3c38446144efd5e140f109333a959be2322ea235d1722fe88ea562ccf33d9724

Analysis

max time kernel
114s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 02:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3c38446144efd5e140f109333a959be2322ea235d1722fe88ea562ccf33d9724N.exe
Size

468KB
MD5

8fc2e4801eb7c6c9cbb30528d3ea4640
SHA1

bdd59f3114dfe437c9cbd40730a437597c562c2f
SHA256

3c38446144efd5e140f109333a959be2322ea235d1722fe88ea562ccf33d9724
SHA512

ce0a61234321ec7673db0371467caeaf75eac5450d41e406f604d725719d0c84be837953a3850579e50d0aafc7e7e2e5262712b840f57ebae2c8edf352099d3e
SSDEEP

3072:4belogxaIU57tbYFPzcfmbfD/n2DnsIH99myeQVqxu9KkZgduxulr:4b4oCc7tmP4fmbfraSBu9Didux

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1696	Unicorn-5608.exe
2496	Unicorn-35990.exe
1308	Unicorn-31391.exe
852	Unicorn-6405.exe
3468	Unicorn-32070.exe
3436	Unicorn-2876.exe
2968	Unicorn-2975.exe
64	Unicorn-21689.exe
3340	Unicorn-6229.exe
4360	Unicorn-53712.exe
4992	Unicorn-7775.exe
2344	Unicorn-1910.exe
4788	Unicorn-3925.exe
3000	Unicorn-63140.exe
1380	Unicorn-64288.exe
4600	Unicorn-4200.exe
912	Unicorn-50749.exe
3080	Unicorn-43526.exe
628	Unicorn-9784.exe
1312	Unicorn-1539.exe
3240	Unicorn-10469.exe
4320	Unicorn-3270.exe
2488	Unicorn-9135.exe
1088	Unicorn-55072.exe
1936	Unicorn-20470.exe
1484	Unicorn-5944.exe
224	Unicorn-51616.exe
3580	Unicorn-55830.exe
3952	Unicorn-63898.exe
4068	Unicorn-55565.exe
3012	Unicorn-5669.exe
2736	Unicorn-56681.exe
3244	Unicorn-36815.exe
4864	Unicorn-35092.exe
2520	Unicorn-52384.exe
4752	Unicorn-15573.exe
2996	Unicorn-61053.exe
5080	Unicorn-15189.exe
4908	Unicorn-15189.exe
1616	Unicorn-54000.exe
4916	Unicorn-13928.exe
2536	Unicorn-30265.exe
3076	Unicorn-21334.exe
2592	Unicorn-57684.exe
2064	Unicorn-63814.exe
3372	Unicorn-10015.exe
4800	Unicorn-29616.exe
1208	Unicorn-10015.exe
4572	Unicorn-19030.exe
4532	Unicorn-54909.exe
2768	Unicorn-57862.exe
2688	Unicorn-4748.exe
2840	Unicorn-26425.exe
4284	Unicorn-10965.exe
400	Unicorn-10965.exe
3452	Unicorn-39916.exe
4544	Unicorn-4451.exe
1624	Unicorn-10389.exe
3432	Unicorn-10389.exe
5020	Unicorn-55869.exe
2332	Unicorn-10197.exe
1048	Unicorn-5407.exe
4744	Unicorn-25008.exe
3664	Unicorn-19142.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
12456	10524	WerFault.exe	483

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28022.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45716.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44358.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13928.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38091.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-104.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56080.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2069.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20950.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50845.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13619.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19381.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57302.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56633.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43527.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11628.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41558.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15929.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55522.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61622.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64807.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43527.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3683.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9132.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6229.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30342.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43933.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27600.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40076.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64934.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11647.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36240.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	16464	dwm.exe
Token: SeChangeNotifyPrivilege	16464	dwm.exe
Token: 33	16464	dwm.exe
Token: SeIncBasePriorityPrivilege	16464	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4156	3c38446144efd5e140f109333a959be2322ea235d1722fe88ea562ccf33d9724N.exe
1696	Unicorn-5608.exe
1308	Unicorn-31391.exe
2496	Unicorn-35990.exe
3436	Unicorn-2876.exe
852	Unicorn-6405.exe
3468	Unicorn-32070.exe
2968	Unicorn-2975.exe
64	Unicorn-21689.exe
2344	Unicorn-1910.exe
4992	Unicorn-7775.exe
4360	Unicorn-53712.exe
3340	Unicorn-6229.exe
4788	Unicorn-3925.exe
3000	Unicorn-63140.exe
1380	Unicorn-64288.exe
4600	Unicorn-4200.exe
912	Unicorn-50749.exe
3080	Unicorn-43526.exe
628	Unicorn-9784.exe
1088	Unicorn-55072.exe
3240	Unicorn-10469.exe
1312	Unicorn-1539.exe
2488	Unicorn-9135.exe
4320	Unicorn-3270.exe
1936	Unicorn-20470.exe
3952	Unicorn-63898.exe
3580	Unicorn-55830.exe
224	Unicorn-51616.exe
1484	Unicorn-5944.exe
4068	Unicorn-55565.exe
4864	Unicorn-35092.exe
3244	Unicorn-36815.exe
2736	Unicorn-56681.exe
3012	Unicorn-5669.exe
2520	Unicorn-52384.exe
4752	Unicorn-15573.exe
2996	Unicorn-61053.exe
5080	Unicorn-15189.exe
4916	Unicorn-13928.exe
4908	Unicorn-15189.exe
2536	Unicorn-30265.exe
4800	Unicorn-29616.exe
1616	Unicorn-54000.exe
2064	Unicorn-63814.exe
2592	Unicorn-57684.exe
3372	Unicorn-10015.exe
1208	Unicorn-10015.exe
3076	Unicorn-21334.exe
4572	Unicorn-19030.exe
4532	Unicorn-54909.exe
2768	Unicorn-57862.exe
2688	Unicorn-4748.exe
4284	Unicorn-10965.exe
400	Unicorn-10965.exe
2840	Unicorn-26425.exe
4544	Unicorn-4451.exe
3452	Unicorn-39916.exe
3432	Unicorn-10389.exe
5020	Unicorn-55869.exe
1624	Unicorn-10389.exe
2332	Unicorn-10197.exe
1048	Unicorn-5407.exe
4744	Unicorn-25008.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 1696	4156	3c38446144efd5e140f109333a959be2322ea235d1722fe88ea562ccf33d9724N.exe	89
PID 4156 wrote to memory of 1696	4156	3c38446144efd5e140f109333a959be2322ea235d1722fe88ea562ccf33d9724N.exe	89
PID 4156 wrote to memory of 1696	4156	3c38446144efd5e140f109333a959be2322ea235d1722fe88ea562ccf33d9724N.exe	89
PID 1696 wrote to memory of 2496	1696	Unicorn-5608.exe	92
PID 1696 wrote to memory of 2496	1696	Unicorn-5608.exe	92
PID 1696 wrote to memory of 2496	1696	Unicorn-5608.exe	92
PID 4156 wrote to memory of 1308	4156	3c38446144efd5e140f109333a959be2322ea235d1722fe88ea562ccf33d9724N.exe	93
PID 4156 wrote to memory of 1308	4156	3c38446144efd5e140f109333a959be2322ea235d1722fe88ea562ccf33d9724N.exe	93
PID 4156 wrote to memory of 1308	4156	3c38446144efd5e140f109333a959be2322ea235d1722fe88ea562ccf33d9724N.exe	93
PID 1308 wrote to memory of 852	1308	Unicorn-31391.exe	95
PID 1308 wrote to memory of 852	1308	Unicorn-31391.exe	95
PID 1308 wrote to memory of 852	1308	Unicorn-31391.exe	95
PID 4156 wrote to memory of 3468	4156	3c38446144efd5e140f109333a959be2322ea235d1722fe88ea562ccf33d9724N.exe	96
PID 4156 wrote to memory of 3468	4156	3c38446144efd5e140f109333a959be2322ea235d1722fe88ea562ccf33d9724N.exe	96
PID 4156 wrote to memory of 3468	4156	3c38446144efd5e140f109333a959be2322ea235d1722fe88ea562ccf33d9724N.exe	96
PID 1696 wrote to memory of 3436	1696	Unicorn-5608.exe	97
PID 1696 wrote to memory of 3436	1696	Unicorn-5608.exe	97
PID 1696 wrote to memory of 3436	1696	Unicorn-5608.exe	97
PID 2496 wrote to memory of 2968	2496	Unicorn-35990.exe	100
PID 2496 wrote to memory of 2968	2496	Unicorn-35990.exe	100
PID 2496 wrote to memory of 2968	2496	Unicorn-35990.exe	100
PID 852 wrote to memory of 64	852	Unicorn-6405.exe	101
PID 852 wrote to memory of 64	852	Unicorn-6405.exe	101
PID 852 wrote to memory of 64	852	Unicorn-6405.exe	101
PID 3436 wrote to memory of 3340	3436	Unicorn-2876.exe	102
PID 3436 wrote to memory of 3340	3436	Unicorn-2876.exe	102
PID 3436 wrote to memory of 3340	3436	Unicorn-2876.exe	102
PID 1308 wrote to memory of 4360	1308	Unicorn-31391.exe	104
PID 1308 wrote to memory of 4360	1308	Unicorn-31391.exe	104
PID 1308 wrote to memory of 4360	1308	Unicorn-31391.exe	104
PID 4156 wrote to memory of 4992	4156	3c38446144efd5e140f109333a959be2322ea235d1722fe88ea562ccf33d9724N.exe	103
PID 4156 wrote to memory of 4992	4156	3c38446144efd5e140f109333a959be2322ea235d1722fe88ea562ccf33d9724N.exe	103
PID 4156 wrote to memory of 4992	4156	3c38446144efd5e140f109333a959be2322ea235d1722fe88ea562ccf33d9724N.exe	103
PID 1696 wrote to memory of 2344	1696	Unicorn-5608.exe	105
PID 1696 wrote to memory of 2344	1696	Unicorn-5608.exe	105
PID 1696 wrote to memory of 2344	1696	Unicorn-5608.exe	105
PID 2968 wrote to memory of 4788	2968	Unicorn-2975.exe	106
PID 2968 wrote to memory of 4788	2968	Unicorn-2975.exe	106
PID 2968 wrote to memory of 4788	2968	Unicorn-2975.exe	106
PID 2496 wrote to memory of 3000	2496	Unicorn-35990.exe	107
PID 2496 wrote to memory of 3000	2496	Unicorn-35990.exe	107
PID 2496 wrote to memory of 3000	2496	Unicorn-35990.exe	107
PID 3468 wrote to memory of 1380	3468	Unicorn-32070.exe	108
PID 3468 wrote to memory of 1380	3468	Unicorn-32070.exe	108
PID 3468 wrote to memory of 1380	3468	Unicorn-32070.exe	108
PID 64 wrote to memory of 4600	64	Unicorn-21689.exe	109
PID 64 wrote to memory of 4600	64	Unicorn-21689.exe	109
PID 64 wrote to memory of 4600	64	Unicorn-21689.exe	109
PID 852 wrote to memory of 912	852	Unicorn-6405.exe	110
PID 852 wrote to memory of 912	852	Unicorn-6405.exe	110
PID 852 wrote to memory of 912	852	Unicorn-6405.exe	110
PID 4992 wrote to memory of 3080	4992	Unicorn-7775.exe	111
PID 4992 wrote to memory of 3080	4992	Unicorn-7775.exe	111
PID 4992 wrote to memory of 3080	4992	Unicorn-7775.exe	111
PID 2344 wrote to memory of 628	2344	Unicorn-1910.exe	112
PID 2344 wrote to memory of 628	2344	Unicorn-1910.exe	112
PID 2344 wrote to memory of 628	2344	Unicorn-1910.exe	112
PID 4156 wrote to memory of 1312	4156	3c38446144efd5e140f109333a959be2322ea235d1722fe88ea562ccf33d9724N.exe	113
PID 4156 wrote to memory of 1312	4156	3c38446144efd5e140f109333a959be2322ea235d1722fe88ea562ccf33d9724N.exe	113
PID 4156 wrote to memory of 1312	4156	3c38446144efd5e140f109333a959be2322ea235d1722fe88ea562ccf33d9724N.exe	113
PID 3340 wrote to memory of 3240	3340	Unicorn-6229.exe	114
PID 3340 wrote to memory of 3240	3340	Unicorn-6229.exe	114
PID 3340 wrote to memory of 3240	3340	Unicorn-6229.exe	114
PID 1308 wrote to memory of 4320	1308	Unicorn-31391.exe	115

C:\Users\Admin\AppData\Local\Temp\3c38446144efd5e140f109333a959be2322ea235d1722fe88ea562ccf33d9724N.exe
"C:\Users\Admin\AppData\Local\Temp\3c38446144efd5e140f109333a959be2322ea235d1722fe88ea562ccf33d9724N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Users\Admin\AppData\Local\Temp\Unicorn-5608.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-5608.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35990.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35990.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2975.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2975.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3925.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20470.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19030.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55558.exe
        8⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6773.exe
        9⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50617.exe
        10⤵
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3215.exe
        10⤵
        
        PID:13512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4310.exe
        10⤵
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1660.exe
        9⤵
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56167.exe
        9⤵
        
        PID:14176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24675.exe
        9⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62919.exe
        8⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26064.exe
        8⤵
        
        PID:10580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31570.exe
        8⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2828.exe
        7⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22726.exe
        8⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39817.exe
        9⤵
        
        PID:16260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14140.exe
        9⤵
        
        PID:10504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51828.exe
        8⤵
        
        PID:12120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63789.exe
        8⤵
        
        PID:16452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59284.exe
        8⤵
        
        PID:18096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13619.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3061.exe
        8⤵
        
        PID:18824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50150.exe
        7⤵
        
        PID:14496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38091.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54909.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38646.exe
        7⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54713.exe
        8⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22854.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37231.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59396.exe
        9⤵
        
        PID:17424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49117.exe
        8⤵
        
        PID:9920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36468.exe
        8⤵
        
        PID:14404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57347.exe
        8⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64544.exe
        7⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36502.exe
        8⤵
        
        PID:18800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57972.exe
        7⤵
        
        PID:10620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28262.exe
        7⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51197.exe
        7⤵
        
        PID:18280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14918.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32710.exe
        7⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28022.exe
        8⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17039.exe
        8⤵
        
        PID:13428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1510.exe
        8⤵
        
        PID:10660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43828.exe
        7⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        7⤵
        
        PID:13544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2387.exe
        7⤵
        
        PID:8712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13804.exe
        6⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22854.exe
        7⤵
        
        PID:9892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47895.exe
        7⤵
        
        PID:15032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33933.exe
        7⤵
        
        PID:10692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10467.exe
        6⤵
        
        PID:10036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65072.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62502.exe
        6⤵
        
        PID:19072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51616.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10965.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17209.exe
        7⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1493.exe
        8⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48697.exe
        9⤵
        
        PID:9384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
        9⤵
        
        PID:14272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38052.exe
        9⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1452.exe
        8⤵
        
        PID:10172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54039.exe
        8⤵
        
        PID:14572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5458.exe
        8⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31804.exe
        7⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50345.exe
        8⤵
        
        PID:11424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37439.exe
        8⤵
        
        PID:15744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33417.exe
        8⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53364.exe
        7⤵
        
        PID:12008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62279.exe
        7⤵
        
        PID:16472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29564.exe
        6⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61270.exe
        7⤵
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11061.exe
        8⤵
        
        PID:11752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63488.exe
        8⤵
        
        PID:16932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29219.exe
        8⤵
        
        PID:18204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13759.exe
        7⤵
        
        PID:11512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50983.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18940.exe
        7⤵
        
        PID:17716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26131.exe
        6⤵
        
        PID:9680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17039.exe
        6⤵
        
        PID:13468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25267.exe
        6⤵
        
        PID:10604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4451.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29046.exe
        6⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20422.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17804.exe
        8⤵
        
        PID:11116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23027.exe
        8⤵
        
        PID:1548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18556.exe
        8⤵
        
        PID:17928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50669.exe
        7⤵
        
        PID:11104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22150.exe
        7⤵
        
        PID:15120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8146.exe
        7⤵
        
        PID:4236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63796.exe
        6⤵
        
        PID:8780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9535.exe
        6⤵
        
        PID:9732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55207.exe
        6⤵
        
        PID:16956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18524.exe
        6⤵
        
        PID:17836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25709.exe
        5⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60886.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45961.exe
        7⤵
        
        PID:13844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63725.exe
        7⤵
        
        PID:18388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17039.exe
        6⤵
        
        PID:13452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51588.exe
        6⤵
        
        PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36787.exe
        5⤵
        
        PID:7608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43452.exe
        5⤵
        
        PID:12704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54361.exe
        5⤵
        
        PID:5532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63140.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63140.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5944.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51172.exe
        6⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49158.exe
        7⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11644.exe
        8⤵
        
        PID:11012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35799.exe
        8⤵
        
        PID:13724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14479.exe
        8⤵
        
        PID:15784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1510.exe
        8⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50948.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56080.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45802.exe
        7⤵
        
        PID:8060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45821.exe
        6⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36169.exe
        7⤵
        
        PID:15560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40460.exe
        7⤵
        
        PID:17648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42951.exe
        6⤵
        
        PID:11776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43865.exe
        6⤵
        
        PID:6088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22523.exe
        6⤵
        
        PID:18812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5407.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48070.exe
        6⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58198.exe
        7⤵
        
        PID:8128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17481.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37439.exe
        8⤵
        
        PID:15812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37476.exe
        8⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62109.exe
        7⤵
        
        PID:11064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50983.exe
        7⤵
        
        PID:16256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
        7⤵
        
        PID:19152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35260.exe
        6⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63222.exe
        7⤵
        
        PID:9564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38071.exe
        6⤵
        
        PID:12380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63.exe
        6⤵
        
        PID:17184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26579.exe
        5⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57321.exe
        6⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38713.exe
        7⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42431.exe
        7⤵
        
        PID:14148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61508.exe
        7⤵
        
        PID:18084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28175.exe
        6⤵
        
        PID:11376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51175.exe
        6⤵
        
        PID:15452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10860.exe
        6⤵
        
        PID:18260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55053.exe
        5⤵
        
        PID:9036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65255.exe
        5⤵
        
        PID:12316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28262.exe
        5⤵
        
        PID:7056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55565.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10389.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50950.exe
        6⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51078.exe
        7⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38665.exe
        8⤵
        
        PID:15712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40076.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44237.exe
        7⤵
        
        PID:10632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36240.exe
        7⤵
        
        PID:2616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29107.exe
        7⤵
        
        PID:19112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32380.exe
        6⤵
        
        PID:8472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12118.exe
        6⤵
        
        PID:11920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56848.exe
        6⤵
        
        PID:15752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41028.exe
        6⤵
        
        PID:17776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28495.exe
        5⤵
        
        PID:6228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44358.exe
        6⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36169.exe
        7⤵
        
        PID:15552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46237.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63360.exe
        6⤵
        
        PID:12792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15049.exe
        6⤵
        
        PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22867.exe
        5⤵
        
        PID:7348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53360.exe
        5⤵
        
        PID:13236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44023.exe
        5⤵
        
        PID:1224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8540.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16342.exe
      4⤵
      PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23788.exe
        5⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60886.exe
        6⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61622.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-876.exe
        7⤵
        
        PID:18420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46048.exe
        6⤵
        
        PID:11596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51175.exe
        6⤵
        
        PID:15720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43917.exe
        6⤵
        
        PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23059.exe
        5⤵
        
        PID:7640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3116.exe
        5⤵
        
        PID:12672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43527.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25644.exe
        5⤵
        
        PID:18640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-508.exe
      4⤵
      PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30092.exe
        5⤵
        
        PID:9324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1382.exe
        5⤵
        
        PID:14112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33933.exe
        5⤵
        
        PID:9792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40006.exe
      4⤵
      PID:9432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33694.exe
      4⤵
      PID:12516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24676.exe
      4⤵
      PID:17872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2876.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2876.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6229.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10469.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63814.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35574.exe
        7⤵
        
        PID:368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8044.exe
        8⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30534.exe
        9⤵
        
        PID:9220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37430.exe
        10⤵
        
        PID:15464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46621.exe
        10⤵
        
        PID:17436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8207.exe
        9⤵
        
        PID:12420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38052.exe
        9⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21331.exe
        8⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        8⤵
        
        PID:13792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51780.exe
        8⤵
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32636.exe
        7⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57638.exe
        8⤵
        
        PID:10060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38665.exe
        9⤵
        
        PID:15832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53891.exe
        9⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52224.exe
        8⤵
        
        PID:13700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34761.exe
        8⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38820.exe
        7⤵
        
        PID:8232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        7⤵
        
        PID:14208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28147.exe
        7⤵
        
        PID:18624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46928.exe
        6⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49814.exe
        7⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11685.exe
        8⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47309.exe
        8⤵
        
        PID:11536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50983.exe
        8⤵
        
        PID:16272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2220.exe
        8⤵
        
        PID:18216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19987.exe
        7⤵
        
        PID:10176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56256.exe
        7⤵
        
        PID:14168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25075.exe
        7⤵
        
        PID:10308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7939.exe
        6⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4229.exe
        7⤵
        
        PID:1952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42431.exe
        7⤵
        
        PID:15060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38244.exe
        7⤵
        
        PID:9160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19132.exe
        6⤵
        
        PID:10004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33667.exe
        6⤵
        
        PID:14356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24684.exe
        6⤵
        
        PID:10364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17593.exe
        6⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52118.exe
        7⤵
        
        PID:6404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60886.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29327.exe
        8⤵
        
        PID:11652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52768.exe
        8⤵
        
        PID:15088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59092.exe
        8⤵
        
        PID:18252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        7⤵
        
        PID:10428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40487.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24684.exe
        7⤵
        
        PID:17688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8402.exe
        6⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48598.exe
        7⤵
        
        PID:9420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43567.exe
        7⤵
        
        PID:13348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15929.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60164.exe
        6⤵
        
        PID:9544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        6⤵
        
        PID:14216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35251.exe
        6⤵
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28675.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42310.exe
        6⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-860.exe
        7⤵
        
        PID:8800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52871.exe
        7⤵
        
        PID:11308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45559.exe
        7⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57357.exe
        7⤵
        
        PID:18020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32572.exe
        6⤵
        
        PID:8448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37430.exe
        7⤵
        
        PID:15540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31244.exe
        7⤵
        
        PID:18032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44983.exe
        6⤵
        
        PID:11900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56848.exe
        6⤵
        
        PID:15668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13321.exe
        6⤵
        
        PID:7600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52237.exe
        5⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44358.exe
        6⤵
        
        PID:8076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17039.exe
        6⤵
        
        PID:13460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2195.exe
        6⤵
        
        PID:17884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20067.exe
        5⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10031.exe
        6⤵
        
        PID:17024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28159.exe
        5⤵
        
        PID:13244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47433.exe
        5⤵
        
        PID:16908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55072.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15189.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3285.exe
        6⤵
        
        PID:4888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41158.exe
        7⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49158.exe
        8⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44144.exe
        8⤵
        
        PID:12536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1510.exe
        8⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26220.exe
        7⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11061.exe
        8⤵
        
        PID:11280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63488.exe
        8⤵
        
        PID:16940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38244.exe
        8⤵
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36256.exe
        7⤵
        
        PID:12928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58823.exe
        7⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8732.exe
        7⤵
        
        PID:8220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34255.exe
        6⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64934.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34009.exe
        8⤵
        
        PID:11416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37439.exe
        8⤵
        
        PID:15800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37860.exe
        8⤵
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64320.exe
        7⤵
        
        PID:12724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56759.exe
        7⤵
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43335.exe
        6⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        6⤵
        
        PID:14200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13897.exe
        6⤵
        
        PID:7352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63648.exe
        5⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40598.exe
        6⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28172.exe
        7⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23411.exe
        7⤵
        
        PID:14420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58333.exe
        7⤵
        
        PID:8636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50669.exe
        6⤵
        
        PID:11156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56167.exe
        6⤵
        
        PID:14712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60061.exe
        6⤵
        
        PID:17616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13619.exe
        5⤵
        
        PID:7728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8088.exe
        6⤵
        
        PID:13944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-876.exe
        6⤵
        
        PID:18456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2899.exe
        5⤵
        
        PID:12540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
        5⤵
        
        PID:15404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57684.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57684.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2133.exe
        5⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49814.exe
        6⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27638.exe
        7⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11366.exe
        7⤵
        
        PID:12804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52688.exe
        7⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40836.exe
        7⤵
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43148.exe
        6⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37430.exe
        7⤵
        
        PID:15524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24316.exe
        7⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39540.exe
        6⤵
        
        PID:12048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5458.exe
        6⤵
        
        PID:8156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8402.exe
        5⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39273.exe
        6⤵
        
        PID:9712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62976.exe
        6⤵
        
        PID:13356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2473.exe
        6⤵
        
        PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29686.exe
        5⤵
        
        PID:9704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42333.exe
        5⤵
        
        PID:14348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25075.exe
        5⤵
        
        PID:10332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4748.exe
      4⤵
      PID:5328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37142.exe
        5⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24582.exe
        6⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25977.exe
        7⤵
        
        PID:13524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14332.exe
        7⤵
        
        PID:7248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
        6⤵
        
        PID:14260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4694.exe
        6⤵
        
        PID:1460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1644.exe
        5⤵
        
        PID:10128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54039.exe
        5⤵
        
        PID:14564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11628.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10326.exe
      4⤵
      PID:7672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11061.exe
        5⤵
        
        PID:11112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6278.exe
        5⤵
        
        PID:1216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38636.exe
      4⤵
      PID:10480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48905.exe
      4⤵
      PID:10776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62876.exe
      4⤵
      PID:6988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1910.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1910.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9784.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9784.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30265.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1256.exe
        6⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37609.exe
        7⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34009.exe
        8⤵
        
        PID:11448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37439.exe
        8⤵
        
        PID:16372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60548.exe
        8⤵
        
        PID:17664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51828.exe
        7⤵
        
        PID:12264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53831.exe
        7⤵
        
        PID:3016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
        6⤵
        
        PID:6668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25574.exe
        6⤵
        
        PID:11268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56848.exe
        6⤵
        
        PID:15476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9123.exe
        6⤵
        
        PID:18396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25603.exe
        5⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-860.exe
        6⤵
        
        PID:8808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52871.exe
        6⤵
        
        PID:11124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14172.exe
        6⤵
        
        PID:8532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51405.exe
        5⤵
        
        PID:8560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15670.exe
        5⤵
        
        PID:12024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54048.exe
        5⤵
        
        PID:16488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36358.exe
        5⤵
        
        PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61894.exe
        5⤵
        
        PID:1880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26358.exe
        6⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50310.exe
        7⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52697.exe
        8⤵
        
        PID:15480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19381.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49620.exe
        7⤵
        
        PID:14488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35244.exe
        7⤵
        
        PID:10656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15276.exe
        6⤵
        
        PID:8572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55385.exe
        7⤵
        
        PID:16284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        7⤵
        
        PID:18912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18470.exe
        6⤵
        
        PID:12016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44487.exe
        6⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12572.exe
        6⤵
        
        PID:19196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35324.exe
        5⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45801.exe
        6⤵
        
        PID:9044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33759.exe
        6⤵
        
        PID:13292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30566.exe
        6⤵
        
        PID:548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
        6⤵
        
        PID:19136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43335.exe
        5⤵
        
        PID:8720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        5⤵
        
        PID:14096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18723.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62116.exe
      4⤵
      PID:1440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54329.exe
        5⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46678.exe
        6⤵
        
        PID:8580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42140.exe
        6⤵
        
        PID:12452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37860.exe
        6⤵
        
        PID:9316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22863.exe
        5⤵
        
        PID:8384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1382.exe
        5⤵
        
        PID:14104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8146.exe
        5⤵
        
        PID:7820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18607.exe
      4⤵
      PID:7700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38473.exe
        5⤵
        
        PID:15652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15484.exe
        5⤵
        
        PID:17940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55172.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55172.exe
      4⤵
      PID:10520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14949.exe
      4⤵
      PID:4248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22331.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22331.exe
      4⤵
      PID:18776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9135.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9135.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13928.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29990.exe
        5⤵
        
        PID:5004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55574.exe
        6⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44358.exe
        7⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17039.exe
        7⤵
        
        PID:13436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35251.exe
        7⤵
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43828.exe
        6⤵
        
        PID:9720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40413.exe
        6⤵
        
        PID:13332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13321.exe
        6⤵
        
        PID:7464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31011.exe
        5⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34006.exe
        6⤵
        
        PID:2632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
        6⤵
        
        PID:14308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4694.exe
        6⤵
        
        PID:9624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43933.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10524
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10524 -s 464
        6⤵
        Program crash
        
        PID:12456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24835.exe
        5⤵
        
        PID:14900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe
        5⤵
        
        PID:17492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8479.exe
      4⤵
      PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57302.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35318.exe
        6⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60617.exe
        7⤵
        
        PID:10092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44237.exe
        6⤵
        
        PID:10456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52192.exe
        6⤵
        
        PID:16900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29107.exe
        6⤵
        
        PID:19144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34383.exe
        5⤵
        
        PID:8996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38071.exe
        5⤵
        
        PID:12396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63.exe
        5⤵
        
        PID:17280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64327.exe
      4⤵
      PID:6936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45801.exe
        5⤵
        
        PID:7660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52313.exe
        6⤵
        
        PID:15604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61997.exe
        6⤵
        
        PID:17500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64807.exe
        5⤵
        
        PID:13856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33933.exe
        5⤵
        
        PID:10648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49200.exe
      4⤵
      PID:8728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11647.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58278.exe
      4⤵
      PID:9740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21334.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21334.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18470.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18470.exe
      4⤵
      PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49814.exe
        5⤵
        
        PID:6364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44358.exe
        6⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17039.exe
        6⤵
        
        PID:13384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15625.exe
        6⤵
        
        PID:8676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43828.exe
        5⤵
        
        PID:9416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
        5⤵
        
        PID:13768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35059.exe
        5⤵
        
        PID:8444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25347.exe
      4⤵
      PID:7328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20950.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42431.exe
        5⤵
        
        PID:14324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53812.exe
        5⤵
        
        PID:6220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49028.exe
      4⤵
      PID:12112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39631.exe
      4⤵
      PID:16872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54361.exe
      4⤵
      PID:5660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45084.exe
    3⤵
    PID:5336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55522.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28022.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63168.exe
        5⤵
        
        PID:13316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25267.exe
        5⤵
        
        PID:18268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26812.exe
      4⤵
      PID:8616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39540.exe
      4⤵
      PID:11840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50845.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50845.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:18440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44102.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44102.exe
    3⤵
    PID:6812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44358.exe
      4⤵
      PID:6516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52697.exe
        5⤵
        
        PID:15532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53891.exe
        5⤵
        
        PID:8228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12991.exe
      4⤵
      PID:11720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51175.exe
      4⤵
      PID:15628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10175.exe
      4⤵
      PID:18720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64796.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64796.exe
    3⤵
    PID:7680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33652.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33652.exe
    3⤵
    PID:12660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
    3⤵
    PID:1144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61877.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61877.exe
    3⤵
    PID:18788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31391.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31391.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6405.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21689.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:64
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4200.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5669.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26425.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62185.exe
        8⤵
        
        PID:6076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36950.exe
        9⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1525.exe
        10⤵
        
        PID:18564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17311.exe
        9⤵
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19462.exe
        9⤵
        
        PID:14652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38131.exe
        9⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50253.exe
        8⤵
        
        PID:9652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57383.exe
        8⤵
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25452.exe
        8⤵
        
        PID:18356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54925.exe
        7⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15416.exe
        8⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42665.exe
        9⤵
        
        PID:11332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22614.exe
        9⤵
        
        PID:16672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44237.exe
        8⤵
        
        PID:10248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53344.exe
        8⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29107.exe
        8⤵
        
        PID:19128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39956.exe
        7⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41084.exe
        8⤵
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51616.exe
        7⤵
        
        PID:11756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48375.exe
        7⤵
        
        PID:15548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51965.exe
        7⤵
        
        PID:9832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39916.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46726.exe
        7⤵
        
        PID:6104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36358.exe
        8⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30092.exe
        9⤵
        
        PID:9944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36468.exe
        9⤵
        
        PID:14388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27389.exe
        9⤵
        
        PID:16524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25084.exe
        8⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5365.exe
        9⤵
        
        PID:19300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1382.exe
        8⤵
        
        PID:14128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43917.exe
        8⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17660.exe
        7⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49958.exe
        8⤵
        
        PID:456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36759.exe
        8⤵
        
        PID:532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20854.exe
        7⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26656.exe
        7⤵
        
        PID:14692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59092.exe
        7⤵
        
        PID:17848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19843.exe
        6⤵
        
        PID:5996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47622.exe
        7⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51828.exe
        7⤵
        
        PID:12148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14035.exe
        7⤵
        
        PID:16704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12572.exe
        7⤵
        
        PID:19164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63117.exe
        6⤵
        
        PID:7236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23926.exe
        6⤵
        
        PID:11664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31839.exe
        6⤵
        
        PID:15636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3493.exe
        6⤵
        
        PID:8752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36815.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52797.exe
        6⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38678.exe
        7⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35334.exe
        8⤵
        
        PID:8504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4735.exe
        8⤵
        
        PID:12032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7846.exe
        8⤵
        
        PID:16504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1068.exe
        8⤵
        
        PID:8792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10476.exe
        7⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54425.exe
        8⤵
        
        PID:15892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30476.exe
        8⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55876.exe
        7⤵
        
        PID:11816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43725.exe
        7⤵
        
        PID:8932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62244.exe
        6⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46121.exe
        7⤵
        
        PID:10608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37439.exe
        7⤵
        
        PID:10704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52276.exe
        7⤵
        
        PID:6528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63837.exe
        6⤵
        
        PID:9696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48375.exe
        6⤵
        
        PID:15768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1804.exe
        6⤵
        
        PID:8656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3683.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-789.exe
        6⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2920.exe
        7⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45177.exe
        8⤵
        
        PID:10184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55069.exe
        8⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49620.exe
        7⤵
        
        PID:14528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35244.exe
        7⤵
        
        PID:9152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33231.exe
        6⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34614.exe
        6⤵
        
        PID:12056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13711.exe
        6⤵
        
        PID:16516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26419.exe
        6⤵
        
        PID:18172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18028.exe
        5⤵
        
        PID:6508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16569.exe
        6⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19833.exe
        7⤵
        
        PID:15676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56112.exe
        7⤵
        
        PID:10296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43359.exe
        6⤵
        
        PID:9352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4447.exe
        6⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe
        6⤵
        
        PID:18472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57815.exe
        5⤵
        
        PID:8648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15279.exe
        5⤵
        
        PID:12064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5576.exe
        5⤵
        
        PID:16536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53275.exe
        5⤵
        
        PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50749.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56681.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10965.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12216.exe
        7⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51817.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30342.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9240.exe
        10⤵
        
        PID:13832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14332.exe
        10⤵
        
        PID:10312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8207.exe
        9⤵
        
        PID:12324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27875.exe
        9⤵
        
        PID:18616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25084.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1382.exe
        8⤵
        
        PID:14120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5842.exe
        8⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16591.exe
        7⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34006.exe
        8⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
        8⤵
        
        PID:13696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54964.exe
        8⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64004.exe
        7⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18966.exe
        7⤵
        
        PID:15064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8732.exe
        7⤵
        
        PID:9796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27244.exe
        6⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38294.exe
        7⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48041.exe
        8⤵
        
        PID:11168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37247.exe
        8⤵
        
        PID:15756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38052.exe
        8⤵
        
        PID:8500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37212.exe
        7⤵
        
        PID:10708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-822.exe
        7⤵
        
        PID:16092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5458.exe
        7⤵
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42644.exe
        6⤵
        
        PID:7384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50150.exe
        6⤵
        
        PID:14480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52891.exe
        6⤵
        
        PID:18108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55869.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46726.exe
        6⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
        7⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49958.exe
        8⤵
        
        PID:9448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
        8⤵
        
        PID:14284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4310.exe
        8⤵
        
        PID:9112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30838.exe
        7⤵
        
        PID:10112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58285.exe
        7⤵
        
        PID:14508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2963.exe
        7⤵
        
        PID:9904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64160.exe
        6⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22630.exe
        7⤵
        
        PID:15924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15868.exe
        7⤵
        
        PID:17728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57972.exe
        6⤵
        
        PID:10444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43527.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe
        6⤵
        
        PID:17536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51447.exe
        5⤵
        
        PID:3544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44358.exe
        6⤵
        
        PID:2568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17039.exe
        6⤵
        
        PID:13408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10275.exe
        6⤵
        
        PID:17576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28733.exe
        5⤵
        
        PID:7228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44695.exe
        5⤵
        
        PID:13260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13839.exe
        5⤵
        
        PID:1784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41558.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35092.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10389.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14136.exe
        6⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37142.exe
        7⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17270.exe
        8⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54425.exe
        9⤵
        
        PID:15732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29708.exe
        9⤵
        
        PID:4736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46448.exe
        8⤵
        
        PID:13416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62276.exe
        8⤵
        
        PID:17604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49885.exe
        7⤵
        
        PID:9672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36468.exe
        7⤵
        
        PID:14808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20476.exe
        7⤵
        
        PID:18484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64928.exe
        6⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8088.exe
        7⤵
        
        PID:14004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31628.exe
        7⤵
        
        PID:18184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57972.exe
        6⤵
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40704.exe
        6⤵
        
        PID:15976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9123.exe
        6⤵
        
        PID:18312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45392.exe
        5⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38870.exe
        6⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34006.exe
        7⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
        7⤵
        
        PID:14300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2089.exe
        7⤵
        
        PID:8844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50669.exe
        6⤵
        
        PID:11148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56167.exe
        6⤵
        
        PID:14704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4716.exe
        6⤵
        
        PID:19288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62436.exe
        5⤵
        
        PID:7896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11061.exe
        6⤵
        
        PID:3640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44272.exe
        6⤵
        
        PID:17000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17849.exe
        6⤵
        
        PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18943.exe
        5⤵
        
        PID:12552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21496.exe
        5⤵
        
        PID:5708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9548.exe
      4⤵
      PID:1588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-488.exe
        5⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49158.exe
        6⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26911.exe
        7⤵
        
        PID:11000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35799.exe
        7⤵
        
        PID:13748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14479.exe
        7⤵
        
        PID:15820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64826.exe
        7⤵
        
        PID:7616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40668.exe
        6⤵
        
        PID:10276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4262.exe
        6⤵
        
        PID:14756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2220.exe
        6⤵
        
        PID:17904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26220.exe
        5⤵
        
        PID:8356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36256.exe
        5⤵
        
        PID:12944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28454.exe
        5⤵
        
        PID:1432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40252.exe
        5⤵
        
        PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9747.exe
      4⤵
      PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45801.exe
        5⤵
        
        PID:8120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64807.exe
        5⤵
        
        PID:13880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65453.exe
        5⤵
        
        PID:10724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-76.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-76.exe
      4⤵
      PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64649.exe
      4⤵
      PID:14160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52891.exe
      4⤵
      PID:17680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53712.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53712.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52384.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52384.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10197.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14520.exe
        6⤵
        
        PID:5156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49158.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20758.exe
        8⤵
        
        PID:11256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42431.exe
        8⤵
        
        PID:13112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11923.exe
        8⤵
        
        PID:18408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54317.exe
        7⤵
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe
        7⤵
        
        PID:16100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40627.exe
        7⤵
        
        PID:8900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26220.exe
        6⤵
        
        PID:8332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36256.exe
        6⤵
        
        PID:12920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27190.exe
        6⤵
        
        PID:16468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41679.exe
        6⤵
        
        PID:18004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64349.exe
        5⤵
        
        PID:6460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57321.exe
        6⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33065.exe
        7⤵
        
        PID:13476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40844.exe
        7⤵
        
        PID:9312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11839.exe
        6⤵
        
        PID:11284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56032.exe
        6⤵
        
        PID:16856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9315.exe
        6⤵
        
        PID:18496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49380.exe
        5⤵
        
        PID:8936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8575.exe
        5⤵
        
        PID:11456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60432.exe
        5⤵
        
        PID:15980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29638.exe
        5⤵
        
        PID:19188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19142.exe
      4⤵
      Executes dropped EXE
      PID:3664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34038.exe
        5⤵
        
        PID:5508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15416.exe
        6⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34006.exe
        7⤵
        
        PID:9572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22732.exe
        7⤵
        
        PID:14056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62276.exe
        7⤵
        
        PID:17992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34700.exe
        6⤵
        
        PID:3064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51351.exe
        6⤵
        
        PID:14460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22563.exe
        6⤵
        
        PID:11968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26220.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36256.exe
        5⤵
        
        PID:12936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29878.exe
        5⤵
        
        PID:1420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45436.exe
        5⤵
        
        PID:19064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48096.exe
      4⤵
      PID:6264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11685.exe
        5⤵
        
        PID:8252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37430.exe
        6⤵
        
        PID:15428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54742.exe
        6⤵
        
        PID:6492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17039.exe
        5⤵
        
        PID:13400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58215.exe
        5⤵
        
        PID:18140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20259.exe
      4⤵
      PID:8068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40726.exe
      4⤵
      PID:12532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30011.exe
      4⤵
      PID:17800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7327.exe
      4⤵
      PID:2468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63721.exe
        5⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49158.exe
        6⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        7⤵
        
        PID:11236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9951.exe
        7⤵
        
        PID:14892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13983.exe
        7⤵
        
        PID:16008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54317.exe
        6⤵
        
        PID:11176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34838.exe
        6⤵
        
        PID:16320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10860.exe
        6⤵
        
        PID:9188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26220.exe
        5⤵
        
        PID:8340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45751.exe
        5⤵
        
        PID:11784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29030.exe
        5⤵
        
        PID:17032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40828.exe
        5⤵
        
        PID:10740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42231.exe
      4⤵
      PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63014.exe
        5⤵
        
        PID:8492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42140.exe
        5⤵
        
        PID:12432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59588.exe
        5⤵
        
        PID:7916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64119.exe
      4⤵
      PID:14180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35628.exe
      4⤵
      PID:8700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29616.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29616.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exe
      4⤵
      PID:3192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49814.exe
        5⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30150.exe
        6⤵
        
        PID:7684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7823.exe
        6⤵
        
        PID:11476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4995.exe
        6⤵
        
        PID:8868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22396.exe
        5⤵
        
        PID:10220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1382.exe
        5⤵
        
        PID:14136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52381.exe
        5⤵
        
        PID:18836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25347.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25347.exe
      4⤵
      PID:7240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41545.exe
        5⤵
        
        PID:16164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30476.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22880.exe
      4⤵
      PID:9880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61255.exe
      4⤵
      PID:15788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9116.exe
      4⤵
      PID:18368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57863.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57863.exe
    3⤵
    PID:5180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49622.exe
      4⤵
      PID:6352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41478.exe
        5⤵
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32278.exe
        6⤵
        
        PID:17808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28175.exe
        5⤵
        
        PID:10264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29357.exe
        5⤵
        
        PID:6120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18732.exe
      4⤵
      PID:9076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42697.exe
        5⤵
        
        PID:14036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55069.exe
        5⤵
        
        PID:6596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38071.exe
      4⤵
      PID:12372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49264.exe
      4⤵
      PID:17308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51588.exe
      4⤵
      PID:584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4748.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4748.exe
    3⤵
    PID:6004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39382.exe
      4⤵
      PID:9864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11061.exe
        5⤵
        
        PID:11052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50167.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18940.exe
        5⤵
        
        PID:17564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53661.exe
      4⤵
      PID:11704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15683.exe
      4⤵
      PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5100.exe
      4⤵
      PID:19096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10997.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10997.exe
    3⤵
    PID:9976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12667.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12667.exe
    3⤵
    PID:14240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41204.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41204.exe
    3⤵
    PID:10408
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32070.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32070.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3468
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64288.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64288.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55830.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57862.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5397.exe
        6⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-838.exe
        7⤵
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11061.exe
        8⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34761.exe
        8⤵
        
        PID:8260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26640.exe
        7⤵
        
        PID:12596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exe
        7⤵
        
        PID:15424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63796.exe
        6⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17481.exe
        7⤵
        
        PID:11480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30566.exe
        7⤵
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1836.exe
        7⤵
        
        PID:18060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9535.exe
        6⤵
        
        PID:11020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23724.exe
        6⤵
        
        PID:17452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50877.exe
        5⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1848.exe
        6⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60886.exe
        7⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44423.exe
        7⤵
        
        PID:12748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19711.exe
        7⤵
        
        PID:2204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27571.exe
        7⤵
        
        PID:18848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9324.exe
        6⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62788.exe
        6⤵
        
        PID:12684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36240.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59092.exe
        6⤵
        
        PID:17860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31213.exe
        5⤵
        
        PID:7284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40502.exe
        6⤵
        
        PID:16116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57373.exe
        6⤵
        
        PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14214.exe
        5⤵
        
        PID:11100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15503.exe
        5⤵
        
        PID:16124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57318.exe
        5⤵
        
        PID:8048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4748.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57094.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37142.exe
        6⤵
        
        PID:6912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20758.exe
        7⤵
        
        PID:9664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42431.exe
        7⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5571.exe
        7⤵
        
        PID:9560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24332.exe
        6⤵
        
        PID:8440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53463.exe
        6⤵
        
        PID:14732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60829.exe
        6⤵
        
        PID:9140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62919.exe
        5⤵
        
        PID:9088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27600.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56935.exe
        5⤵
        
        PID:17272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-502.exe
      4⤵
      PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51817.exe
        5⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44358.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60375.exe
        6⤵
        
        PID:12852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36432.exe
        6⤵
        
        PID:964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29107.exe
        6⤵
        
        PID:19120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9132.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47495.exe
        5⤵
        
        PID:13252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27520.exe
        5⤵
        
        PID:5776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37261.exe
      4⤵
      PID:4176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36409.exe
        5⤵
        
        PID:11180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9292.exe
        5⤵
        
        PID:14908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54964.exe
        5⤵
        
        PID:9528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18054.exe
      4⤵
      PID:8308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1455.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1455.exe
      4⤵
      PID:14684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2725.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2725.exe
      4⤵
      PID:6832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63898.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63898.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52797.exe
      4⤵
      PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56633.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54425.exe
        6⤵
        
        PID:15904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40652.exe
        6⤵
        
        PID:8468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51828.exe
        5⤵
        
        PID:12128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11238.exe
        5⤵
        
        PID:4868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42940.exe
        5⤵
        
        PID:17548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45716.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34009.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37439.exe
        5⤵
        
        PID:15920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59588.exe
        5⤵
        
        PID:7448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34502.exe
      4⤵
      PID:12564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9528.exe
      4⤵
      PID:7004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25008.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63638.exe
      4⤵
      PID:6032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20614.exe
        5⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57638.exe
        6⤵
        
        PID:10048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37916.exe
        6⤵
        
        PID:14076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4310.exe
        6⤵
        
        PID:7024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18364.exe
        5⤵
        
        PID:10084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51351.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27005.exe
        5⤵
        
        PID:8264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-268.exe
      4⤵
      PID:7792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38089.exe
        5⤵
        
        PID:15824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24316.exe
        5⤵
        
        PID:6428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57972.exe
      4⤵
      PID:10268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57040.exe
      4⤵
      PID:1492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2771.exe
      4⤵
      PID:7664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8003.exe
    3⤵
    PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51654.exe
      4⤵
      PID:8080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48697.exe
        5⤵
        
        PID:9428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36759.exe
        5⤵
        
        PID:13980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39040.exe
        5⤵
        
        PID:13936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50669.exe
      4⤵
      PID:11092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22150.exe
      4⤵
      PID:14672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49693.exe
      4⤵
      PID:17464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28783.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28783.exe
    3⤵
    PID:9000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16776.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16776.exe
    3⤵
    PID:12308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50055.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50055.exe
    3⤵
    PID:17176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36956.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36956.exe
    3⤵
    PID:18244
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7775.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7775.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43526.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15573.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60934.exe
        5⤵
        
        PID:896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-104.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2069.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5592.exe
        8⤵
        
        PID:13796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55728.exe
        8⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44237.exe
        7⤵
        
        PID:10640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34454.exe
        7⤵
        
        PID:15504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65261.exe
        7⤵
        
        PID:17412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32380.exe
        6⤵
        
        PID:8480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2623.exe
        6⤵
        
        PID:13060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11430.exe
        6⤵
        
        PID:17132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41679.exe
        6⤵
        
        PID:18148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28495.exe
        5⤵
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60886.exe
        6⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9992.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48029.exe
        7⤵
        
        PID:16988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56759.exe
        7⤵
        
        PID:6484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17039.exe
        6⤵
        
        PID:13444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25651.exe
        6⤵
        
        PID:18324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23059.exe
        5⤵
        
        PID:7720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40196.exe
        5⤵
        
        PID:11792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24492.exe
        5⤵
        
        PID:17744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10508.exe
      4⤵
      PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22902.exe
        5⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64150.exe
        6⤵
        
        PID:7296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3279.exe
        6⤵
        
        PID:9956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64055.exe
        6⤵
        
        PID:15776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17020.exe
        6⤵
        
        PID:18044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43516.exe
        5⤵
        
        PID:7320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26726.exe
        5⤵
        
        PID:11644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28070.exe
        5⤵
        
        PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58893.exe
        5⤵
        
        PID:18336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13699.exe
      4⤵
      PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63398.exe
        5⤵
        
        PID:9172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64807.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65453.exe
        5⤵
        
        PID:17752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44685.exe
      4⤵
      PID:8984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11647.exe
      4⤵
      PID:15172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16155.exe
      4⤵
      PID:7624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61053.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61053.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14229.exe
      4⤵
      PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17209.exe
        5⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15416.exe
        6⤵
        
        PID:7500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4114.exe
        7⤵
        
        PID:8412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5699.exe
        6⤵
        
        PID:12524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34729.exe
        6⤵
        
        PID:15496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26220.exe
        5⤵
        
        PID:8320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62964.exe
        5⤵
        
        PID:11832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14419.exe
        5⤵
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59277.exe
        5⤵
        
        PID:17700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28495.exe
      4⤵
      PID:6236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52614.exe
        5⤵
        
        PID:7696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16054.exe
        6⤵
        
        PID:11324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37439.exe
        6⤵
        
        PID:15900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21347.exe
        6⤵
        
        PID:19392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49620.exe
        5⤵
        
        PID:14520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42364.exe
        5⤵
        
        PID:18120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48119.exe
      4⤵
      PID:9024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8383.exe
      4⤵
      PID:12328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62080.exe
      4⤵
      PID:4624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7523.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7523.exe
    3⤵
    PID:4080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17318.exe
      4⤵
      PID:5524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22150.exe
        5⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11061.exe
        6⤵
        
        PID:10252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30758.exe
        6⤵
        
        PID:4588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37389.exe
        6⤵
        
        PID:19276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51828.exe
        5⤵
        
        PID:12104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43335.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44367.exe
        5⤵
        
        PID:19084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47440.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54425.exe
        5⤵
        
        PID:15912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14332.exe
        5⤵
        
        PID:5596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57972.exe
      4⤵
      PID:10164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57040.exe
      4⤵
      PID:16368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
      4⤵
      PID:9524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48096.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48096.exe
    3⤵
    PID:6256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58582.exe
      4⤵
      PID:8096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19974.exe
        5⤵
        
        PID:9812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22732.exe
        5⤵
        
        PID:14144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61508.exe
        5⤵
        
        PID:18076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7996.exe
      4⤵
      PID:10256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53463.exe
      4⤵
      PID:14716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35085.exe
      4⤵
      PID:17952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13715.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13715.exe
    3⤵
    PID:8972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65248.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65248.exe
    3⤵
    PID:11556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42774.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42774.exe
    3⤵
    PID:17060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24801.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24801.exe
    3⤵
    PID:8188
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1539.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1539.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15189.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15189.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17977.exe
      4⤵
      PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20614.exe
        5⤵
        
        PID:2276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17286.exe
        6⤵
        
        PID:4896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
        6⤵
        
        PID:14268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54580.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24332.exe
        5⤵
        
        PID:10192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53463.exe
        5⤵
        
        PID:14724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49693.exe
        5⤵
        
        PID:17508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40919.exe
      4⤵
      PID:9644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17132.exe
      4⤵
      PID:14376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15771.exe
      4⤵
      PID:8524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14940.exe
    3⤵
    PID:5312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55712.exe
      4⤵
      PID:6664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59124.exe
      4⤵
      PID:11300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56848.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26803.exe
      4⤵
      PID:17588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62244.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62244.exe
    3⤵
    PID:7968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13259.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13259.exe
    3⤵
    PID:11824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64277.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64277.exe
    3⤵
    PID:9780
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54000.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54000.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35190.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35190.exe
    3⤵
    PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49814.exe
      4⤵
      PID:6372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64057.exe
        5⤵
        
        PID:9756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46448.exe
        5⤵
        
        PID:13392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11155.exe
        5⤵
        
        PID:17628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25084.exe
      4⤵
      PID:9052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1382.exe
      4⤵
      PID:13564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10175.exe
      4⤵
      PID:10584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59741.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59741.exe
    3⤵
    PID:7128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61078.exe
      4⤵
      PID:7724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30095.exe
      4⤵
      PID:11496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52192.exe
      4⤵
      PID:15988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56788.exe
      4⤵
      PID:7516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39588.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39588.exe
    3⤵
    PID:7764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37792.exe
    3⤵
    PID:13144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43335.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43335.exe
    3⤵
    PID:1476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26412.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26412.exe
    3⤵
    PID:18160
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26406.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26406.exe
  2⤵
  PID:5300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2232.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2232.exe
    3⤵
    PID:6992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44358.exe
      4⤵
      PID:6724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25702.exe
        5⤵
        
        PID:16424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56989.exe
        5⤵
        
        PID:8964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39143.exe
      4⤵
      PID:14920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56397.exe
      4⤵
      PID:17520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36132.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36132.exe
    3⤵
    PID:10212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7247.exe
    3⤵
    PID:13760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
    3⤵
    PID:8028
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9982.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9982.exe
  2⤵
  PID:6772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17286.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17286.exe
    3⤵
    PID:9356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53184.exe
    3⤵
    PID:14292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59588.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59588.exe
    3⤵
    PID:10712
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51988.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51988.exe
  2⤵
  PID:11080
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13551.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13551.exe
  2⤵
  PID:14552
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6724.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6724.exe
  2⤵
  PID:19312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 10524 -ip 10524
1⤵
PID:11392

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:16464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10469.exe

Filesize
468KB

MD5
c16f717b68bf574238d6969ce7d96b37

SHA1
f5cc85ac974a70d4a3d43ac08699c01e6dd17747

SHA256
f3c318af7d6f02eca4147e4ed75a5c0bda4bab703c4a643d97d700dcb36f289b

SHA512
543b55cc116b0667ef727e2ed067d9678faed521cb77f2a59dad3c87a35fa9f71485f6a1156fa2577a9ae4f5a3bbf641896da59d6e214eccd5d657cf4133088b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1539.exe

Filesize
468KB

MD5
3d50e80708d56e5ea23fcb4e1cc13eed

SHA1
560a3b8b735a6a0e46851b708ab4b1e897b5cf92

SHA256
32f87f7500dccd3f129783a128428a4c613324b4af73749d5d16e16568ed7038

SHA512
02a24fad7d0a796aa0e420ce9df66f3fdff9e0421e69fcea94f4fa4c84b0dcd9db6731ef193c05947b9f21659a917be2647c3df6eeda3309b37b5758faed6f35

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1910.exe

Filesize
468KB

MD5
d5363e8331b89df230b31d4b236fcc5a

SHA1
2e15a6313eee66ddf8ce15b90d6a1e174da8ecea

SHA256
2422c06bcf12030c9cf30a08152b441c7b5aeb0d8bb32c4ea8e7832f9def1004

SHA512
4ed7ec6581557f13d7d704996b92b55bfeb1597a10084aa5f29cfd1b783b9d38b0c789a20b88a67cc6c1c0d571cd8b606bfa57193e39c3abf24c582ce0b96986

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20470.exe

Filesize
468KB

MD5
35e3de8b06c8107b4a74a2fa420c9bfc

SHA1
835c1433d506dd9cf9f7627b1811425cea329fb7

SHA256
2c86f9ba9fa4fafbd3791aaf44cb9a8f5b2130aaab092b943d1a3b8e9abd6601

SHA512
68306aad3ad4345bc7c0c8648281aee5bf83d99b404fe45baa1323c18fd29a993a183e77e4c3fafb143ea103f67732390e02e1022560cd3cf992a568e0c10141

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20854.exe

Filesize
468KB

MD5
038cff5b8ec800e31e156946a25b9f2b

SHA1
d29926a788d8354d041b3e8ca8ca29fd5910eb24

SHA256
3df07979dec73e8328518294dc127d18a7aafb6354a1e824bd7bab480a4d5359

SHA512
5d40c7057a401e2826b403a52edb46a2f4cbccabb1e1258e9e295ed2b2d775f29b7e5c8e08f88c05747356bd509c717388e567da9b1c93e7289d7573717703eb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21689.exe

Filesize
468KB

MD5
51425dd17ac59d9bcf179a47750bc899

SHA1
cbe546f1198a82a808d544f5e4d44208d0baa92a

SHA256
d602934dd31001beb4dfbd5cc8a56596983011fa0b4e927ab2b7bbb4814009c1

SHA512
5876c9b721844b1d660e97ffaca0a2e80d06b4e837514951ec50f2521033bf6938bd7481a5acaf7ac1bef3b82d526b063d1942f1ffa9d7f4ec78e69bbf91f666

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2876.exe

Filesize
468KB

MD5
c69c2fc882585b5d9138515a57518de7

SHA1
53cba5fce888df7b407a33a35663d6c96154efdd

SHA256
033354d4e11ca45bb9fed7a29aff619037abfb3e7f1f713420267646b1424f0d

SHA512
5c61d286481dcb99c72fc797c82bc0325cedb3e24ce1edfd02854bc9f8c4bf608cfe64c7a0d6f7f84e734fe70e4f2bec051adc3261a407e66fd48c3f3c10ddb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2975.exe

Filesize
468KB

MD5
439c1cc2eab719a64f5d8db6068a0c0a

SHA1
f7e990ad0d5da110bf4353251f1c838385a06423

SHA256
10c48ca293aa6221a615a4124df5071ad6b30e6e9ec03eb6e9b29d5748f005be

SHA512
71d2b86af15f908a0ac28db4c825cd155f6f563f42a42989efbe484a0d8b7ecfdb29693a95728f06313612f364a42cfe099477cc8673156f39ca58acab7165f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31391.exe

Filesize
468KB

MD5
2d23870af8d6a7ee70eef174e83941bd

SHA1
a6e7206d8c4e474ee9065c4db7573bd937763003

SHA256
c772a1522eb0572110f08e8ae3f9c2985f0df806f6eea01b2ca6b965456653eb

SHA512
d00d008794f4e4cb989bbdf94e5d7d7703bb083c8d66204d953df2f6eb67def79d659a0fadbf14c1dd5701bdabf8b51f632244ac275bf44f93f2dc4aa43db117

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32070.exe

Filesize
468KB

MD5
99542da7e09974c553192c37b2de8353

SHA1
a540171e5903af600b55bcb522ee1a0ddf52082f

SHA256
a0418b86454991072692c519c867ac7f7d96ae96389281c5ba39c22c3c3401c6

SHA512
59727ccc57e56fedb58c551004ef7856d8af985e47cfe5ea1fb6bfc7263052a7c7a89521480d9fc89d7f72fac2401145a1408de949c6b895e1b1baa4787ed46b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe

Filesize
468KB

MD5
4dbc9d0a472b0991cfacdb77d2c41dbb

SHA1
f258a10f88373d88578c47b7192fa79984926d0e

SHA256
e5e2738090cec798ab5d3dcba4aadaa98a8dbcc0f60a467330e0770ebd225b1c

SHA512
82a2d547446003e615112a528369875e557d0dd942267d780c1599e90108630c17f1bdbb7a8ef3d637bd3c9fb5d23f7ab9b7383401639941e15f7f72d01076ca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35990.exe

Filesize
468KB

MD5
511d9ab3460fe54df629cfe4980666d1

SHA1
1ffc48669301ca54729b041021d6cb5042c73806

SHA256
3eb7b4f4f765c0befa2d12d92a80fb67c812cdaf21a2795933bb65dc8d56b9a4

SHA512
83bb6e49049ac0548a545d8820c6a26b568b5ee7b5f1a852db3ed694a14b5665c0d6d25ecf366bcad1b545aa1706a606db2e4a209f8768dcf54a3b40eaf61b41

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3925.exe

Filesize
468KB

MD5
4f769ca02a5b13470c617a404eb2ffeb

SHA1
250105d5f1f6c5cbb2c6bce270162829f5b08915

SHA256
e3a032ebe4c6bf1371a75b6f3bff3573c8f1f1dd76e3311ab08cc0f30a29bc24

SHA512
ab2b43e89666a173a78b17f41ea2e35d153d349bf4e03b2fb9130ff7a3d8315227312f49f7ab1a8cbeaa574f7236eb39cc07de31dbe6931aee22506785b76297

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4200.exe

Filesize
468KB

MD5
a74a3e796250293c7bdb97e899eb6cc0

SHA1
c7c8d13810d3f3d93e531fba5887b95f52ccd854

SHA256
e19aa84d285598068d98a0cf59f3e95dcb60690bf13ab55eda53a364c4865ce6

SHA512
57de7cd32e1bf6bd44a8e0d131adcafa0bec992b76f2a42149844d56b6a9269d1abd58d1531114e8ce3599a2c391fdc7b008106b7e670cd29cebc7224176b9ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43526.exe

Filesize
468KB

MD5
f2d06e661d0cae22afcf9c0d65a4d4f9

SHA1
fb9321bcba17ee1a0e3ed4aa9dcae1da4a1c0b91

SHA256
475ad5ac5c860368eba0927827323b78076d5bd8de79156613009f150e51d82b

SHA512
6d75949685fb527ca697e1a6b47e66c546ba34ee054dfb73e9e2c036b351c0948288102aba4da8d7135bc3b356fe75b47ac93b1bf2dd1bbf22318d30dc357dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45821.exe

Filesize
468KB

MD5
a57fe7cb85c93e949a0d208a85ee08fd

SHA1
28ed49cbb97abbc2aee85d363117d449fe9db3f6

SHA256
4cbfe8cd31fa72a7bdc2dbf605c5fca76ec7df0c5a4032c5f0f6952e1cd17ffa

SHA512
84cad8f0ac83345bea1da76959f2ed84506aefd728ae4fd57f4a3ebf8ff81f88e1dc2986d6e9624051680b94cd99c44df9809d77a763c1518d6cfeace11b515c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50749.exe

Filesize
468KB

MD5
5557c29f6703576d943e06174755de98

SHA1
492199ba2c03c695d814990e2b9b7019d8c6503d

SHA256
3f0fb945a138dfcfd612571fe1cf886c49d7e5a491112df77a2ed347b30da5bd

SHA512
5921f5cd58c8e016dc7ddbcfb58747f145a729377557fa28f30b753ade81e73ce629521e6de7e675ff6ed60775828542e8d018b372cc0680eab2a142895fe86d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51616.exe

Filesize
468KB

MD5
1519c2cdb9ef36de9742e5b7feba5396

SHA1
6075f0d839be88325480d68427dbe1f114f6f376

SHA256
b4d0e7a9d035359ad664d91a717a82e1721c975ea9dc4a18ba25a65d8b518c56

SHA512
d34257737d26af8f540652d6270e94701185f6c23d154b839a381f06105fe915b0ec7ffc3d0a20c1cdeebbbae9383b9ad3a210d18eaaaed16aa2de90af7efd88

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53712.exe

Filesize
468KB

MD5
bdd6be4aa69b217a93577ef48b6449d2

SHA1
4b6719d2225252c22170d8defd46b8d7bdf37737

SHA256
b91a3406d2e87fff315b04b9f89a4e3047b24b0e7ab1993e6958c84f531de67c

SHA512
e7c1dc8ac51ca1e9dbfa05eae9e5ef60be35c4e6ea77d68ce5280f005df854f35d6875712574663c70aa7e2428f58a1de0fd20814d6c16ab9f1e452a3678d7fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55072.exe

Filesize
468KB

MD5
21a80978b826e71ac1566ede6058522c

SHA1
304320a099d1943c0bea93f15d857a07ba908ac5

SHA256
e42e9a3451d5a039a7316d3074212c67c1f7d8ecdeaa3b1607987e241788a2a7

SHA512
2eddf73dfdae51f967073b030a23664e7682516606bb90cd2f1a2a6f38e7852d9b47098b6317d424270341aae9d9280306f4c552ed20d4ccde0abbd1fd730796

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55565.exe

Filesize
468KB

MD5
0fde1d545c6ffd9629703561819557f7

SHA1
448800d87c0c3c8ef1db9613c773ab892e9a6355

SHA256
4fbde72758bf887e1e7123ba13aecc25986fd39b2b2fa03b72f2a2140481c62f

SHA512
865ebd514c299e2d774bd67800cfe898b3537323a0ec4772f6213d6d5beed6e819fd8a08f9dc3b3448cb813972ea83bec908907051ff72879fe2e8bf0302a016

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55830.exe

Filesize
468KB

MD5
57a46120a3b41c47f1cf645864ab8704

SHA1
fec1673b1904d715279cd86f03c9841e596441f2

SHA256
9630213cfb619839945ebef735fcf79a2585ad272e84921b413e4a1ab392281d

SHA512
55eb2a78c08c4d9ea058dd9fd4735e9f99c146713b3bb938ca5df2734557e6cec56983c1ac2cb3c0aeaf1b153fc4168ed677f3951bd354586f8e194a3cfb84f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5608.exe

Filesize
468KB

MD5
88ac48d69f93d7cfcef3988d5bc81181

SHA1
4d6e311c77551e934a59be360053d29a91b4d1ce

SHA256
985233ecf1b7307b228970fba9f79db03fb901334776f08fe247cd1fb15aef9a

SHA512
0c956faddb29cc3117a8071740198ed0be7f10b06cc203abea42b5802a1776c5727bb6217b7bb26f6adb1c783a02dc8e3418a10df29d87fa3d8fe725c6d14f84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5669.exe

Filesize
468KB

MD5
4d89967a5d3421db45e990b3b270fae4

SHA1
5f8c2e7b44cb81edceddd7c8505866cd6cc7d366

SHA256
e7f8e3aeda1ef257e2c432c8eb6a075a47752e6460d3e4b69098ec06953cd5c5

SHA512
da92ed689f223226b5e28509bb802e10378f8dceb2a090547d4e1f1b12a44c074bc6a34d68bb1d07b5372194442102395ce7dd3cbeca74fc0ac3fe97ff541a2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5944.exe

Filesize
468KB

MD5
8127f14665b574b83233ac4bf68f84c4

SHA1
39d725865a895e23bc6d7e8b426db2d27e67ec01

SHA256
7b1b1a8d7d7a389838764be37c6dac35bbd2ed3c8f13a323e5868f8913692213

SHA512
fa62460bf1acda236b96182df10d7978729b77a91bbb8731706c2a3daeb926b875e3f0e981a6d79bf4471bd5782abf37e9612eedbd5f9b5f33f26fe8c86a507d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62185.exe

Filesize
468KB

MD5
7102977cca73017aea28b8a43fa7b149

SHA1
27c16ce4fa6b47e5f8ec39f1efef5b0f14433798

SHA256
2cbdb6c044481631e024879883acdf872634e8bbdba013737f80ca2ba06522e1

SHA512
158ccec533c1f8eb95ba5186d57db2529800fda4f1e1aad9d60d6b7ab0e01dd825d8e3e4d84779ec0a79a5dfd6349d7c2cfb2f5269d7a428b8a0b81b4d0189cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6229.exe

Filesize
468KB

MD5
86f2d00ae38d0251706f47662b4777ec

SHA1
bf79c1834f33a822a81a94463e8f9f15fc290151

SHA256
04346a1367520c849881e0eadd4955235cd5e6893f03d0fbaf1be61ca9368dce

SHA512
39d0afab2cc8026395bcdb9e04fa0ecd34a9832a97294f44473ee1548758cbbc7fa8c34caf8480ab6190b385a2ad1d291a07e48ab992a56b66e8850bea59bed6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63140.exe

Filesize
468KB

MD5
811c643471ee65fcc8a21fb0e109afca

SHA1
10c194dbf9f7a64b21fbc01cfc4d8a4947400236

SHA256
d8e51a59f735935e9c912aed3742c55cd43333f9286cfeb8bce325b15e5b9a45

SHA512
57af74563a01193998fe5dc4431106d5649df462e19ce59ef4e7a0a8872a8ed90da8768600c5648862aa8ae2309da76e7b6459977a95b45dcee9796a2ca8ac41

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63898.exe

Filesize
468KB

MD5
a7a98b34b9a19c228da97c1602a910ce

SHA1
96ec4cadba92dbe7711b9c1558dd8e602b9aad59

SHA256
1fe24938ceb074d17ae3a7dcb81ce919b17a5e4837ed8b39df18fc09f1b8014c

SHA512
970b46bea174acce94c61f23d06b1bf7bf060af8327fad3850e3117e5973fdf6773fe09f16853c3cb996fce93b9fcc59761fe73cc30fe8fc12f4756ab44f25e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6405.exe

Filesize
468KB

MD5
fc0f336ec8f2c13497b0e89ee834e76b

SHA1
07d65d3d19257c04f43ae50740705e467207ec31

SHA256
e637cf98a362a8beb72fa77512e5fb519092d5f411ab9d516f40bd1b8628f04f

SHA512
a83f98c2de67cce5f827ef11f9d6c37c7ac7018972b73402581324fc482c56826b0ded65c17edaf3925e5c0b4838afcf7dcd940cc5889af9b2602896d60920aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64288.exe

Filesize
468KB

MD5
3423c7c975af6efcd8297519e3780b13

SHA1
122a8c0df9a372ed4300cbbea3224938487efb36

SHA256
05a2ee2f54722ba8aa088cf4fa72f796789f99c3ca447071bd538e75d9374c3b

SHA512
47ce2913a83abfe786cd48bc8ae7272c164b2d1f25470a8d94e37be187796948de6176721902e81cb3d0fad4ab00c879b9c16ed1b47fbd7ee96e8919a7bc6ded

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7775.exe

Filesize
468KB

MD5
84595158be8a284b60932ce7cdf509fc

SHA1
e6e5abefc9c98982e6b32a10b8a7d9ce8da55398

SHA256
327e3ce2a689f283323334cba8597f57f91032612469295b6ba33552f6fc6bf8

SHA512
dcf47312a5b811b98b2647f51b728c3ec29283fa3164bd046e383378c0ec3dc5d26bcb1d03e1cdb81b3b375eb3274e976420ff84118d8ef34ec99234e8da4c1c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9135.exe

Filesize
468KB

MD5
391be359670a577c32c49376448b269e

SHA1
e23716a8823e1600ffb658d85aca94c173c27369

SHA256
1bd3c38b6a8a8a76ea97bed497e663f05a1061961654008eb5bdeff80256859a

SHA512
d8041ca7eb8b395af2d0f9605dfccfa6bf89de35be3156ac55cd081a415362defcc4f203fc011864dcb410697571f18d5f0e4be7918fab5830f39a141efc91db

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9784.exe

Filesize
468KB

MD5
cbde5297b54e8b1c53e791429f2699fb

SHA1
bf48b105c79778723b9164794ed7d5f65883d34c

SHA256
7269b3b6402d00efef797312d142439aa80f2ed4775577aa5c336446008019b2

SHA512
d44e6c66ce4363119e5b4a0778bec5475b2572e99ed3e6532706fb3d4a8bdf9aec382285f21937fa9fa8ef2c4bf2d47cc0d9fac7a0c3f7132d8eff6c62a06e18

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads