID:5792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22883.exe
        9⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30214.exe
        10⤵
        
        PID:9152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51530.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:1956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27208.exe
        10⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7528.exe
        10⤵
        
        PID:9364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25641.exe
        9⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65265.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18657.exe
        9⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62868.exe
        8⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65219.exe
        9⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17036.exe
        9⤵
        
        PID:14140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        9⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10073.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23731.exe
        8⤵
        
        PID:13776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        8⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41049.exe
        7⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22611.exe
        8⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3989.exe
        9⤵
        
        PID:9948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56538.exe
        9⤵
        
        PID:13784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56973.exe
        8⤵
        
        PID:11164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45685.exe
        8⤵
        
        PID:15648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        8⤵
        
        PID:16720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1888.exe
        7⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43731.exe
        8⤵
        
        PID:13964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59602.exe
        8⤵
        
        PID:16116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
        7⤵
        
        PID:12128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7188.exe
        7⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-545.exe
        7⤵
        
        PID:7380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33737.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25555.exe
        7⤵
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15875.exe
        8⤵
        
        PID:2368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13410.exe
        9⤵
        
        PID:2216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51530.exe
        9⤵
        
        PID:10848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47577.exe
        9⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
        9⤵
        
        PID:18180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18044.exe
        8⤵
        
        PID:9392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6547.exe
        8⤵
        
        PID:13336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49602.exe
        8⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48448.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:18032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41068.exe
        7⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3938.exe
        8⤵
        
        PID:13172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18488.exe
        8⤵
        
        PID:9140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30448.exe
        7⤵
        
        PID:10352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39333.exe
        7⤵
        
        PID:14588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        7⤵
        
        PID:16752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12211.exe
        6⤵
        
        PID:5964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3980.exe
        7⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59107.exe
        8⤵
        
        PID:14616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58725.exe
        8⤵
        
        PID:16952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        7⤵
        
        PID:11192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9348.exe
        7⤵
        
        PID:15324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        7⤵
        
        PID:16556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23498.exe
        6⤵
        
        PID:7572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30819.exe
        7⤵
        
        PID:10964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
        7⤵
        
        PID:14732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        7⤵
        
        PID:6916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17363.exe
        6⤵
        
        PID:10784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1252.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
        6⤵
        
        PID:6148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54653.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37075.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39478.exe
        7⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39686.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50950.exe
        9⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20076.exe
        9⤵
        
        PID:11720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54345.exe
        9⤵
        
        PID:15592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        9⤵
        
        PID:16524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9289.exe
        8⤵
        
        PID:8752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25747.exe
        8⤵
        
        PID:11740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26002.exe
        8⤵
        
        PID:16360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3000.exe
        8⤵
        
        PID:13476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
        7⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50035.exe
        8⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3196.exe
        8⤵
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46140.exe
        8⤵
        
        PID:17116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37457.exe
        7⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14441.exe
        7⤵
        
        PID:13616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        7⤵
        
        PID:16580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6156.exe
        6⤵
        
        PID:4024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59014.exe
        7⤵
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62502.exe
        8⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35297.exe
        8⤵
        
        PID:14072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        8⤵
        
        PID:7008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60045.exe
        7⤵
        
        PID:9492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47684.exe
        7⤵
        
        PID:11840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17632.exe
        6⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35510.exe
        7⤵
        
        PID:10436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55586.exe
        7⤵
        
        PID:14696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
        7⤵
        
        PID:16504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26029.exe
        6⤵
        
        PID:10836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17787.exe
        6⤵
        
        PID:15172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        6⤵
        
        PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47473.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34086.exe
        6⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56515.exe
        7⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40131.exe
        8⤵
        
        PID:9484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27020.exe
        8⤵
        
        PID:13524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        8⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
        7⤵
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65265.exe
        7⤵
        
        PID:12616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16244.exe
        7⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49984.exe
        7⤵
        
        PID:9564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15712.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25562.exe
        6⤵
        
        PID:10580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29316.exe
        6⤵
        
        PID:15364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
        6⤵
        
        PID:2444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28362.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57971.exe
        6⤵
        
        PID:8156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44202.exe
        6⤵
        
        PID:10332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52492.exe
        6⤵
        
        PID:13364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        6⤵
        
        PID:16744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59242.exe
        5⤵
        
        PID:8772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33094.exe
        5⤵
        
        PID:12548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3491.exe
        5⤵
        
        PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54976.exe
        5⤵
        
        PID:17940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18316.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6524.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32083.exe
        6⤵
        
        PID:3080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5321.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48195.exe
        8⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17788.exe
        8⤵
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1656.exe
        8⤵
        
        PID:8632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60129.exe
        7⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37389.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25643.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63708.exe
        7⤵
        
        PID:18132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62868.exe
        6⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60158.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8401.exe
        7⤵
        
        PID:17128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10073.exe
        6⤵
        
        PID:10156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32772.exe
        6⤵
        
        PID:14788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20797.exe
        6⤵
        
        PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61034.exe
        5⤵
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23763.exe
        6⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42670.exe
        7⤵
        
        PID:15268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59602.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57569.exe
        6⤵
        
        PID:11816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62514.exe
        6⤵
        
        PID:15656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        6⤵
        
        PID:5080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57396.exe
        5⤵
        
        PID:7900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36012.exe
        5⤵
        
        PID:12184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52499.exe
        5⤵
        
        PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62097.exe
        5⤵
        
        PID:10084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35524.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2648
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2648 -s 720
        5⤵
        Program crash
        
        PID:3024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35658.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26022.exe
        5⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39907.exe
        6⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56019.exe
        7⤵
        
        PID:12520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4536.exe
        7⤵
        
        PID:1308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8176.exe
        6⤵
        
        PID:11908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62514.exe
        6⤵
        
        PID:15556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        6⤵
        
        PID:15832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46461.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55348.exe
        5⤵
        
        PID:12144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8456.exe
        5⤵
        
        PID:15800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63708.exe
        5⤵
        
        PID:18208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9411.exe
      4⤵
      PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62579.exe
        5⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40475.exe
        6⤵
        
        PID:14660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59602.exe
        6⤵
        
        PID:6396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49277.exe
        5⤵
        
        PID:8472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50572.exe
        5⤵
        
        PID:14512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        5⤵
        
        PID:16928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15292.exe
      4⤵
      PID:8016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41894.exe
        5⤵
        
        PID:14380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59602.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55667.exe
      4⤵
      PID:11228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45219.exe
      4⤵
      PID:15356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43324.exe
      4⤵
      PID:16960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30905.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53859.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56070.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52134.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20931.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12482.exe
        8⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62579.exe
        9⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16518.exe
        10⤵
        
        PID:13244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46997.exe
        10⤵
        
        PID:4100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17506.exe
        10⤵
        
        PID:18080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49277.exe
        9⤵
        
        PID:9800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50572.exe
        9⤵
        
        PID:14504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1169.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15775.exe
        9⤵
        
        PID:17964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17731.exe
        8⤵
        
        PID:7264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15466.exe
        9⤵
        
        PID:408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11960.exe
        9⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
        8⤵
        
        PID:12020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57458.exe
        8⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15236.exe
        8⤵
        
        PID:18228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28377.exe
        7⤵
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18771.exe
        8⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20076.exe
        8⤵
        
        PID:11732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54345.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        8⤵
        
        PID:16656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5427.exe
        7⤵
        
        PID:8704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31613.exe
        7⤵
        
        PID:11836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17336.exe
        7⤵
        
        PID:16308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18152.exe
        7⤵
        
        PID:17636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52954.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56333.exe
        7⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32640.exe
        8⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17513.exe
        8⤵
        
        PID:13104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58316.exe
        8⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16920.exe
        8⤵
        
        PID:9436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36481.exe
        7⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
        7⤵
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55429.exe
        7⤵
        
        PID:3960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29954.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12211.exe
        6⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45366.exe
        7⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64166.exe
        8⤵
        
        PID:11036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59305.exe
        8⤵
        
        PID:4740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
        8⤵
        
        PID:18112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49277.exe
        7⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50572.exe
        7⤵
        
        PID:14528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        7⤵
        
        PID:16436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14931.exe
        6⤵
        
        PID:7684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53763.exe
        6⤵
        
        PID:12864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-803.exe
        6⤵
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22688.exe
        6⤵
        
        PID:10108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15740.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39763.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26022.exe
        7⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45366.exe
        8⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49962.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50572.exe
        8⤵
        
        PID:14544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        8⤵
        
        PID:3024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3897.exe
        7⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20163.exe
        7⤵
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26453.exe
        7⤵
        
        PID:15156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9883.exe
        7⤵
        
        PID:15544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16152.exe
        7⤵
        
        PID:10068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31340.exe
        6⤵
        
        PID:5772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23379.exe
        7⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42281.exe
        7⤵
        
        PID:10908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20587.exe
        7⤵
        
        PID:15232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        7⤵
        
        PID:16672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1888.exe
        6⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
        6⤵
        
        PID:12084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55538.exe
        6⤵
        
        PID:16036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-545.exe
        6⤵
        
        PID:7516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-384.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27558.exe
        6⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27219.exe
        7⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63683.exe
        8⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38756.exe
        8⤵
        
        PID:14308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
        8⤵
        
        PID:16968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50538.exe
        7⤵
        
        PID:10244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4736.exe
        7⤵
        
        PID:13864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        7⤵
        
        PID:16680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37337.exe
        6⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39956.exe
        6⤵
        
        PID:11188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51170.exe
        6⤵
        
        PID:15128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        6⤵
        
        PID:16516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51434.exe
        5⤵
        
        PID:5744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23379.exe
        6⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36102.exe
        7⤵
        
        PID:10888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31569.exe
        7⤵
        
        PID:15180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
        7⤵
        
        PID:16648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9900.exe
        6⤵
        
        PID:12700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58041.exe
        6⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63708.exe
        6⤵
        
        PID:18076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64625.exe
        5⤵
        
        PID:8216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36012.exe
        5⤵
        
        PID:12208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20320.exe
        5⤵
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62097.exe
        5⤵
        
        PID:10040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2572.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6514.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43619.exe
        7⤵
        
        PID:5188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28838.exe
        8⤵
        
        PID:4040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15141.exe
        9⤵
        
        PID:9384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33948.exe
        9⤵
        
        PID:14284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
        9⤵
        
        PID:16816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31321.exe
        8⤵
        
        PID:9660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50756.exe
        8⤵
        
        PID:14148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        8⤵
        
        PID:16572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10035.exe
        7⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51187.exe
        8⤵
        
        PID:9640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4649.exe
        8⤵
        
        PID:13532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        8⤵
        
        PID:16420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4508.exe
        7⤵
        
        PID:11448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7419.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53125.exe
        7⤵
        
        PID:16984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8393.exe
        6⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57203.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30107.exe
        8⤵
        
        PID:15704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7524.exe
        8⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10569.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54028.exe
        7⤵
        
        PID:14816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        7⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35713.exe
        6⤵
        
        PID:8460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48715.exe
        7⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22520.exe
        7⤵
        
        PID:18376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14809.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21988.exe
        6⤵
        
        PID:15480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56098.exe
        6⤵
        
        PID:10460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35657.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61299.exe
        6⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29907.exe
        7⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48195.exe
        8⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51530.exe
        8⤵
        
        PID:13124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56010.exe
        7⤵
        
        PID:10164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26531.exe
        7⤵
        
        PID:13880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        7⤵
        
        PID:16824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-441.exe
        6⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51110.exe
        7⤵
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31428.exe
        7⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35104.exe
        7⤵
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52177.exe
        6⤵
        
        PID:10512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45852.exe
        6⤵
        
        PID:13820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        6⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4147.exe
        5⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23846.exe
        6⤵
        
        PID:8100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44202.exe
        6⤵
        
        PID:11204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53753.exe
        6⤵
        
        PID:14372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        6⤵
        
        PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49533.exe
        5⤵
        
        PID:7244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52548.exe
        5⤵
        
        PID:12028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10906.exe
        5⤵
        
        PID:6156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20176.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40038.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27558.exe
        6⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27987.exe
        7⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2853.exe
        8⤵
        
        PID:11280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31569.exe
        8⤵
        
        PID:15208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63501.exe
        7⤵
        
        PID:9956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        7⤵
        
        PID:13832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        7⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32236.exe
        6⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19696.exe
        6⤵
        
        PID:10572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45852.exe
        6⤵
        
        PID:14492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53125.exe
        6⤵
        
        PID:16736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64013.exe
        5⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22310.exe
        6⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47171.exe
        7⤵
        
        PID:11844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42913.exe
        7⤵
        
        PID:15568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62761.exe
        7⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57113.exe
        7⤵
        
        PID:17988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42281.exe
        6⤵
        
        PID:10900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60210.exe
        6⤵
        
        PID:15584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        6⤵
        
        PID:4792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1888.exe
        5⤵
        
        PID:8256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41780.exe
        5⤵
        
        PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58866.exe
        5⤵
        
        PID:8648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47194.exe
      4⤵
      PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2965.exe
        5⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23379.exe
        6⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15715.exe
        7⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35297.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        7⤵
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21417.exe
        6⤵
        
        PID:9836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40756.exe
        6⤵
        
        PID:13536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        6⤵
        
        PID:16604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64353.exe
        5⤵
        
        PID:8516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9049.exe
        5⤵
        
        PID:12620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40828.exe
        5⤵
        
        PID:2564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13080.exe
        5⤵
        
        PID:17948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45748.exe
      4⤵
      PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49798.exe
        5⤵
        
        PID:800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4336.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15140.exe
        5⤵
        
        PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24127.exe
        5⤵
        
        PID:8808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51629.exe
      4⤵
      PID:8900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59523.exe
      4⤵
      PID:11876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61873.exe
      4⤵
      PID:16288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8736.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8736.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29747.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29747.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22438.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25622.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56317.exe
        6⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35667.exe
        7⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34742.exe
        8⤵
        
        PID:9264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20876.exe
        8⤵
        
        PID:13940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        8⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22185.exe
        7⤵
        
        PID:9672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40756.exe
        7⤵
        
        PID:13564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        7⤵
        
        PID:16412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14176.exe
        6⤵
        
        PID:7208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25562.exe
        6⤵
        
        PID:10588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-984.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        6⤵
        
        PID:6616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12601.exe
        5⤵
        
        PID:4760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40179.exe
        6⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16902.exe
        7⤵
        
        PID:13152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47765.exe
        7⤵
        
        PID:15576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51248.exe
        7⤵
        
        PID:18008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
        6⤵
        
        PID:9200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31523.exe
        6⤵
        
        PID:13280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65061.exe
        6⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14706.exe
        6⤵
        
        PID:18248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63745.exe
        5⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62230.exe
        6⤵
        
        PID:10524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31569.exe
        6⤵
        
        PID:14784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        6⤵
        
        PID:16468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43322.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5776.exe
        5⤵
        
        PID:13652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53125.exe
        5⤵
        
        PID:16476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54765.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13717.exe
        5⤵
        Executes dropped EXE
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51590.exe
        6⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5013.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19312.exe
        7⤵
        
        PID:11660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61829.exe
        7⤵
        
        PID:15540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        7⤵
        
        PID:5896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64058.exe
        6⤵
        
        PID:7756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34304.exe
        6⤵
        
        PID:11784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60210.exe
        6⤵
        
        PID:15508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        6⤵
        
        PID:16540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34812.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-789.exe
        6⤵
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29750.exe
        7⤵
        
        PID:11052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12820.exe
        7⤵
        
        PID:14804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
        7⤵
        
        PID:16704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41612.exe
        6⤵
        
        PID:12160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63525.exe
        6⤵
        
        PID:3572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45952.exe
        6⤵
        
        PID:17884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59549.exe
        5⤵
        
        PID:9172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42180.exe
        5⤵
        
        PID:13296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7188.exe
        5⤵
        
        PID:5692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32450.exe
        5⤵
        
        PID:18324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26336.exe
      4⤵
      PID:4676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28259.exe
        5⤵
        
        PID:6280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55174.exe
        6⤵
        
        PID:7852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56973.exe
        6⤵
        
        PID:11064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60210.exe
        6⤵
        
        PID:15492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        6⤵
        
        PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52621.exe
        5⤵
        
        PID:8284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55348.exe
        5⤵
        
        PID:12136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25560.exe
        5⤵
        
        PID:5016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63708.exe
        5⤵
        
        PID:18172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41834.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41834.exe
      4⤵
      PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46035.exe
        5⤵
        
        PID:13376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64485.exe
        5⤵
        
        PID:15660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32415.exe
        5⤵
        
        PID:17924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40988.exe
      4⤵
      PID:9920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31190.exe
      4⤵
      PID:14252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49536.exe
      4⤵
      PID:5568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57450.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57450.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24854.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13634.exe
        5⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19494.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22310.exe
        7⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42281.exe
        7⤵
        
        PID:10916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20587.exe
        7⤵
        
        PID:15224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        7⤵
        
        PID:16628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52621.exe
        6⤵
        
        PID:8292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55348.exe
        6⤵
        
        PID:12048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59468.exe
        6⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49784.exe
        6⤵
        
        PID:9616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52026.exe
        5⤵
        
        PID:6788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16217.exe
        6⤵
        
        PID:7912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        6⤵
        
        PID:12360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26002.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        6⤵
        
        PID:15580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52900.exe
        5⤵
        
        PID:8604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14809.exe
        5⤵
        
        PID:11896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17336.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2504.exe
        5⤵
        
        PID:8908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42585.exe
      4⤵
      PID:752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19494.exe
        5⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21977.exe
        6⤵
        
        PID:8480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8944.exe
        6⤵
        
        PID:11524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57164.exe
        6⤵
        
        PID:428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13080.exe
        6⤵
        
        PID:17904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22745.exe
        5⤵
        
        PID:8416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8643.exe
        5⤵
        
        PID:11308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39785.exe
        5⤵
        
        PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13080.exe
        5⤵
        
        PID:17896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16752.exe
      4⤵
      PID:6860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62502.exe
        5⤵
        
        PID:9124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51530.exe
        5⤵
        
        PID:13212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5800.exe
        5⤵
        
        PID:17180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45242.exe
      4⤵
      PID:8056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62465.exe
      4⤵
      PID:12996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53125.exe
      4⤵
      PID:6564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48596.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48596.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
      4⤵
      PID:1932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38243.exe
        5⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3477.exe
        6⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37756.exe
        6⤵
        
        PID:10548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3784.exe
        6⤵
        
        PID:14760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        6⤵
        
        PID:6984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46077.exe
        5⤵
        
        PID:7232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49731.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe
        6⤵
        
        PID:11756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26139.exe
        6⤵
        
        PID:15568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57113.exe
        6⤵
        
        PID:18048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44673.exe
        5⤵
        
        PID:9812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39325.exe
        5⤵
        
        PID:14240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        5⤵
        
        PID:16588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3017.exe
      4⤵
      PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48195.exe
        5⤵
        
        PID:8392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51530.exe
        5⤵
        
        PID:13356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5800.exe
        5⤵
        
        PID:17172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39377.exe
      4⤵
      PID:8476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59309.exe
      4⤵
      PID:13160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9992.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9992.exe
      4⤵
      PID:15484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6360.exe
      4⤵
      PID:17652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7001.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7001.exe
    3⤵
    PID:3548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28259.exe
      4⤵
      PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38838.exe
        5⤵
        
        PID:8028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44202.exe
        5⤵
        
        PID:11216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3483.exe
        5⤵
        
        PID:15344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        5⤵
        
        PID:16712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4681.exe
      4⤵
      PID:8348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55348.exe
      4⤵
      PID:12172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56780.exe
      4⤵
      PID:2980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31912.exe
      4⤵
      PID:17920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49350.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49350.exe
    3⤵
    PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48195.exe
      4⤵
      PID:7796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35297.exe
      4⤵
      PID:14100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
      4⤵
      PID:6120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36328.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36328.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2388.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2388.exe
    3⤵
    PID:13252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16113.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16113.exe
    3⤵
    PID:5184
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34745.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34745.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49702.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49702.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39251.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9749.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30230.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63110.exe
        7⤵
        
        PID:5328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28259.exe
        8⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62579.exe
        9⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49962.exe
        9⤵
        
        PID:2260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50572.exe
        9⤵
        
        PID:14536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        9⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16284.exe
        8⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19696.exe
        8⤵
        
        PID:10612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9649.exe
        8⤵
        
        PID:14740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        8⤵
        
        PID:16888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61716.exe
        7⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45053.exe
        8⤵
        
        PID:8320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64897.exe
        8⤵
        
        PID:14104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        8⤵
        
        PID:16452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41786.exe
        7⤵
        
        PID:9680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37955.exe
        7⤵
        
        PID:13516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        7⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62378.exe
        6⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23350.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14645.exe
        8⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51530.exe
        8⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60176.exe
        8⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26876.exe
        7⤵
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65265.exe
        7⤵
        
        PID:12356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49602.exe
        7⤵
        
        PID:2956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15391.exe
        7⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46916.exe
        6⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21302.exe
        7⤵
        
        PID:11492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30417.exe
        7⤵
        
        PID:14260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
        7⤵
        
        PID:1416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43322.exe
        6⤵
        
        PID:10060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44955.exe
        6⤵
        
        PID:15184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48659.exe
        6⤵
        
        PID:16904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9980.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16323.exe
        6⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7820.exe
        7⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65219.exe
        8⤵
        
        PID:9328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33948.exe
        8⤵
        
        PID:14272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
        8⤵
        
        PID:16768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30448.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39333.exe
        7⤵
        
        PID:14572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        7⤵
        
        PID:16880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41068.exe
        6⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30448.exe
        6⤵
        
        PID:10336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39333.exe
        6⤵
        
        PID:14580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54585.exe
        6⤵
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33347.exe
        5⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16723.exe
        6⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49731.exe
        7⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60732.exe
        7⤵
        
        PID:1160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8812.exe
        6⤵
        
        PID:3540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31523.exe
        6⤵
        
        PID:13208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        6⤵
        
        PID:4772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8092.exe
        5⤵
        
        PID:440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48195.exe
        6⤵
        
        PID:7780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51530.exe
        6⤵
        
        PID:13304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12683.exe
        6⤵
        
        PID:14380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7720.exe
        6⤵
        
        PID:9376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57329.exe
        5⤵
        
        PID:9256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45929.exe
        5⤵
        
        PID:11252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
        5⤵
        
        PID:1892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21328.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46307.exe
        5⤵
        
        PID:2100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51590.exe
        6⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23379.exe
        7⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8802.exe
        8⤵
        
        PID:9868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60378.exe
        8⤵
        
        PID:13608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        8⤵
        
        PID:5064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21228.exe
        7⤵
        
        PID:10628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54517.exe
        7⤵
        
        PID:14860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        7⤵
        
        PID:16460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53690.exe
        6⤵
        
        PID:8232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55348.exe
        6⤵
        
        PID:12104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56780.exe
        6⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31912.exe
        6⤵
        
        PID:18156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45565.exe
        5⤵
        
        PID:6692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49798.exe
        6⤵
        
        PID:8304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41612.exe
        6⤵
        
        PID:12076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65445.exe
        6⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31343.exe
        6⤵
        
        PID:9268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3507.exe
        5⤵
        
        PID:8576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14809.exe
        5⤵
        
        PID:11488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41505.exe
        5⤵
        
        PID:3984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15236.exe
        5⤵
        
        PID:18100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14604.exe
      4⤵
      PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38627.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13093.exe
        6⤵
        
        PID:7480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10569.exe
        6⤵
        
        PID:10792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54028.exe
        6⤵
        
        PID:14724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        6⤵
        
        PID:16992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6684.exe
        5⤵
        
        PID:8544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8944.exe
        5⤵
        
        PID:11516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22872.exe
        5⤵
        
        PID:3916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39313.exe
      4⤵
      PID:6468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34614.exe
        5⤵
        
        PID:7484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20076.exe
        5⤵
        
        PID:11772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54345.exe
        5⤵
        
        PID:15516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        5⤵
        
        PID:16392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51629.exe
      4⤵
      PID:8712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23477.exe
      4⤵
      PID:11212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61873.exe
      4⤵
      PID:16352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47760.exe
      4⤵
      PID:17600
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2857.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2857.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6524.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32083.exe
        5⤵
        
        PID:1404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6437.exe
        6⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29539.exe
        7⤵
        
        PID:8656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18089.exe
        7⤵
        
        PID:12680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13835.exe
        7⤵
        
        PID:15716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57497.exe
        7⤵
        
        PID:9468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15724.exe
        6⤵
        
        PID:8196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49588.exe
        6⤵
        
        PID:12332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48005.exe
        6⤵
        
        PID:3764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        6⤵
        
        PID:16936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17337.exe
        5⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30982.exe
        6⤵
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17788.exe
        6⤵
        
        PID:13164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29035.exe
        6⤵
        
        PID:6924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36772.exe
        5⤵
        
        PID:10076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30778.exe
        5⤵
        
        PID:13660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        5⤵
        
        PID:16760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58241.exe
      4⤵
      PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29494.exe
        5⤵
        
        PID:6384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34531.exe
        6⤵
        
        PID:8396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60445.exe
        6⤵
        
        PID:11300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48834.exe
        6⤵
        
        PID:13624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29423.exe
        6⤵
        
        PID:17880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57229.exe
        5⤵
        
        PID:8692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25747.exe
        5⤵
        
        PID:11764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26002.exe
        5⤵
        
        PID:16300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24127.exe
        5⤵
        
        PID:8532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26157.exe
      4⤵
      PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64835.exe
        5⤵
        
        PID:9668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50778.exe
        5⤵
        
        PID:14152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
        5⤵
        
        PID:16620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23186.exe
      4⤵
      PID:11236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45219.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45219.exe
      4⤵
      PID:15316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43324.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43324.exe
      4⤵
      PID:16844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2851.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2851.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50915.exe
        5⤵
        
        PID:5636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28342.exe
        6⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12709.exe
        7⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48715.exe
        8⤵
        
        PID:888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38088.exe
        8⤵
        
        PID:10184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-969.exe
        7⤵
        
        PID:11072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45305.exe
        7⤵
        
        PID:15148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        7⤵
        
        PID:16612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55309.exe
        6⤵
        
        PID:8568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8944.exe
        6⤵
        
        PID:11564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42857.exe
        6⤵
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64201.exe
        6⤵
        
        PID:18288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61716.exe
        5⤵
        
        PID:6876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9530.exe
        6⤵
        
        PID:14868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58725.exe
        6⤵
        
        PID:16488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50529.exe
        5⤵
        
        PID:10388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14132.exe
        5⤵
        
        PID:14560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe
        5⤵
        
        PID:1016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5305.exe
      4⤵
      PID:6020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39686.exe
        5⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24915.exe
        6⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25222.exe
        7⤵
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52492.exe
        7⤵
        
        PID:14460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        7⤵
        
        PID:16564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41596.exe
        6⤵
        
        PID:10956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60210.exe
        6⤵
        
        PID:15576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        6⤵
        
        PID:16728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29932.exe
        5⤵
        
        PID:7176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55348.exe
        5⤵
        
        PID:12112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8347.exe
        5⤵
        
        PID:10752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63708.exe
        5⤵
        
        PID:18240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53757.exe
      4⤵
      PID:7372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63683.exe
        5⤵
        
        PID:10644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56649.exe
        5⤵
        
        PID:15632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        5⤵
        
        PID:16548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49377.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49377.exe
      4⤵
      PID:10504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49986.exe
      4⤵
      PID:14680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4653.exe
      4⤵
      PID:16944
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19897.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19897.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43235.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52870.exe
        5⤵
        
        PID:7524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62230.exe
        6⤵
        
        PID:10568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31569.exe
        6⤵
        
        PID:15200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
        6⤵
        
        PID:16872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6428.exe
        5⤵
        
        PID:10808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60210.exe
        5⤵
        
        PID:15528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5000.exe
        5⤵
        
        PID:5928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62433.exe
      4⤵
      PID:8268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9817.exe
      4⤵
      PID:12512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56780.exe
      4⤵
      PID:2304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31912.exe
      4⤵
      PID:18020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17875.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17875.exe
    3⤵
    PID:6360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5781.exe
      4⤵
      PID:7892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39204.exe
      4⤵
      PID:12068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56780.exe
      4⤵
      PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63708.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63708.exe
      4⤵
      PID:18192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63165.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63165.exe
    3⤵
    PID:8764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23483.exe
    3⤵
    PID:11612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65437.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65437.exe
    3⤵
    PID:17152
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61169.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61169.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38182.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38182.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10434.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61750.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64262.exe
        6⤵
        
        PID:4716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40179.exe
        7⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15141.exe
        8⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33948.exe
        8⤵
        
        PID:13348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        8⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
        7⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65265.exe
        7⤵
        
        PID:13036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48725.exe
        7⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31919.exe
        7⤵
        
        PID:18344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49517.exe
        6⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63654.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35297.exe
        7⤵
        
        PID:1332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        7⤵
        
        PID:16976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27181.exe
        6⤵
        
        PID:10680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16360.exe
        6⤵
        
        PID:15104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53125.exe
        6⤵
        
        PID:16496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44506.exe
        5⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39686.exe
        6⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15141.exe
        7⤵
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51162.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        7⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
        6⤵
        
        PID:224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54980.exe
        6⤵
        
        PID:13456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        6⤵
        
        PID:6928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63252.exe
        5⤵
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51878.exe
        6⤵
        
        PID:13200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46997.exe
        6⤵
        
        PID:3164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34719.exe
        6⤵
        
        PID:18276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19584.exe
        5⤵
        
        PID:10652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65362.exe
        5⤵
        
        PID:15088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26958.exe
        5⤵
        
        PID:17140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40732.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14485.exe
        5⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10277.exe
        6⤵
        
        PID:6328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56051.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59006.exe
        8⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58725.exe
        8⤵
        
        PID:16800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9900.exe
        7⤵
        
        PID:12708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9883.exe
        7⤵
        
        PID:15752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15384.exe
        7⤵
        
        PID:9352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20825.exe
        6⤵
        
        PID:8312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55348.exe
        6⤵
        
        PID:12216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8347.exe
        6⤵
        
        PID:1576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63708.exe
        6⤵
        
        PID:18164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19436.exe
        5⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32518.exe
        6⤵
        
        PID:9292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17788.exe
        6⤵
        
        PID:13136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        6⤵
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8432.exe
        5⤵
        
        PID:9180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5593.exe
        5⤵
        
        PID:12836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26623.exe
        5⤵
        
        PID:8616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8656.exe
      4⤵
      PID:5304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23350.exe
        5⤵
        
        PID:7040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28003.exe
        6⤵
        
        PID:8508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60746.exe
        6⤵
        
        PID:11536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14708.exe
        6⤵
        
        PID:1168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14706.exe
        6⤵
        
        PID:18224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64925.exe
        5⤵
        
        PID:7772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36433.exe
        5⤵
        
        PID:12480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26002.exe
        5⤵
        
        PID:16344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42384.exe
        5⤵
        
        PID:8860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52781.exe
      4⤵
      PID:1000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33395.exe
        5⤵
        
        PID:9332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58733.exe
        5⤵
        
        PID:12784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
        5⤵
        
        PID:16912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33971.exe
      4⤵
      PID:10032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5577.exe
      4⤵
      PID:13644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4653.exe
      4⤵
      PID:16640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39385.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39385.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13317.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16707.exe
        5⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39686.exe
        6⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50582.exe
        7⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13932.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20136.exe
        7⤵
        
        PID:16328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36930.exe
        7⤵
        
        PID:17104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28329.exe
        6⤵
        
        PID:8436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31523.exe
        6⤵
        
        PID:12284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49321.exe
        6⤵
        
        PID:7808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33180.exe
        5⤵
        
        PID:7076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27181.exe
        5⤵
        
        PID:10668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16360.exe
        5⤵
        
        PID:15096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53125.exe
        5⤵
        
        PID:16852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14220.exe
      4⤵
      PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39686.exe
        5⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15458.exe
        6⤵
        
        PID:11224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57660.exe
        6⤵
        
        PID:3200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57113.exe
        6⤵
        
        PID:17928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
        5⤵
        
        PID:8300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31523.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        5⤵
        
        PID:16920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46916.exe
      4⤵
      PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10098.exe
        5⤵
        
        PID:14428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58725.exe
        5⤵
        
        PID:16596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42637.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64210.exe
      4⤵
      PID:14632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5530.exe
      4⤵
      PID:6052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24016.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24016.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1548.exe
      4⤵
      PID:5980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32640.exe
        5⤵
        
        PID:9136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-300.exe
        5⤵
        
        PID:13220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58041.exe
        5⤵
        
        PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29224.exe
        5⤵
        
        PID:9032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52817.exe
      4⤵
      PID:8444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14508.exe
      4⤵
      PID:11292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39969.exe
      4⤵
      PID:15460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48978.exe
      4⤵
      PID:18056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27293.exe
    3⤵
    PID:5464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13378.exe
      4⤵
      PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61862.exe
        5⤵
        
        PID:11968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12024.exe
        5⤵
        
        PID:2424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
        5⤵
        
        PID:18092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49962.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49962.exe
      4⤵
      PID:9944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50572.exe
      4⤵
      PID:14496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
      4⤵
      PID:16784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14832.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14832.exe
    3⤵
    PID:7540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-828.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-828.exe
    3⤵
    PID:10820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18317.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18317.exe
    3⤵
    PID:15136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48659.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48659.exe
    3⤵
    PID:16864
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21772.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21772.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36307.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8725.exe
        5⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2802.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43054.exe
        7⤵
        
        PID:15216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57602.exe
        7⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21500.exe
        6⤵
        
        PID:9704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40756.exe
        6⤵
        
        PID:13548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9903.exe
        6⤵
        
        PID:8624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64909.exe
        5⤵
        
        PID:7236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61862.exe
        6⤵
        
        PID:11988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8980.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
        6⤵
        
        PID:6960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19696.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45852.exe
        5⤵
        
        PID:15380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54002.exe
        5⤵
        
        PID:5828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64013.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64013.exe
      4⤵
      PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22310.exe
        5⤵
        
        PID:7712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9900.exe
        5⤵
        
        PID:12684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17336.exe
        5⤵
        
        PID:16276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43528.exe
        5⤵
        
        PID:8796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-819.exe
      4⤵
      PID:8272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
      4⤵
      PID:12096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6337.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6337.exe
      4⤵
      PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48978.exe
      4⤵
      PID:17976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31900.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31900.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24486.exe
      4⤵
      PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18454.exe
        5⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49277.exe
        6⤵
        
        PID:8564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50572.exe
        6⤵
        
        PID:14520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13665.exe
        6⤵
        
        PID:6248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21500.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40756.exe
        5⤵
        
        PID:13556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12788.exe
        5⤵
        
        PID:16664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16969.exe
      4⤵
      PID:7268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52563.exe
        5⤵
        
        PID:13284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47765.exe
        5⤵
        
        PID:15728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35104.exe
        5⤵
        
        PID:9008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19696.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19696.exe
      4⤵
      PID:10596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45852.exe
      4⤵
      PID:15372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53125.exe
      4⤵
      PID:16832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12211.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12211.exe
    3⤵
    PID:5992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6850.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6850.exe
      4⤵
      PID:7668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9900.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9900.exe
      4⤵
      PID:12692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25944.exe
      4⤵
      PID:5048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49208.exe
      4⤵
      PID:9432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56077.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56077.exe
    3⤵
    PID:8332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52548.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:12152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8877.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8877.exe
    3⤵
    PID:2296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59242.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59242.exe
    3⤵
    PID:18140
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35238.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35238.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24870.exe
      4⤵
      PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39686.exe
        5⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15141.exe
        6⤵
        
        PID:9080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18105.exe
        6⤵
        
        PID:14128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
        6⤵
        
        PID:16688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
        5⤵
        
        PID:9168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65265.exe
        5⤵
        
        PID:12272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16244.exe
        5⤵
        
        PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48448.exe
        5⤵
        
        PID:18040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15712.exe
      4⤵
      PID:7384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7301.exe
        5⤵
        
        PID:400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58725.exe
        5⤵
        
        PID:16532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57357.exe
      4⤵
      PID:10540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29316.exe
      4⤵
      PID:15124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4653.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4653.exe
      4⤵
      PID:16776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24220.exe
    3⤵
    PID:5544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65309.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65309.exe
      4⤵
      PID:9016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5488.exe
      4⤵
      PID:12652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16628.exe
      4⤵
      PID:2052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48448.exe
      4⤵
      PID:18148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60196.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60196.exe
    3⤵
    PID:8064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61213.exe
    3⤵
    PID:12120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24785.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24785.exe
    3⤵
    PID:5260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23425.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23425.exe
    3⤵
    PID:9556
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10457.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10457.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25939.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25939.exe
    3⤵
    PID:5776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65430.exe
      4⤵
      PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51110.exe
        5⤵
        
        PID:10992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45461.exe
        5⤵
        
        PID:16152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17506.exe
        5⤵
        
        PID:18200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8812.exe
      4⤵
      PID:2480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31523.exe
      4⤵
      PID:3684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16244.exe
      4⤵
      PID:5480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15007.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15007.exe
      4⤵
      PID:9304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
    3⤵
    PID:3488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16182.exe
      4⤵
      PID:9276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17788.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6923.exe
      4⤵
      PID:16808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-652.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-652.exe
    3⤵
    PID:9832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30659.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30659.exe
    3⤵
    PID:14220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53125.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53125.exe
    3⤵
    PID:16792
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52515.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52515.exe
  2⤵
  PID:5272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38838.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38838.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46963.exe
      4⤵
      PID:10816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40292.exe
      4⤵
      PID:14748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7800.exe
      4⤵
      PID:16428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39204.exe
    3⤵
    PID:12060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25560.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25560.exe
    3⤵
    PID:2020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33448.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33448.exe
    3⤵
    PID:9532
- C:\Users\Admin\AppData\Local\Temp\Unicorn-58699.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-58699.exe
  2⤵
  PID:8372
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46497.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46497.exe
  2⤵
  PID:10932
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4808
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53033.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53033.exe
  2⤵
  PID:10296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2648 -ip 2648
1⤵
PID:3780

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:14904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10434.exe

Filesize
468KB

MD5
5c8fb1f2f7e43b2061dea3c2926064c5

SHA1
1a3242fbcb7f075a4181ba11c1cff991a7b6b422

SHA256
b310f7a2d9332b12a59a73c6da10c46fea285f68dbff546e517ceeab429158d9

SHA512
b3cc210327ed65a5471bcafed8784a66938895839e4e39fed5a5069da9a41a36e59180820e176adc8f23d260a0c5faea3df8a756e58efbb5fe06374ec9bff447

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1077.exe

Filesize
468KB

MD5
75c664370302890f5944aa21ba55c9c3

SHA1
670ea2696a763e77a65c2a3b4908478b6ea2d1ca

SHA256
997e3cb6cad65be8b9e0ffc05aeb6adf602753b1f1986785daf44f69f597bafd

SHA512
55a7fbe5bc38fc4264f9bf89f3a64b04befd19c2d61c6cc7952725f8f38059e07b1f1a841a3574f3c7618387678af080e799f46c5e1373f15c1d3264d10b7823

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15740.exe

Filesize
468KB

MD5
41a5a394c2cdd8f4eab44e5ca3e19805

SHA1
7471e252c99deebbdb44949351532b7821cfada1

SHA256
1e6208980e556cc981e4164e44c85e19fc0c9776836487a0a1efef6d60aed391

SHA512
ad9838dd0e61b3f332de7fa1ebcf9d30994ecf08955419cfec171ff9c29e29e78079b109c5983eca4641ffd2ea39c8e3a9030ddf2c6d6b3644f34283d5e5c289

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18316.exe

Filesize
468KB

MD5
0376a303a9910171f3af6660e8787084

SHA1
963c24f720d69e8202a6f9607790d41dd4739add

SHA256
9d814fbc9fbb2a89387b26d3c20d4eda271e093b1cd8b0ea6ef74c22f298bae1

SHA512
0a611ec312d42a7dd3aac27869df1968e923d116aebe9f4f70dd326030ce74e9f596fcd33ad9e56d44abe0ce3ab31b72d4841fd688b4e74a47810eeb695d118e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20176.exe

Filesize
468KB

MD5
db437ec1b82d279a4514162489e65a25

SHA1
6fa321aeddbcfaee95fe0bbb1d3454176c94d937

SHA256
dfc006d04edefea6d814bbe1982ca3102f8d757f6dc0e4830eb473275db36be7

SHA512
f7e94c958af90dfc598ebe172ba86cb24b5896bb101436c6df2934954125c5e188b10f57f1f3dd7e8b7f16b56f135e04a80887bb1af8ef1df8e91eedba4bb7e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21772.exe

Filesize
468KB

MD5
3f6ec65e24767ba8c52134a6c03dc3fa

SHA1
205635e12182ec74392d6fd1a5d3475987dcfead

SHA256
0472c5ee0726f22656a3620e967f1e594e84e9e0b178f98358df9e19d2561e2e

SHA512
abf6aa254bb4e6b5f02ee417dcf76c37e4be6b52eb1f177b1f5abe214af1b7e9f432cd4edcb2da177634a7df4656a77ade5ea253599ba39d2ea8f812c570a20f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22438.exe

Filesize
468KB

MD5
61d5cc896ac53eb78bc851248eb2a784

SHA1
eb3cae20798777d33ee1554feac9968f84b0745a

SHA256
b404682e80c4c92628b5949c0c2bc60d79242690241f1cd2d75c897584bee70e

SHA512
58e285bb16b46254267b8dd9883dc12b868b405d576db4b79517e41a1dff87ab39218328d52d24c6ac94cb049f0c667b8399a54f3e4577e962a1f291643c7596

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2572.exe

Filesize
468KB

MD5
b56e20317ddc70022b1fed3172b28b61

SHA1
6fdb9ab244767a60c82dff617df3e635f3a91eb9

SHA256
e81e6c706e67d67d685ae0327e4bd9e61a010227537e5a22a841ceab7001ef5b

SHA512
ff461657d95c9ee4855896575fca70180e90c0e7360d733ede896b1088681452b7927e9cbf46b37cf42e07cedb428be8c8e1abb82f29fd7f1759c7c7423c37d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2851.exe

Filesize
468KB

MD5
ded21248f71f6e057c18cf71b76c7bdd

SHA1
75f9e8ebc04d2b44ee24128d5fa9134d55690427

SHA256
19a4118b6cca8b937a0598e6012b8a21f511ce7ff7c4a3201a46a8cc1b7f803f

SHA512
d2aa47affd29ad2cbcdf79c49f287d754945e2ca2939b7b67ad55397d6335c25dea6ba6c903896a69e860d5540cd762bdf6b7171225c4edd309401e0c356d3d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2857.exe

Filesize
468KB

MD5
f07a2164c57231e5e030f535b6cf9396

SHA1
603aad817f2b71070f9cc8ec6ecb289e6b81bd87

SHA256
ef75810b44e237eaf86cb6b56ec3d8dd72ca488c060f76b49f24d7d7c23e592a

SHA512
61bb6b184b2e284e9ccc18581bbfbf91b8368e524f6361e226497be247f8e2cfce5f3c7502ccbd556dcc6cdf7fed1ac49ef3b92f9a2aabed3c24c2114486d0c0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29747.exe

Filesize
468KB

MD5
6f04e9cccd720867b67a498ec9c88b6e

SHA1
61966a18a7cd940f444fa30cd3ed70faa3a4ec1b

SHA256
9ce960ee44fa2823fdfe5b44b8bc8487fbd3da62a5c1d9ec9404a51fc602701b

SHA512
5d64bbb4800426f478b4a6dd214464aab617c78ff59131b1fbca18bd89b0fb7a29da61b402ebee32f60ecc1046c58bc373f3f7f8efb67ac4e095b9f1b0a10ccf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30905.exe

Filesize
468KB

MD5
2dc2b94bf98dda3dd4602612f7c9a394

SHA1
01346ffd8f63d5a02695bb9d7148b019d67b4bd9

SHA256
00457327e981d0a2b77d2db5edbc8a0244eaac7f948b0696d680ec051713e01f

SHA512
2a740c866a5d11518627d2e11d296377e93e143db5799d5eca310977c1ab4efc0c61ab82cf2e7b5262554f1baf531582cf531eeb78caabaeabe38311382e0c00

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34745.exe

Filesize
468KB

MD5
754d2a0682c7a9f6d28b585b391ee012

SHA1
a4aa4a959ad75f96503cf49c65e4322ee80beb47

SHA256
c0f8be4ca9c36e40285e9ecaa02ae9a494d0572a048c804c360d8d75a58cc6f1

SHA512
f4ded04d84e3a30b27561e8dd8939cff261a35d195afda3dc0d28d92e55495455ff2f16b78d008fd5f8749ac65e0765622bca59e1bfb3fd96f8f8532ad36fd37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35524.exe

Filesize
468KB

MD5
ad0a1ef31f582114ce824d898a327b63

SHA1
f38e4bceba202fc2a8679c3db9908748e4c94046

SHA256
d376337b28bc8d320a18214d4dc4012661e405e11c47579b918ca095e8fcc056

SHA512
d40c19eb342094c17fda34c4865e0ce12a9e9111298214d947cf91a80fae4e7ae54dd2c4c5cbb947da70bf631ef16aba78f0b3de55cf52001f234cade20d2ed3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38182.exe

Filesize
468KB

MD5
a953d325526cdd45430168a552b84f1f

SHA1
4127dc52132764b93d3f5338349f2cef2aa891d8

SHA256
08f4e43c811aae15c0d0b4148b28e86f789df58a1045faa3e2bc20ff529990de

SHA512
7dab582ea0b4335691cf6f68f51b790799f3fd2b77d4c5a5377eef309a9187a988567280fd72e3e75ed691d50cd693a9c18207f84955b32ffaa22ba88aba40ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39251.exe

Filesize
468KB

MD5
39a5ad1464fa5f7de1b37e8ae215f003

SHA1
dc2988019dd97d0f9da6420383dcc5ecf61943a9

SHA256
31f16b31f61acb98e772a841bf239a4784c566691a6a2ef2ad4f22b162c27be8

SHA512
9df8e5a1fb950f3b95721936f7dd5051a711de8219612e18319d1b658797974c467f976d0f144b1643f0fa4aba7687d7019aec9ddfaea41a2c52be23e68c1ba3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39385.exe

Filesize
468KB

MD5
9e0803aa821ab181e20052e25f2e762a

SHA1
12f7e447df20c0304efb34cafd117474ae20db9b

SHA256
38d4853d4e62bfcd3bca8f045edc054aaa3c3806789b7f1ea9ed735c0419f38c

SHA512
5791c87cb409e79c363a33f5c9d69ceed15a0fc56642f531787a1f07ab1ed2f4192f7b6cc186e4544156a03b8a44b5fdfd1e09e01c04849bb1baff2923c43ffa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42835.exe

Filesize
468KB

MD5
d62b90a4a14ded3a10c89b842ca10e17

SHA1
ae0a0ddd34a6c87c904e7863ddd2a5cb7c964bc1

SHA256
45e9ff8eb2d6400ef396e93f5e6b2ebc4767e58be4b9597731b845cafd0f6b33

SHA512
df2a27e08882eb629b6b629f460ba15775ca6406cec8875cf3330673a8283f76da389baa1d0e03049918f5e9ceeb75d011273e1b729f5870af859f88d25b23f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4917.exe

Filesize
468KB

MD5
a275fec06a8279e7b24d0261b79f9655

SHA1
670fc49276a40623111d50ffbce96e8c0f2e70dd

SHA256
c72788a274a3b5df1345399e526731b75aebdbca853e92ff1750905acf00783f

SHA512
f91546440770653ebc79379e03c3413c825a9c83d2f2f971b71e6128d9e8f7d71ac214461a48284333a3caf93424a2ed415f399d91c158e06a1b0efd00474705

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49702.exe

Filesize
468KB

MD5
98a9be3c23a983a4dcec092f4ffefb5f

SHA1
fa8de720114693ffacd47bdfd49b8f60d90c9420

SHA256
d6fa58a40519e3afa02430e3e7f9c16adbb3df7608e80b05adaa3e7092b473c2

SHA512
60b2b4cb2334580adce8a671ba72f87cd58d2a339a51a75fe05ae8e4e478ce063a2b554148d5fc58dfad67151a4e94e4dad0071e0763031348f3f32957b1a3e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50454.exe

Filesize
468KB

MD5
fbb685c7e88049015c1ede278ba655f4

SHA1
fb4633a9984dbbff7dfdfdb5cdf94a160b5ab7a7

SHA256
57df4a30925c4c1adff27314787dcf81a63112e39ca759f59814bb87526681c6

SHA512
41c5d02ec32f74536f36b4511323ab2275b5c9caff669750482a2b2f69d776a3aac743b0bf6de51e59ade3aa176fb56f2460c9098350b1b47593a5c946b02d90

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51.exe

Filesize
468KB

MD5
147f0fd11a4c4bd7b14e0ce99f054d09

SHA1
d05dc479ed9a3702f0a449fc6e5ff237e0bc5000

SHA256
235666d7afb3575dc783d91e28a472ea9db5613fdf1d81826c53dead66c81ebe

SHA512
750a31b1976fb1ed3ec1960dd282c5de3a6adf2a626a3e3147e2e0cb0cfb01571e38ed07c5655dd744d4fe2937b0145cb5b83c51f330891a74b9158c35eda215

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52134.exe

Filesize
468KB

MD5
811c62c3eebc01860524d4d87cbf3d13

SHA1
5be8aae209a4d71df01f6c1057a3f70bb388bd1a

SHA256
8a9ee9ff265c8fd48a3e274daa71cafffbf2f827d9512ed1145d3eacd6787d5e

SHA512
7cb14de92b2a1bfc500060ca575b3a1793c38b16120444d11e7b1a61e2c794a321d32a8b5696047f654c22f306bee28f00bd2bb04a3b45b954aae4b7e08feba2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53859.exe

Filesize
468KB

MD5
9ea8dc1b3269f58bfe03494c64323c3b

SHA1
c2c256128311b83e4f1be2f8b9ff4cffe4a5ce77

SHA256
5d35854020780ae34f86a866198ba1e0edb35e2d0d4dc9d3bf938b507a9cd122

SHA512
6a639e96c150b29f40ec69ffcb725e4cd06fe87006c585b06ffde134540b488146765b7b15a3c46b40419fe7970492452c1db56ba38f4bd6839ed3d2f3edd92e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54653.exe

Filesize
468KB

MD5
eb744c7c4f1da82808217502b13c729c

SHA1
b8f261452da79df34284c9edb51487cd3e33b45e

SHA256
0b56dd19d1f28f4820023381397188875f1d5ffae1a503415fdfc25a88cf296a

SHA512
979951779bfd88acfccd96dcbe47b564fa0b681c40aa365344dbc9f8ae267a64084763a60485a5f7abf1f711638daea2fead13791e59ade89e858887977fba78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55094.exe

Filesize
468KB

MD5
c43e2aa244b7c5a2501feddd16cc9634

SHA1
43e05c0eeb84ecf750f56fc6a8c2714cf9ab2408

SHA256
b0e375c98d3652304c3a8608b0878df445ae562de5d37c2ba45b8cb59b17f584

SHA512
bf46cf8592165573734c0964d6dee504d16ba6d752c2232d7c4e329a25999d0a75968adabbdc9304bf487a009280d1934934a0aea777b6f52d495da25efde0d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56070.exe

Filesize
468KB

MD5
13685e78e8c82f5ff53202d7050da826

SHA1
a7361091455eb4b4dafec245a212f1896bf13e25

SHA256
b9c89b64ec3b276e246692d74d17a39ec2ead4c5cfad31970af797caff4b8190

SHA512
2e09cbcb48d67c3ddf5136cc048617a347c9fcf35d1acfdf383ea369a59f06d5214b7522fcdb298afad718f881be67986c3576b69ddff46ba597bcaae7885b3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57450.exe

Filesize
468KB

MD5
f50dd61ebc51caae8f4c378a24307e6a

SHA1
1cd07f9ae2a105e9a202df890361df18a50c61a9

SHA256
9d883236ab7aaea0d998652d55fccdd0adee11d024a2334512173b67b33bf897

SHA512
7ed7fd223a7ce10e234445c23b51eff922792e87198cb9c2116d77923f7f55cc8dc8438d3e8937d3291c0eb98bb60bffc55164ba804aa1d088de5bb3e52fed36

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61169.exe

Filesize
468KB

MD5
c991fea4360bc77bde7ff4a29529afbd

SHA1
8c204aa075e6c4ea2356da0b571d89ce56cf1cf1

SHA256
b5372292ce62c3a87ff4953c573ac05a0d82be96d30677361dbdfa080adb8d4f

SHA512
833d522f86892ef7a687496f6546c03c9026243de860eea21cfeba61fc737b9003bb9c34a82c0790d172876c5361736cf50f35274cc8351dde170dfcb2649b05

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe

Filesize
468KB

MD5
a8e7e9f38374b3bdabe0eb1c1649c9a1

SHA1
703a682e8417bc37a273c47ffcf3cf28ac40d964

SHA256
861db264449568d4f1fc24ba75ef2739bcf4e24049969eb3f46b5bc30bfc3d48

SHA512
c1c3de1f2a33915925516cd2e95b5d7a129e441b272f4b3e64c9962846a28fc51732e88c76c09d7ab64c93e9dad2d5a9b4a97d38b607b0bb56ad48a6adabbd29

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9749.exe

Filesize
468KB

MD5
9f7bb57f8ef01e14bcd478f74dda9ef3

SHA1
d80b09ff4110aa706b0bd4b6bff37388b04a0602

SHA256
96fcc60c84999c42abc6e5939f82c6b1f9f49da16cab0fe946d7966046916d66

SHA512
3fe87f1c952621c3ab307ff4245f1f615fca1ae72e374aa9c18a3bfc0db5b248591b0689f56ef0ecb45a7a2e6e0ee12f00b97dbbcb941ba6362bbc791d326965

Download Submit
memory/100-184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/456-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/752-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/764-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/828-139-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/856-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/912-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1116-263-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1228-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1500-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1596-38-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1652-154-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1720-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1816-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1832-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1932-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1952-76-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2004-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2068-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2100-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2168-299-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2188-254-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2284-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2348-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2404-185-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2476-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2536-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2568-206-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2636-99-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2648-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2648-497-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2772-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2856-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2872-187-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2964-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3020-91-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3068-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3080-431-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3148-373-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3236-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3444-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3460-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3520-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3548-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3696-251-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3708-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3712-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3720-341-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3736-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3860-147-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3880-123-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4008-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4020-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4024-575-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4124-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4172-46-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4216-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4264-213-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4352-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4376-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4432-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4504-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4592-92-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4656-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4676-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4716-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4760-432-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4788-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4816-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4844-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4864-132-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4928-56-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4936-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4968-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4996-298-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5156-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5212-446-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5224-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5248-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5304-455-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5328-452-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5440-465-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5448-456-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5496-487-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5548-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5560-500-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5636-523-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5716-525-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5724-524-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5776-526-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5792-527-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5820-528-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5840-529-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5860-530-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6020-531-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6080-532-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads