cc66ef2b469ad5cb8363eca56883b21aad7e8aec58a1ce29483a2279de2881ad

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 03:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc66ef2b469ad5cb8363eca56883b21aad7e8aec58a1ce29483a2279de2881ad.exe
Size

468KB
MD5

b33752a5265fd8784da295b4a0c6dc65
SHA1

381a459779eb387f8f9199c6bad6144be68cbed1
SHA256

cc66ef2b469ad5cb8363eca56883b21aad7e8aec58a1ce29483a2279de2881ad
SHA512

97903451332d708259fc53c7d40e3513e1cdd9fdc84341c0a8ca5394002a97637c02c43c024ce2b73a4286ffb554afa8811c6a430ef7875f454c084fd2042eca
SSDEEP

3072:4bglogxaIU5EtbYdP1cfmbfD/n2zncIH9wmyeQVqiWlDkkhruxUlU:4bSoCcEtGP+fmbfrabyWlo8rux

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3212	Unicorn-54049.exe
1048	Unicorn-32576.exe
1760	Unicorn-45767.exe
2408	Unicorn-3375.exe
4656	Unicorn-19136.exe
3896	Unicorn-64807.exe
1868	Unicorn-46062.exe
1736	Unicorn-50080.exe
2988	Unicorn-30406.exe
3140	Unicorn-33552.exe
3652	Unicorn-40096.exe
816	Unicorn-23760.exe
4660	Unicorn-40023.exe
2828	Unicorn-4086.exe
3092	Unicorn-34157.exe
4344	Unicorn-37696.exe
4336	Unicorn-1686.exe
2004	Unicorn-54032.exe
3084	Unicorn-5245.exe
4956	Unicorn-43856.exe
456	Unicorn-39942.exe
4604	Unicorn-59808.exe
3516	Unicorn-26944.exe
3300	Unicorn-32289.exe
4980	Unicorn-10415.exe
468	Unicorn-4285.exe
4192	Unicorn-1485.exe
3588	Unicorn-45776.exe
4296	Unicorn-45511.exe
3996	Unicorn-42438.exe
4308	Unicorn-36766.exe
4560	Unicorn-431.exe
2136	Unicorn-48672.exe
2308	Unicorn-12470.exe
3712	Unicorn-28893.exe
3832	Unicorn-34640.exe
3564	Unicorn-1967.exe
3120	Unicorn-1391.exe
4844	Unicorn-22808.exe
1288	Unicorn-44078.exe
1396	Unicorn-50400.exe
928	Unicorn-34064.exe
4440	Unicorn-34064.exe
4412	Unicorn-36176.exe
1692	Unicorn-27238.exe
1756	Unicorn-19264.exe
2980	Unicorn-19264.exe
4972	Unicorn-48599.exe
2164	Unicorn-27053.exe
1548	Unicorn-16118.exe
4968	Unicorn-48215.exe
1916	Unicorn-2278.exe
1156	Unicorn-2543.exe
1752	Unicorn-45806.exe
1564	Unicorn-48407.exe
3800	Unicorn-26576.exe
3828	Unicorn-42839.exe
2340	Unicorn-17889.exe
4648	Unicorn-54152.exe
2364	Unicorn-19280.exe
5096	Unicorn-15558.exe
1440	Unicorn-15174.exe
2700	Unicorn-37152.exe
3760	Unicorn-49575.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
6912	1812	WerFault.exe	172

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56886.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52471.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34368.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30485.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33195.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45057.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45776.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48672.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37152.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41425.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55994.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31925.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55651.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64465.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63735.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11478.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59674.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11718.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26020.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37859.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42960.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3280.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40547.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16179.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1105.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-665.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34157.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37465.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13300.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7225.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cc66ef2b469ad5cb8363eca56883b21aad7e8aec58a1ce29483a2279de2881ad.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1673.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58671.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53637.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-207.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26005.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65278.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7104.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7104.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62385.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54384.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40071.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	8480	dwm.exe
Token: SeChangeNotifyPrivilege	8480	dwm.exe
Token: 33	8480	dwm.exe
Token: SeIncBasePriorityPrivilege	8480	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4408	cc66ef2b469ad5cb8363eca56883b21aad7e8aec58a1ce29483a2279de2881ad.exe
3212	Unicorn-54049.exe
1048	Unicorn-32576.exe
1760	Unicorn-45767.exe
4656	Unicorn-19136.exe
2408	Unicorn-3375.exe
3896	Unicorn-64807.exe
1868	Unicorn-46062.exe
1736	Unicorn-50080.exe
2988	Unicorn-30406.exe
3140	Unicorn-33552.exe
2828	Unicorn-4086.exe
4660	Unicorn-40023.exe
3092	Unicorn-34157.exe
816	Unicorn-23760.exe
3652	Unicorn-40096.exe
4344	Unicorn-37696.exe
4336	Unicorn-1686.exe
2004	Unicorn-54032.exe
3084	Unicorn-5245.exe
4956	Unicorn-43856.exe
4604	Unicorn-59808.exe
456	Unicorn-39942.exe
4296	Unicorn-45511.exe
4980	Unicorn-10415.exe
468	Unicorn-4285.exe
3516	Unicorn-26944.exe
4192	Unicorn-1485.exe
3300	Unicorn-32289.exe
3588	Unicorn-45776.exe
3996	Unicorn-42438.exe
4308	Unicorn-36766.exe
4560	Unicorn-431.exe
2136	Unicorn-48672.exe
2308	Unicorn-12470.exe
3712	Unicorn-28893.exe
3832	Unicorn-34640.exe
3564	Unicorn-1967.exe
1288	Unicorn-44078.exe
4844	Unicorn-22808.exe
3120	Unicorn-1391.exe
1396	Unicorn-50400.exe
4440	Unicorn-34064.exe
928	Unicorn-34064.exe
2980	Unicorn-19264.exe
1756	Unicorn-19264.exe
2164	Unicorn-27053.exe
4972	Unicorn-48599.exe
4412	Unicorn-36176.exe
1548	Unicorn-16118.exe
1564	Unicorn-48407.exe
1916	Unicorn-2278.exe
1752	Unicorn-45806.exe
1156	Unicorn-2543.exe
4968	Unicorn-48215.exe
3828	Unicorn-42839.exe
3800	Unicorn-26576.exe
2340	Unicorn-17889.exe
2364	Unicorn-19280.exe
5096	Unicorn-15558.exe
4648	Unicorn-54152.exe
1440	Unicorn-15174.exe
2700	Unicorn-37152.exe
4212	Unicorn-49575.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4408 wrote to memory of 3212	4408	cc66ef2b469ad5cb8363eca56883b21aad7e8aec58a1ce29483a2279de2881ad.exe	90
PID 4408 wrote to memory of 3212	4408	cc66ef2b469ad5cb8363eca56883b21aad7e8aec58a1ce29483a2279de2881ad.exe	90
PID 4408 wrote to memory of 3212	4408	cc66ef2b469ad5cb8363eca56883b21aad7e8aec58a1ce29483a2279de2881ad.exe	90
PID 3212 wrote to memory of 1048	3212	Unicorn-54049.exe	96
PID 3212 wrote to memory of 1048	3212	Unicorn-54049.exe	96
PID 3212 wrote to memory of 1048	3212	Unicorn-54049.exe	96
PID 4408 wrote to memory of 1760	4408	cc66ef2b469ad5cb8363eca56883b21aad7e8aec58a1ce29483a2279de2881ad.exe	97
PID 4408 wrote to memory of 1760	4408	cc66ef2b469ad5cb8363eca56883b21aad7e8aec58a1ce29483a2279de2881ad.exe	97
PID 4408 wrote to memory of 1760	4408	cc66ef2b469ad5cb8363eca56883b21aad7e8aec58a1ce29483a2279de2881ad.exe	97
PID 1048 wrote to memory of 2408	1048	Unicorn-32576.exe	100
PID 1048 wrote to memory of 2408	1048	Unicorn-32576.exe	100
PID 1048 wrote to memory of 2408	1048	Unicorn-32576.exe	100
PID 1760 wrote to memory of 4656	1760	Unicorn-45767.exe	102
PID 1760 wrote to memory of 4656	1760	Unicorn-45767.exe	102
PID 1760 wrote to memory of 4656	1760	Unicorn-45767.exe	102
PID 3212 wrote to memory of 3896	3212	Unicorn-54049.exe	103
PID 3212 wrote to memory of 3896	3212	Unicorn-54049.exe	103
PID 3212 wrote to memory of 3896	3212	Unicorn-54049.exe	103
PID 4408 wrote to memory of 1868	4408	cc66ef2b469ad5cb8363eca56883b21aad7e8aec58a1ce29483a2279de2881ad.exe	104
PID 4408 wrote to memory of 1868	4408	cc66ef2b469ad5cb8363eca56883b21aad7e8aec58a1ce29483a2279de2881ad.exe	104
PID 4408 wrote to memory of 1868	4408	cc66ef2b469ad5cb8363eca56883b21aad7e8aec58a1ce29483a2279de2881ad.exe	104
PID 2408 wrote to memory of 1736	2408	Unicorn-3375.exe	107
PID 2408 wrote to memory of 1736	2408	Unicorn-3375.exe	107
PID 2408 wrote to memory of 1736	2408	Unicorn-3375.exe	107
PID 1048 wrote to memory of 2988	1048	Unicorn-32576.exe	108
PID 1048 wrote to memory of 2988	1048	Unicorn-32576.exe	108
PID 1048 wrote to memory of 2988	1048	Unicorn-32576.exe	108
PID 3896 wrote to memory of 3140	3896	Unicorn-64807.exe	109
PID 3896 wrote to memory of 3140	3896	Unicorn-64807.exe	109
PID 3896 wrote to memory of 3140	3896	Unicorn-64807.exe	109
PID 1868 wrote to memory of 3652	1868	Unicorn-46062.exe	110
PID 1868 wrote to memory of 3652	1868	Unicorn-46062.exe	110
PID 1868 wrote to memory of 3652	1868	Unicorn-46062.exe	110
PID 4656 wrote to memory of 816	4656	Unicorn-19136.exe	111
PID 4656 wrote to memory of 816	4656	Unicorn-19136.exe	111
PID 4656 wrote to memory of 816	4656	Unicorn-19136.exe	111
PID 4408 wrote to memory of 4660	4408	cc66ef2b469ad5cb8363eca56883b21aad7e8aec58a1ce29483a2279de2881ad.exe	112
PID 4408 wrote to memory of 4660	4408	cc66ef2b469ad5cb8363eca56883b21aad7e8aec58a1ce29483a2279de2881ad.exe	112
PID 4408 wrote to memory of 4660	4408	cc66ef2b469ad5cb8363eca56883b21aad7e8aec58a1ce29483a2279de2881ad.exe	112
PID 1760 wrote to memory of 2828	1760	Unicorn-45767.exe	113
PID 1760 wrote to memory of 2828	1760	Unicorn-45767.exe	113
PID 1760 wrote to memory of 2828	1760	Unicorn-45767.exe	113
PID 3212 wrote to memory of 3092	3212	Unicorn-54049.exe	114
PID 3212 wrote to memory of 3092	3212	Unicorn-54049.exe	114
PID 3212 wrote to memory of 3092	3212	Unicorn-54049.exe	114
PID 1736 wrote to memory of 4344	1736	Unicorn-50080.exe	115
PID 1736 wrote to memory of 4344	1736	Unicorn-50080.exe	115
PID 1736 wrote to memory of 4344	1736	Unicorn-50080.exe	115
PID 2408 wrote to memory of 4336	2408	Unicorn-3375.exe	116
PID 2408 wrote to memory of 4336	2408	Unicorn-3375.exe	116
PID 2408 wrote to memory of 4336	2408	Unicorn-3375.exe	116
PID 2988 wrote to memory of 2004	2988	Unicorn-30406.exe	117
PID 2988 wrote to memory of 2004	2988	Unicorn-30406.exe	117
PID 2988 wrote to memory of 2004	2988	Unicorn-30406.exe	117
PID 1048 wrote to memory of 3084	1048	Unicorn-32576.exe	118
PID 1048 wrote to memory of 3084	1048	Unicorn-32576.exe	118
PID 1048 wrote to memory of 3084	1048	Unicorn-32576.exe	118
PID 3140 wrote to memory of 4956	3140	Unicorn-33552.exe	119
PID 3140 wrote to memory of 4956	3140	Unicorn-33552.exe	119
PID 3140 wrote to memory of 4956	3140	Unicorn-33552.exe	119
PID 3896 wrote to memory of 456	3896	Unicorn-64807.exe	120
PID 3896 wrote to memory of 456	3896	Unicorn-64807.exe	120
PID 3896 wrote to memory of 456	3896	Unicorn-64807.exe	120
PID 4660 wrote to memory of 4604	4660	Unicorn-40023.exe	121

C:\Users\Admin\AppData\Local\Temp\cc66ef2b469ad5cb8363eca56883b21aad7e8aec58a1ce29483a2279de2881ad.exe
"C:\Users\Admin\AppData\Local\Temp\cc66ef2b469ad5cb8363eca56883b21aad7e8aec58a1ce29483a2279de2881ad.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4408
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54049.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54049.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32576.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32576.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3375.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50080.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37696.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-431.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17889.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18128.exe
        9⤵
        
        PID:5628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5567.exe
        10⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5170.exe
        11⤵
        
        PID:12916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58666.exe
        11⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15264.exe
        11⤵
        
        PID:16548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10613.exe
        11⤵
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
        10⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7104.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:11856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
        10⤵
        
        PID:16280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47399.exe
        9⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40547.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:12980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61946.exe
        10⤵
        
        PID:15488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3321.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:10332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15424.exe
        9⤵
        
        PID:9248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12969.exe
        9⤵
        
        PID:11764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19632.exe
        9⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-283.exe
        9⤵
        
        PID:1268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44936.exe
        8⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20003.exe
        9⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31801.exe
        9⤵
        
        PID:12120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52689.exe
        9⤵
        
        PID:14976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-813.exe
        8⤵
        
        PID:7736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22752.exe
        8⤵
        
        PID:11564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62186.exe
        8⤵
        
        PID:14508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38029.exe
        8⤵
        
        PID:13180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54152.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33888.exe
        8⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20963.exe
        9⤵
        
        PID:8844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28420.exe
        9⤵
        
        PID:3792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43265.exe
        9⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59466.exe
        9⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39154.exe
        9⤵
        
        PID:4428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11478.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45617.exe
        8⤵
        
        PID:10936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41818.exe
        8⤵
        
        PID:13628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42513.exe
        8⤵
        
        PID:2288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16933.exe
        8⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37182.exe
        7⤵
        
        PID:4144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65168.exe
        8⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31667.exe
        9⤵
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8825.exe
        8⤵
        
        PID:4092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13664.exe
        8⤵
        
        PID:12836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33301.exe
        8⤵
        
        PID:16492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48029.exe
        8⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38967.exe
        7⤵
        
        PID:7680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55418.exe
        7⤵
        
        PID:11604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62915.exe
        7⤵
        
        PID:14552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61513.exe
        7⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12470.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38112.exe
        7⤵
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43312.exe
        8⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        9⤵
        
        PID:8388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62065.exe
        9⤵
        
        PID:12224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42218.exe
        9⤵
        
        PID:15000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52615.exe
        8⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        8⤵
        
        PID:11840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16832.exe
        8⤵
        
        PID:14776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6482.exe
        8⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45704.exe
        7⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16160.exe
        8⤵
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44186.exe
        8⤵
        
        PID:11052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24154.exe
        8⤵
        
        PID:14696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27699.exe
        8⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1965.exe
        7⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55146.exe
        7⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37179.exe
        7⤵
        
        PID:12912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13113.exe
        7⤵
        
        PID:16408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16989.exe
        6⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41968.exe
        7⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46547.exe
        8⤵
        
        PID:9716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49306.exe
        8⤵
        
        PID:12612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46378.exe
        8⤵
        
        PID:15268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65290.exe
        8⤵
        
        PID:9992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36854.exe
        7⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15081.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62385.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43364.exe
        7⤵
        
        PID:13272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10566.exe
        6⤵
        
        PID:6232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35395.exe
        7⤵
        
        PID:10056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19705.exe
        7⤵
        
        PID:13088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46378.exe
        7⤵
        
        PID:15976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16748.exe
        7⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65278.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38585.exe
        6⤵
        
        PID:10136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37710.exe
        6⤵
        
        PID:1044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58949.exe
        6⤵
        
        PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1686.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48672.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19280.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7375.exe
        8⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63808.exe
        9⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22339.exe
        10⤵
        
        PID:776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14729.exe
        10⤵
        
        PID:14244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50897.exe
        10⤵
        
        PID:15508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56886.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45985.exe
        9⤵
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39306.exe
        9⤵
        
        PID:13072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4064.exe
        9⤵
        
        PID:15212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32956.exe
        9⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57399.exe
        8⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4777.exe
        8⤵
        
        PID:11064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34496.exe
        8⤵
        
        PID:13848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59418.exe
        8⤵
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33999.exe
        8⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44936.exe
        7⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57872.exe
        8⤵
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45921.exe
        8⤵
        
        PID:12052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43129.exe
        8⤵
        
        PID:15280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19427.exe
        8⤵
        
        PID:17188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1965.exe
        7⤵
        
        PID:7244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22752.exe
        7⤵
        
        PID:11556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64298.exe
        7⤵
        
        PID:14644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45057.exe
        7⤵
        
        PID:10572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15558.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17168.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26144.exe
        8⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62451.exe
        9⤵
        
        PID:12828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27545.exe
        9⤵
        
        PID:15848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51261.exe
        9⤵
        
        PID:10476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30905.exe
        8⤵
        
        PID:10232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35169.exe
        8⤵
        
        PID:13228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30602.exe
        8⤵
        
        PID:15548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14245.exe
        8⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11478.exe
        7⤵
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48794.exe
        7⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37179.exe
        7⤵
        
        PID:14292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57475.exe
        7⤵
        
        PID:17080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46056.exe
        7⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42410.exe
        7⤵
        
        PID:4820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37182.exe
        6⤵
        
        PID:4388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20003.exe
        7⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39577.exe
        7⤵
        
        PID:11444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33835.exe
        7⤵
        
        PID:14432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6678.exe
        6⤵
        
        PID:7724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55763.exe
        6⤵
        
        PID:11624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44241.exe
        6⤵
        
        PID:16380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42960.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62267.exe
        6⤵
        
        PID:16116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28893.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37152.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22944.exe
        7⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17694.exe
        8⤵
        
        PID:3732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31801.exe
        8⤵
        
        PID:12128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20016.exe
        8⤵
        
        PID:14964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11286.exe
        7⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53676.exe
        7⤵
        
        PID:10828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43930.exe
        7⤵
        
        PID:13712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9840.exe
        7⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24546.exe
        7⤵
        
        PID:11332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20950.exe
        6⤵
        
        PID:3900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56144.exe
        7⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44186.exe
        7⤵
        
        PID:10948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47297.exe
        7⤵
        
        PID:14116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7168.exe
        7⤵
        
        PID:17112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50522.exe
        7⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35644.exe
        7⤵
        
        PID:11964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50014.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22752.exe
        6⤵
        
        PID:11540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64298.exe
        6⤵
        
        PID:14636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50488.exe
        6⤵
        
        PID:5520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-919.exe
        5⤵
        
        PID:1160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14799.exe
        6⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2530.exe
        7⤵
        
        PID:10220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3280.exe
        7⤵
        
        PID:13528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31002.exe
        7⤵
        
        PID:15720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-521.exe
        7⤵
        
        PID:11252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12736.exe
        6⤵
        
        PID:10112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55258.exe
        6⤵
        
        PID:13128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21936.exe
        6⤵
        
        PID:15560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22587.exe
        6⤵
        
        PID:1828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35469.exe
        5⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47811.exe
        6⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31849.exe
        5⤵
        
        PID:6488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7840.exe
        6⤵
        
        PID:15824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4556.exe
        6⤵
        
        PID:10320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64995.exe
        5⤵
        
        PID:12408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49171.exe
        5⤵
        
        PID:15944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7133.exe
        5⤵
        
        PID:4988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30406.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54032.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19264.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47920.exe
        7⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22096.exe
        8⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62499.exe
        9⤵
        
        PID:9780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48922.exe
        9⤵
        
        PID:12668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46378.exe
        9⤵
        
        PID:4572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32809.exe
        9⤵
        
        PID:8568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57221.exe
        8⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7104.exe
        8⤵
        
        PID:9164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
        8⤵
        
        PID:16196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
        8⤵
        
        PID:9576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31638.exe
        7⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31568.exe
        7⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46026.exe
        7⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16944.exe
        7⤵
        
        PID:15296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-283.exe
        7⤵
        
        PID:9412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13638.exe
        6⤵
        
        PID:5784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17694.exe
        7⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-665.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11856.exe
        7⤵
        
        PID:15356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35962.exe
        7⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25213.exe
        6⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36106.exe
        6⤵
        
        PID:10672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17584.exe
        6⤵
        
        PID:13540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5801.exe
        6⤵
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31311.exe
        6⤵
        
        PID:8700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46782.exe
        5⤵
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26400.exe
        6⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16473.exe
        7⤵
        
        PID:8952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59866.exe
        7⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-992.exe
        7⤵
        
        PID:14928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28813.exe
        7⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19366.exe
        6⤵
        
        PID:7684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
        6⤵
        
        PID:10164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53162.exe
        6⤵
        
        PID:14044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25232.exe
        6⤵
        
        PID:17192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51223.exe
        5⤵
        
        PID:6512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32112.exe
        6⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8825.exe
        6⤵
        
        PID:10416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44225.exe
        6⤵
        
        PID:12824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30613.exe
        6⤵
        
        PID:16468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4510.exe
        5⤵
        
        PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63438.exe
        5⤵
        
        PID:11640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41384.exe
        5⤵
        
        PID:14560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56177.exe
        5⤵
        
        PID:5092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5245.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34640.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22928.exe
        6⤵
        
        PID:2552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43312.exe
        7⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13855.exe
        8⤵
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44186.exe
        8⤵
        
        PID:10976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65361.exe
        8⤵
        
        PID:14180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28522.exe
        8⤵
        
        PID:4260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36854.exe
        7⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        7⤵
        
        PID:11628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62385.exe
        7⤵
        
        PID:14592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56503.exe
        6⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19651.exe
        7⤵
        
        PID:10812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56618.exe
        7⤵
        
        PID:13776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45505.exe
        7⤵
        
        PID:16316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43670.exe
        7⤵
        
        PID:11004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52410.exe
        6⤵
        
        PID:8936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34368.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15268.exe
        6⤵
        
        PID:14184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61534.exe
        6⤵
        
        PID:12636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27862.exe
        5⤵
        
        PID:3820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31136.exe
        6⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24595.exe
        7⤵
        
        PID:13384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31001.exe
        7⤵
        
        PID:16372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36269.exe
        7⤵
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34937.exe
        6⤵
        
        PID:8308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7104.exe
        6⤵
        
        PID:6740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31936.exe
        6⤵
        
        PID:16224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65436.exe
        6⤵
        
        PID:8796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5597.exe
        5⤵
        
        PID:6404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31715.exe
        6⤵
        
        PID:13816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42937.exe
        6⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58490.exe
        6⤵
        
        PID:5740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57050.exe
        5⤵
        
        PID:8752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64465.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32505.exe
        5⤵
        
        PID:15892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35535.exe
        5⤵
        
        PID:11024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22808.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54256.exe
        5⤵
        
        PID:4836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41968.exe
        6⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18291.exe
        7⤵
        
        PID:9068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21241.exe
        7⤵
        
        PID:12300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33584.exe
        7⤵
        
        PID:15760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63670.exe
        7⤵
        
        PID:2276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59112.exe
        6⤵
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15081.exe
        6⤵
        
        PID:11968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17216.exe
        6⤵
        
        PID:14940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20081.exe
        6⤵
        
        PID:11452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47191.exe
        5⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30403.exe
        6⤵
        
        PID:9696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49306.exe
        6⤵
        
        PID:12620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6864.exe
        6⤵
        
        PID:908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-521.exe
        6⤵
        
        PID:8088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7310.exe
        5⤵
        
        PID:6952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22752.exe
        5⤵
        
        PID:11548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62186.exe
        5⤵
        
        PID:14584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52938.exe
        5⤵
        
        PID:13172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7661.exe
      4⤵
      PID:5360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37088.exe
        5⤵
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60979.exe
        6⤵
        
        PID:10340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22788.exe
        6⤵
        
        PID:13732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28416.exe
        6⤵
        
        PID:17176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27049.exe
        5⤵
        
        PID:8604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4800.exe
        5⤵
        
        PID:10276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31936.exe
        5⤵
        
        PID:16232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28960.exe
        5⤵
        
        PID:16368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-486.exe
      4⤵
      PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48819.exe
        5⤵
        
        PID:14448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20265.exe
        5⤵
        
        PID:17220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64355.exe
        5⤵
        
        PID:16424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
      4⤵
      PID:9932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24056.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24056.exe
      4⤵
      PID:12892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43265.exe
      4⤵
      PID:14972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47982.exe
      4⤵
      PID:9376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64807.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64807.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33552.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43856.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34064.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47728.exe
        7⤵
        
        PID:1100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43824.exe
        8⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65379.exe
        9⤵
        
        PID:9800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42372.exe
        9⤵
        
        PID:12724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46378.exe
        9⤵
        
        PID:15352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48184.exe
        9⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47434.exe
        8⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        8⤵
        
        PID:13308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39450.exe
        8⤵
        
        PID:15784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40071.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52051.exe
        8⤵
        
        PID:12212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6281.exe
        8⤵
        
        PID:14948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39265.exe
        7⤵
        
        PID:9840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32778.exe
        7⤵
        
        PID:12328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7344.exe
        7⤵
        
        PID:4708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48370.exe
        7⤵
        
        PID:8264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14022.exe
        6⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47280.exe
        7⤵
        
        PID:4632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51747.exe
        8⤵
        
        PID:10968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40665.exe
        8⤵
        
        PID:13808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29168.exe
        8⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35321.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7104.exe
        7⤵
        
        PID:12048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28298.exe
        7⤵
        
        PID:13028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25920.exe
        7⤵
        
        PID:16508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48370.exe
        7⤵
        
        PID:8696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29821.exe
        6⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19379.exe
        7⤵
        
        PID:12240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61354.exe
        7⤵
        
        PID:15344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18284.exe
        7⤵
        
        PID:10044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57050.exe
        6⤵
        
        PID:7292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64465.exe
        6⤵
        
        PID:12340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53637.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48215.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16592.exe
        6⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10528.exe
        7⤵
        
        PID:6960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24595.exe
        8⤵
        
        PID:13400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19844.exe
        8⤵
        
        PID:1188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2169.exe
        8⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7449.exe
        7⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13824.exe
        7⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31946.exe
        7⤵
        
        PID:15244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51503.exe
        6⤵
        
        PID:7344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57050.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64465.exe
        6⤵
        
        PID:12364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53637.exe
        6⤵
        
        PID:15960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51679.exe
        6⤵
        
        PID:10356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17005.exe
        5⤵
        
        PID:5928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5567.exe
        6⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12061.exe
        7⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12153.exe
        7⤵
        
        PID:14548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62443.exe
        7⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38092.exe
        7⤵
        
        PID:11588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-921.exe
        6⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7104.exe
        6⤵
        
        PID:11616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
        6⤵
        
        PID:16296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27699.exe
        6⤵
        
        PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7191.exe
        5⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9629.exe
        6⤵
        
        PID:10156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3280.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31002.exe
        6⤵
        
        PID:15728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16748.exe
        6⤵
        
        PID:9056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28768.exe
        5⤵
        
        PID:8328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53306.exe
        5⤵
        
        PID:11696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20162.exe
        5⤵
        
        PID:13832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55949.exe
        5⤵
        
        PID:8356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39942.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1967.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19030.exe
        6⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44577.exe
        7⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45921.exe
        7⤵
        
        PID:12016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56725.exe
        7⤵
        
        PID:14720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14974.exe
        7⤵
        
        PID:1272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9453.exe
        6⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44186.exe
        6⤵
        
        PID:10296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41425.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5412.exe
        6⤵
        
        PID:16520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44199.exe
        5⤵
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19745.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6559.exe
        7⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44186.exe
        7⤵
        
        PID:11216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24154.exe
        7⤵
        
        PID:14680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30139.exe
        7⤵
        
        PID:5236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39353.exe
        6⤵
        
        PID:9100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36401.exe
        6⤵
        
        PID:11456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39701.exe
        6⤵
        
        PID:14420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63791.exe
        5⤵
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54730.exe
        5⤵
        
        PID:8944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4304.exe
        5⤵
        
        PID:11680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3097.exe
        5⤵
        
        PID:15336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45057.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44078.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3872.exe
        5⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23248.exe
        6⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9629.exe
        7⤵
        
        PID:9384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11833.exe
        7⤵
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23792.exe
        7⤵
        
        PID:15612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57126.exe
        7⤵
        
        PID:10456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10521.exe
        6⤵
        
        PID:8644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6912.exe
        6⤵
        
        PID:11804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28298.exe
        6⤵
        
        PID:14344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48754.exe
        6⤵
        
        PID:8912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
        5⤵
        
        PID:6744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52051.exe
        6⤵
        
        PID:12032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61354.exe
        6⤵
        
        PID:15260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44065.exe
        5⤵
        
        PID:9920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53722.exe
        5⤵
        
        PID:12884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12324.exe
        5⤵
        
        PID:16328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39591.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9629.exe
        5⤵
        
        PID:8044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21433.exe
        5⤵
        
        PID:13248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57793.exe
        5⤵
        
        PID:15492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35004.exe
        5⤵
        
        PID:11008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22221.exe
      4⤵
      PID:7948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10905.exe
      4⤵
      PID:10640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18114.exe
      4⤵
      PID:13464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1336.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1336.exe
      4⤵
      PID:1632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34157.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34157.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32289.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32289.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2543.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4640.exe
        6⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62672.exe
        7⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40324.exe
        7⤵
        
        PID:10600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20192.exe
        7⤵
        
        PID:13432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31002.exe
        7⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16748.exe
        7⤵
        
        PID:17112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
        6⤵
        
        PID:7668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28320.exe
        6⤵
        
        PID:10436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40090.exe
        6⤵
        
        PID:13448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22336.exe
        6⤵
        
        PID:14176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31925.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5190.exe
        5⤵
        
        PID:3768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47680.exe
        6⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65267.exe
        7⤵
        
        PID:15328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39940.exe
        6⤵
        
        PID:10804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45356.exe
        6⤵
        
        PID:13736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23706.exe
        6⤵
        
        PID:16388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43854.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22752.exe
        5⤵
        
        PID:11572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62186.exe
        5⤵
        
        PID:14576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17506.exe
        5⤵
        
        PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46782.exe
      4⤵
      PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51223.exe
        5⤵
        
        PID:6600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24051.exe
        6⤵
        
        PID:9624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33737.exe
        6⤵
        
        PID:12472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46186.exe
        6⤵
        
        PID:14668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47693.exe
        6⤵
        
        PID:8484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4653.exe
        5⤵
        
        PID:8312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22474.exe
        5⤵
        
        PID:10536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37179.exe
        5⤵
        
        PID:14304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14073.exe
        5⤵
        
        PID:15912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
        5⤵
        
        PID:9692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42471.exe
      4⤵
      PID:5968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27296.exe
        5⤵
        
        PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54917.exe
        5⤵
        
        PID:10176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52081.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30602.exe
        5⤵
        
        PID:15572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25531.exe
        5⤵
        
        PID:7208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15293.exe
      4⤵
      PID:7520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36457.exe
      4⤵
      PID:9796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57315.exe
      4⤵
      PID:12480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52840.exe
      4⤵
      PID:15920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55949.exe
      4⤵
      PID:17028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45511.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45511.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34064.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1184.exe
        5⤵
        
        PID:448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37088.exe
        6⤵
        
        PID:7068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63091.exe
        7⤵
        
        PID:10564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22788.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44753.exe
        7⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30998.exe
        7⤵
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49930.exe
        6⤵
        
        PID:8720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7104.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39612.exe
        6⤵
        
        PID:16240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56220.exe
        6⤵
        
        PID:4768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
        5⤵
        
        PID:2744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36563.exe
        6⤵
        
        PID:10544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4345.exe
        6⤵
        
        PID:12444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33195.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33195.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8418.exe
        6⤵
        
        PID:1416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44065.exe
        5⤵
        
        PID:9912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53722.exe
        5⤵
        
        PID:12904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4064.exe
        5⤵
        
        PID:15388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60698.exe
        5⤵
        
        PID:17068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3739.exe
        5⤵
        
        PID:4576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53047.exe
      4⤵
      PID:5836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25126.exe
        5⤵
        
        PID:7788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22339.exe
        6⤵
        
        PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46961.exe
        5⤵
        
        PID:10592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42394.exe
        5⤵
        
        PID:13420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30779.exe
        5⤵
        
        PID:3640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44419.exe
        5⤵
        
        PID:16476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25213.exe
      4⤵
      PID:7916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36106.exe
      4⤵
      PID:10648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35264.exe
      4⤵
      PID:13700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24057.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24057.exe
      4⤵
      PID:16160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
      4⤵
      PID:6296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27053.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27053.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64832.exe
      4⤵
      PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20560.exe
        5⤵
        
        PID:7012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37859.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55994.exe
        6⤵
        
        PID:16980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60874.exe
        5⤵
        
        PID:8488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4800.exe
        5⤵
        
        PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
        5⤵
        
        PID:16288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44419.exe
        5⤵
        
        PID:3144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56220.exe
        5⤵
        
        PID:12596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46631.exe
      4⤵
      PID:3752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52051.exe
        5⤵
        
        PID:12060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30217.exe
        5⤵
        
        PID:14784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11808.exe
        5⤵
        
        PID:2688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4083.exe
        5⤵
        
        PID:16428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50209.exe
      4⤵
      PID:9360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13737.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13737.exe
      4⤵
      PID:12400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34979.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34979.exe
      4⤵
      PID:16940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34689.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34689.exe
      4⤵
      PID:1168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37799.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37799.exe
    3⤵
    PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16473.exe
      4⤵
      PID:9004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44460.exe
      4⤵
      PID:11336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49130.exe
      4⤵
      PID:14380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7739.exe
      4⤵
      PID:17244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
      4⤵
      PID:9568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47697.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47697.exe
    3⤵
    PID:7180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34120.exe
    3⤵
    PID:11196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18161.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18161.exe
    3⤵
    PID:1292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3097.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3097.exe
    3⤵
    PID:17200
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45767.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45767.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23760.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45776.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19264.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13903.exe
        7⤵
        
        PID:5296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10528.exe
        8⤵
        
        PID:6988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35395.exe
        9⤵
        
        PID:10064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43140.exe
        9⤵
        
        PID:13048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46378.exe
        9⤵
        
        PID:14932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65290.exe
        9⤵
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59146.exe
        8⤵
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13824.exe
        8⤵
        
        PID:9764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17721.exe
        8⤵
        
        PID:2564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17936.exe
        8⤵
        
        PID:16008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56220.exe
        8⤵
        
        PID:2112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53128.exe
        7⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36179.exe
        8⤵
        
        PID:10748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31620.exe
        8⤵
        
        PID:13744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3616.exe
        8⤵
        
        PID:16568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48673.exe
        7⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37760.exe
        7⤵
        
        PID:4612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48457.exe
        7⤵
        
        PID:16132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33805.exe
        7⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13638.exe
        6⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6559.exe
        7⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44186.exe
        7⤵
        
        PID:10916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24154.exe
        7⤵
        
        PID:14688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16739.exe
        7⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52748.exe
        7⤵
        
        PID:9900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25213.exe
        6⤵
        
        PID:7880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36106.exe
        6⤵
        
        PID:10664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17584.exe
        6⤵
        
        PID:13548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5801.exe
        6⤵
        
        PID:15704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33724.exe
        6⤵
        
        PID:6924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46782.exe
        5⤵
        
        PID:2960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43312.exe
        6⤵
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-329.exe
        7⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21024.exe
        7⤵
        
        PID:11308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65466.exe
        7⤵
        
        PID:4304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38623.exe
        7⤵
        
        PID:12312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52231.exe
        6⤵
        
        PID:868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6036.exe
        6⤵
        
        PID:11660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62385.exe
        6⤵
        
        PID:14600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11718.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6557.exe
        6⤵
        
        PID:9848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18361.exe
        6⤵
        
        PID:12748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13321.exe
        6⤵
        
        PID:4964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48461.exe
        6⤵
        
        PID:11116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43737.exe
        5⤵
        
        PID:8992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48243.exe
        6⤵
        
        PID:3580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40825.exe
        6⤵
        
        PID:5468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24748.exe
        6⤵
        
        PID:12012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18754.exe
        5⤵
        
        PID:11316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19464.exe
        5⤵
        
        PID:14364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62177.exe
        5⤵
        
        PID:3728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36766.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26576.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16400.exe
        6⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23248.exe
        7⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58035.exe
        8⤵
        
        PID:14088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60474.exe
        8⤵
        
        PID:14028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26564.exe
        8⤵
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59722.exe
        7⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40161.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
        7⤵
        
        PID:15252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16274.exe
        7⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55287.exe
        6⤵
        
        PID:912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2498.exe
        7⤵
        
        PID:13500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55994.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44065.exe
        6⤵
        
        PID:9904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53722.exe
        6⤵
        
        PID:12956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34979.exe
        6⤵
        
        PID:16948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16241.exe
        6⤵
        
        PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3270.exe
        5⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24051.exe
        6⤵
        
        PID:9632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59674.exe
        6⤵
        
        PID:12428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6864.exe
        6⤵
        
        PID:15272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48461.exe
        6⤵
        
        PID:9436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1197.exe
        5⤵
        
        PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63786.exe
        5⤵
        
        PID:11056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62561.exe
        5⤵
        
        PID:14260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8697.exe
        5⤵
        
        PID:17236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42839.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4640.exe
        5⤵
        
        PID:5572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11727.exe
        6⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37449.exe
        6⤵
        
        PID:8820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe
        6⤵
        
        PID:12492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57706.exe
        6⤵
        
        PID:15876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3974.exe
        5⤵
        
        PID:7552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5632.exe
        5⤵
        
        PID:10400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56426.exe
        5⤵
        
        PID:12272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30395.exe
        5⤵
        
        PID:15516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15781.exe
        5⤵
        
        PID:8724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62830.exe
      4⤵
      PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35395.exe
        5⤵
        
        PID:10048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-976.exe
        5⤵
        
        PID:13348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16009.exe
        5⤵
        
        PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64029.exe
        5⤵
        
        PID:9496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63735.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41907.exe
      4⤵
      PID:11648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36049.exe
      4⤵
      PID:14524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4086.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4086.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26944.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15174.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23520.exe
        6⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3616.exe
        7⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56915.exe
        8⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59674.exe
        8⤵
        
        PID:12420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46378.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64029.exe
        8⤵
        
        PID:9944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34937.exe
        7⤵
        
        PID:9300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40737.exe
        7⤵
        
        PID:12384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12729.exe
        7⤵
        
        PID:15200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16933.exe
        7⤵
        
        PID:8220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24534.exe
        6⤵
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12434.exe
        7⤵
        
        PID:17044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51185.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7593.exe
        6⤵
        
        PID:12348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13872.exe
        6⤵
        
        PID:16000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58671.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25011.exe
        6⤵
        
        PID:9556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59674.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46378.exe
        6⤵
        
        PID:3968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64906.exe
        6⤵
        
        PID:8688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56455.exe
        5⤵
        
        PID:7464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55763.exe
        5⤵
        
        PID:11688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48600.exe
        5⤵
        
        PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26626.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48599.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16592.exe
        5⤵
        
        PID:5404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54384.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19209.exe
        7⤵
        
        PID:9040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37889.exe
        7⤵
        
        PID:13992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27946.exe
        7⤵
        
        PID:5456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40121.exe
        6⤵
        
        PID:8012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46689.exe
        6⤵
        
        PID:11220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31946.exe
        6⤵
        
        PID:15220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17936.exe
        6⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22478.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12614.exe
        5⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36371.exe
        6⤵
        
        PID:10820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40665.exe
        6⤵
        
        PID:13820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12640.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59347.exe
        6⤵
        
        PID:8840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18601.exe
        5⤵
        
        PID:10124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46593.exe
        5⤵
        
        PID:13140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5401.exe
        5⤵
        
        PID:15584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26062.exe
        5⤵
        
        PID:17164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27028.exe
        5⤵
        
        PID:12852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27373.exe
      4⤵
      PID:5772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26912.exe
        5⤵
        
        PID:5764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63578.exe
        5⤵
        
        PID:8872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34784.exe
        5⤵
        
        PID:12044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39450.exe
        5⤵
        
        PID:15776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21948.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40487.exe
      4⤵
      PID:7560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2832.exe
      4⤵
      PID:9884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26217.exe
      4⤵
      PID:12844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28622.exe
      4⤵
      PID:15872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12468.exe
      4⤵
      PID:7936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4285.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4285.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36176.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46576.exe
        5⤵
        
        PID:5320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31136.exe
        6⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49587.exe
        7⤵
        
        PID:14396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34937.exe
        6⤵
        
        PID:9308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33738.exe
        6⤵
        
        PID:13152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23104.exe
        6⤵
        
        PID:15580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15013.exe
        6⤵
        
        PID:9792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57399.exe
        5⤵
        
        PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51185.exe
        5⤵
        
        PID:4764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7593.exe
        5⤵
        
        PID:12608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4635.exe
        5⤵
        
        PID:15936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47109.exe
        5⤵
        
        PID:7796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52471.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45760.exe
        5⤵
        
        PID:7772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14765.exe
        6⤵
        
        PID:12336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59237.exe
        6⤵
        
        PID:15852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40893.exe
        6⤵
        
        PID:8464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16121.exe
        5⤵
        
        PID:10784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45356.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18505.exe
        5⤵
        
        PID:2724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1673.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24637.exe
      4⤵
      PID:8028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36106.exe
      4⤵
      PID:10680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17584.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17584.exe
      4⤵
      PID:13512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5801.exe
      4⤵
      PID:4448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35535.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35535.exe
      4⤵
      PID:5108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16592.exe
      4⤵
      PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31136.exe
        5⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52051.exe
        6⤵
        
        PID:12096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61354.exe
        6⤵
        
        PID:14456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56458.exe
        6⤵
        
        PID:8776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51082.exe
        5⤵
        
        PID:9108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7104.exe
        5⤵
        
        PID:3540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39612.exe
        5⤵
        
        PID:16176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20729.exe
        5⤵
        
        PID:17260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22862.exe
        5⤵
        
        PID:12484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57399.exe
      4⤵
      PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34931.exe
        5⤵
        
        PID:17156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26005.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51185.exe
      4⤵
      PID:8228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7593.exe
      4⤵
      PID:12560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
      4⤵
      PID:15864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6674.exe
      4⤵
      PID:4128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52031.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52031.exe
    3⤵
    PID:5980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38848.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2873.exe
      4⤵
      PID:10408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39980.exe
      4⤵
      PID:13344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38314.exe
      4⤵
      PID:2524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38092.exe
      4⤵
      PID:6892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7990.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7990.exe
    3⤵
    PID:7192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55651.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55651.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10152
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16179.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16179.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:14328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50785.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50785.exe
    3⤵
    PID:1968
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46062.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46062.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40096.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40096.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10415.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50400.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29280.exe
        6⤵
        
        PID:1812
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1812 -s 720
        7⤵
        Program crash
        
        PID:6912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65416.exe
        6⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38430.exe
        7⤵
        
        PID:12784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63670.exe
        7⤵
        
        PID:12464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4656.exe
        6⤵
        
        PID:7820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52554.exe
        6⤵
        
        PID:4404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23280.exe
        6⤵
        
        PID:15228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45735.exe
        5⤵
        
        PID:5384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41696.exe
        6⤵
        
        PID:388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45283.exe
        7⤵
        
        PID:15476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35994.exe
        7⤵
        
        PID:9988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32633.exe
        6⤵
        
        PID:8896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7104.exe
        6⤵
        
        PID:9464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39612.exe
        6⤵
        
        PID:16216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45296.exe
        6⤵
        
        PID:16412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3869.exe
        5⤵
        
        PID:6008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36323.exe
        6⤵
        
        PID:13428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38313.exe
        6⤵
        
        PID:16552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18217.exe
        5⤵
        
        PID:10192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49281.exe
        5⤵
        
        PID:13212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38457.exe
        5⤵
        
        PID:15500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19538.exe
        5⤵
        
        PID:17076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31217.exe
        5⤵
        
        PID:9752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16118.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12559.exe
        5⤵
        
        PID:3384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19745.exe
        6⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51923.exe
        7⤵
        
        PID:10012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-976.exe
        7⤵
        
        PID:13356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16009.exe
        7⤵
        
        PID:15412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64029.exe
        7⤵
        
        PID:9864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17625.exe
        6⤵
        
        PID:8852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42156.exe
        6⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16841.exe
        6⤵
        
        PID:13472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2240.exe
        6⤵
        
        PID:6360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56220.exe
        6⤵
        
        PID:688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50056.exe
        5⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54179.exe
        6⤵
        
        PID:12800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7840.exe
        6⤵
        
        PID:10336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57126.exe
        6⤵
        
        PID:10468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48865.exe
        5⤵
        
        PID:6344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44860.exe
        5⤵
        
        PID:12780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48457.exe
        5⤵
        
        PID:16248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27757.exe
      4⤵
      PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-160.exe
        5⤵
        
        PID:7196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37449.exe
        5⤵
        
        PID:8332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe
        5⤵
        
        PID:12504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57322.exe
        5⤵
        
        PID:16148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31079.exe
      4⤵
      PID:7848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59729.exe
      4⤵
      PID:10740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26020.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26020.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32675.exe
      4⤵
      PID:16144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42438.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42438.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49575.exe
      4⤵
      Executes dropped EXE
      PID:3760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25056.exe
        5⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12687.exe
        6⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21662.exe
        7⤵
        
        PID:17056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50109.exe
        7⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63873.exe
        6⤵
        
        PID:11088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
        6⤵
        
        PID:14144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64625.exe
        6⤵
        
        PID:15452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11478.exe
        5⤵
        
        PID:7864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30240.exe
        5⤵
        
        PID:10688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26250.exe
        5⤵
        
        PID:13504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22336.exe
        5⤵
        
        PID:15660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47493.exe
        5⤵
        
        PID:5380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5853.exe
      4⤵
      PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37107.exe
        5⤵
        
        PID:8808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5170.exe
        6⤵
        
        PID:12924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7840.exe
        6⤵
        
        PID:14444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23494.exe
        6⤵
        
        PID:8512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37465.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10976.exe
        5⤵
        
        PID:1240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35682.exe
        5⤵
        
        PID:1708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8406.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8406.exe
      4⤵
      PID:7308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55121.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55121.exe
      4⤵
      PID:11244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27961.exe
      4⤵
      PID:768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25763.exe
      4⤵
      PID:17208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57396.exe
      4⤵
      PID:11160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45806.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64832.exe
      4⤵
      PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8671.exe
        5⤵
        
        PID:8180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44186.exe
        5⤵
        
        PID:11180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        5⤵
        
        PID:14656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31925.exe
        5⤵
        
        PID:10376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19542.exe
      4⤵
      PID:7660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18803.exe
        5⤵
        
        PID:12188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30217.exe
        5⤵
        
        PID:13456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35244.exe
        5⤵
        
        PID:4988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30788.exe
        5⤵
        
        PID:1280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28320.exe
      4⤵
      PID:10420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7225.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40017.exe
      4⤵
      PID:15400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63830.exe
      4⤵
      PID:8576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63000.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63000.exe
    3⤵
    PID:6100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-207.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-207.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44186.exe
      4⤵
      PID:10928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47297.exe
      4⤵
      PID:14108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33898.exe
      4⤵
      PID:17252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21948.exe
      4⤵
      PID:228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14733.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14733.exe
    3⤵
    PID:7340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63438.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63438.exe
    3⤵
    PID:11672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59256.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59256.exe
    3⤵
    PID:14732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33025.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33025.exe
    3⤵
    PID:16368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42853.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42853.exe
    3⤵
    PID:10700
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40023.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40023.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59808.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59808.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49575.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49575.exe
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51223.exe
        5⤵
        
        PID:6612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45345.exe
        6⤵
        
        PID:7480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44186.exe
        6⤵
        
        PID:11144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30485.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23040.exe
        6⤵
        
        PID:5204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19427.exe
        6⤵
        
        PID:5224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4653.exe
        5⤵
        
        PID:8320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43121.exe
        5⤵
        
        PID:12108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17928.exe
        5⤵
        
        PID:15204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18466.exe
        5⤵
        
        PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30855.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30855.exe
      4⤵
      PID:6812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4050.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23433.exe
        5⤵
        
        PID:11276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34603.exe
        5⤵
        
        PID:14008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27408.exe
      4⤵
      PID:9012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1113.exe
      4⤵
      PID:11364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40995.exe
      4⤵
      PID:14352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48629.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48629.exe
      4⤵
      PID:5224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48407.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48407.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32544.exe
      4⤵
      PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27488.exe
        5⤵
        
        PID:348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57251.exe
        6⤵
        
        PID:12316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19849.exe
        6⤵
        
        PID:15748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4393.exe
        5⤵
        
        PID:8076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe
        5⤵
        
        PID:12372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-240.exe
        5⤵
        
        PID:16536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35878.exe
      4⤵
      PID:7644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28320.exe
      4⤵
      PID:10428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40090.exe
      4⤵
      PID:13320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7344.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7344.exe
      4⤵
      PID:644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48370.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48370.exe
      4⤵
      PID:4148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27757.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27757.exe
    3⤵
    PID:5712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6559.exe
      4⤵
      PID:7780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14802.exe
        5⤵
        
        PID:13328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44186.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44186.exe
      4⤵
      PID:11136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65361.exe
      4⤵
      PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20249.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20249.exe
      4⤵
      PID:1556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38092.exe
      4⤵
      PID:4800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52398.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52398.exe
    3⤵
    PID:8292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62810.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62810.exe
    3⤵
    PID:9868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37710.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37710.exe
    3⤵
    PID:14316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56120.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56120.exe
    3⤵
    PID:5132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11757.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11757.exe
    3⤵
    PID:6220
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1485.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1485.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1391.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1391.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3872.exe
      4⤵
      PID:5148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47088.exe
        5⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48467.exe
        6⤵
        
        PID:9820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18361.exe
        6⤵
        
        PID:12740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46378.exe
        6⤵
        
        PID:2892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32425.exe
        6⤵
        
        PID:11412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17833.exe
        5⤵
        
        PID:8736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7104.exe
        5⤵
        
        PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
        5⤵
        
        PID:16308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31925.exe
        5⤵
        
        PID:8964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48951.exe
      4⤵
      PID:7312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50609.exe
      4⤵
      PID:8288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7593.exe
      4⤵
      PID:12512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49041.exe
      4⤵
      PID:16164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13446.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13446.exe
    3⤵
    PID:5752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63040.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63040.exe
      4⤵
      PID:7248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63873.exe
      4⤵
      PID:11096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59114.exe
      4⤵
      PID:14016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32144.exe
      4⤵
      PID:14956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16549.exe
      4⤵
      PID:9872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25213.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25213.exe
    3⤵
    PID:7832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51866.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51866.exe
    3⤵
    PID:10776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2016.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2016.exe
    3⤵
    PID:13784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40393.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40393.exe
    3⤵
    PID:16128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55452.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55452.exe
    3⤵
    PID:7004
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27238.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27238.exe
  2⤵
  - Executes dropped EXE
  PID:1692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47920.exe
    3⤵
    PID:5160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45168.exe
      4⤵
      PID:6528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
        5⤵
        
        PID:11808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63658.exe
        5⤵
        
        PID:2392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36873.exe
      4⤵
      PID:8784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1728.exe
      4⤵
      PID:12356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13300.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2438.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2438.exe
    3⤵
    PID:7444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35617.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35617.exe
    3⤵
    PID:9428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31434.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31434.exe
    3⤵
    PID:13060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28475.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28475.exe
    3⤵
    PID:15616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48754.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48754.exe
    3⤵
    PID:8528
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63936.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63936.exe
  2⤵
  PID:5952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20003.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20003.exe
    3⤵
    PID:9072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4800.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4800.exe
    3⤵
    PID:11284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25610.exe
    3⤵
    PID:15288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31157.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31157.exe
    3⤵
    PID:9276
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33701.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33701.exe
  2⤵
  PID:8000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11858.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11858.exe
    3⤵
    PID:17060
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1105.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1105.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:10628
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60986.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60986.exe
  2⤵
  PID:13488
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38002.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38002.exe
  2⤵
  PID:852
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32469.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32469.exe
  2⤵
  PID:11044

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1812 -ip 1812
1⤵
PID:6748

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:8480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10415.exe

Filesize
468KB

MD5
2e9043f7000ea0afd352853c6c5f7ada

SHA1
d1f8829a98a8a08378c5518622bbc161915be9a8

SHA256
93452fde5b0569804c59e88d760dd201cb328c24a8b9e58bfcf000ac9cb9167e

SHA512
5ce0f89a809642e74e820592eb7e4234099f24f57a4fd6b9e6e1c951f5ea1773ac5689304af1928b4e72ad0c83b510eca49ffea7328989cfe74a31b38baf8441

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12061.exe

Filesize
468KB

MD5
ab6f43f5e3012cc2bd314f0802dc2075

SHA1
7df06051d163346dcc2cebc24cfedecb61e0a2b9

SHA256
0e1055b56e4193344ed15d81323aa69a85a4b9b64f42691a65ce7d181b859be0

SHA512
26c183f7e31b7947fc8946c84fdaa24f5b45f3a317c7d085aa1166320a19e4bd762adc1b9e5ce7860e19e6127c146acfd57f63e40e70880db2cbda61fe1ca0a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1485.exe

Filesize
468KB

MD5
ec772e96b3d5c73f4b8c120ef4a9f36d

SHA1
7ccd2a260622f90022c4598186aa2cc6f23704a4

SHA256
b8437c8b0b4a9038c1220e8a278df751d4a92b4456bb70678f1f7b6dbae1224a

SHA512
d1e53253f9994907099140885399eda90f38a247a24764c39a06a409a5685b717c9fd2b8fcea1298eb7312b819e8475f7e9d8bf3303dc3824a32db3c38658cf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1686.exe

Filesize
468KB

MD5
61a0c4a8e64ab6b5268378f45b8114da

SHA1
2d61a2792af35398f611b32a60a5db8e4e6974dc

SHA256
58f851691c544d1519c14814cd081d7529a8b9a5ca35b3376771075360eac12b

SHA512
3e0264a6e981cb918398f15b64119bedaad417e0d7d27e36410fafa2210dc1a7b59abbe39236a12486ea6bcbbd7716a6bedb4c468696fbb4755fd309277ebf58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19136.exe

Filesize
468KB

MD5
b0747d9c04850f50479d6b9faf196e5a

SHA1
5749de7912278cb71a136128b055322a187dbcf6

SHA256
bcf9b9d777fb71658b3c92a0693606bd4efed12f3280993c3332a74d49f004a6

SHA512
d672b9f45d732e25cedcbf3edf55d0cb2cdb310317576304d4b8a04eae607c11d836f318cecb314299a0d7423f2191078ba864df31d3ed6e9bbe4608a33effc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20736.exe

Filesize
468KB

MD5
cd0f992b07a5724da66c3cca410ee07f

SHA1
42789049fe024b902e3c2500b0aa705a20b54a68

SHA256
78a3a50a395d82ffecc8b7d42f1853e872ab8e13164ab305320a6eb29d8134d0

SHA512
e4b17007ac7954d5429da1029bf9a72ed5f8e1698152fcb34f7dac20d5b3b5a4b8195abddb0fd4f348ac2c79ca3d32654f6fbc4405eea9bdcb2f50394bf84875

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23760.exe

Filesize
468KB

MD5
060c4948f45a343bdd27ed6f6f2262e7

SHA1
75bae2316364112ee93ef4cd3a147578cdba0e75

SHA256
8116fdbb0f264152769951e8653e0581aebe1d273cb0a3def9d3c0e7e31f2d97

SHA512
ad5ef5e64c31097c434ac40d6a4115f82ee4183750449f3beb109d6f3be3d4983e5e07675fe9872c9fba288ac1397070c0f68f8446ab0552e13e81268e9153aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26944.exe

Filesize
468KB

MD5
89b586dcd1c27533a518a2907b8f5e69

SHA1
9b0e510dd156afe7413ac06193c409b191774161

SHA256
dd86aaffaa34f76a30f8acac61b2b414b86ad32180417c60302fdae2704629e5

SHA512
bf1faa7198e5659343bc7d0d24b963686d2d0b20927f6aff4ed46471b1f62b1f5b908b5285b100d6f73c7c0e7e40908f317190800db380ab31354ef83d09169b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30406.exe

Filesize
468KB

MD5
11e113803aa2dcb0055821bd34128eeb

SHA1
a3280cce05b5b507d80242bb5d8fd416b51c7110

SHA256
a339f273e810506056d5b47bfea703ec120bde2e909cb233722e25e53a135960

SHA512
50f4901e1bae5900dcd6377296867f0d9a3da833a6107d1b89d1a42f9f51e7a29dfd29b8bd79e1a2ad4241dc1f4257d32ef717fe596a949cedd4e320ec09a47b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32289.exe

Filesize
468KB

MD5
31ed70c8062a5027b89608e7191a5dc8

SHA1
e0a0a5fde79fe75331b9d601b5d9abc83d88f6b5

SHA256
54600132ef00775c4c039dfd747cc603ad622000e2acb220845cbb6d196f4329

SHA512
4d9b2a2f8d5dfb5feef2e8b5ddd74cb3b2f0c0e5481bfe11820a5d2d23a093c53a4f7bc67998b3965aaed87c1266b75b5c026b6e017fd6e0759606712bd772c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32576.exe

Filesize
468KB

MD5
407d5404decdd8de97de3c7329f7bf89

SHA1
3e4fa1cac2f1790df60de4f4946056f861fa521f

SHA256
e3ac4c41c868bdc0f4cbcd1af32194e4cf653433adccd45043ef478c5cd8c84e

SHA512
b69b3eb8f93928a976843000ff56ce26da63920710b5711442d896b00f6d2e6b10ba1d1108a6845b837e1e5d2f3d9a3bc9b04180f5ddc05c47b9ea7597075c20

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33552.exe

Filesize
468KB

MD5
e93597686eee3e66d4f45bc140bc4df1

SHA1
70f30b075fde35780ebcdd73977bef1e7f18c50a

SHA256
d4b521339b59d93d227304b521f2c800d2bb1a4d0575e46e26000c5a02beabf9

SHA512
0a8809bbf9fb4003008122c88c617f12774ff5ff2166690a8283490736c3c9af2816893cd8dc6b2a19b0c62623905e859a8e66bfd7d27b40d55c3f3b0a2c0d05

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3375.exe

Filesize
468KB

MD5
4b00b1957dfa724cf2b5a39134eeef7b

SHA1
ff6964a5b99e3de87cbe0f70797bdb89afafeae6

SHA256
eb87965e1e2ab20536e040137793e8a2822d693aac321900eec50891331615b1

SHA512
df4c600e7ac5914cfcfad4c345e39489ce1f62f3a1177fdb393b540a4019f2871daa1facd64022bf298e79cdf6349fc5e5f1766a351e5665b2e452a821065c79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34157.exe

Filesize
468KB

MD5
e0f930e8b7b310a8f216f09694ab63a4

SHA1
1ce099035e998915639ff90bea237dad02e6cb0c

SHA256
87592d354813ffac734f72e335b219c630eb0022d51f4ab1c20dc90a2244afef

SHA512
300448ba0229a6c56c7593fca995c3446b3906632cc31e595d34758feba64ea02c35caf722e333bc578ad28a2976d394127b48b1e4884b5765e847915941af80

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36766.exe

Filesize
468KB

MD5
70fc5214c2685d359c2ad04353281db1

SHA1
03859ae1237bda4075e40bfb45a8dddd2546e98c

SHA256
9ee1b48b5319326d1e39a98013c4baca1277f924ee6cf26cd86f259acacff53c

SHA512
7df5df2691e3e8b76006b88dffc97924bb7f13493dc1a5a468d3a3e405824aac758eb68c45442b2d5f4506d9b90633553fcd3715dc2a2da4fdece35d25a0b273

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37696.exe

Filesize
468KB

MD5
9ceb88038df58816f96fbc425a79a40c

SHA1
9c87b597fe654b9f2849c324b5bc01c22a6ea6bc

SHA256
7afdf2fa59ba1298ca5df9e41a1168a496df6bfa757c9bc63dca9076da87a55a

SHA512
1cf5840a78e71bafa5acf40129de7076b8b49c8bcb03508a11121b1f3961977d7539ef94013cc19736d0fd28b16883c5e39bc5cf5d1fe0c14a797f354642beeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39942.exe

Filesize
468KB

MD5
26808c068a8fbd521ff5d98b7f0e2e05

SHA1
ed268c4d50c315e802b035de132c06196c697ebd

SHA256
6ec8a815f9cc8f717f71781b3704d17afee7857d74e7416a27e76659c6e8d0b5

SHA512
0f3c1a61fc1e9cd9486f141a47266fbd9ea1687d2cc4c5f17a0ae461aef256af9146051efecee6d0c5472e77755696a6f035b2fd12be4f22468d63b89274c476

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40023.exe

Filesize
468KB

MD5
e5fb058f5a58e11e7d0d19be32286b74

SHA1
fd1b23c8498371086459e895ec739ba392272f16

SHA256
6fe50737da9b69c30d015c2c4873d0c1ae3c593550a3a776e64ab71b7f2648c3

SHA512
c2848fb9849d1fcc901835e48583b8172ac849d118ebf700cb3ca113d8a70e80e8b38d4935d8a8f645f9d780666df5cca5466a0066a11ee01f60b877d6045835

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40096.exe

Filesize
468KB

MD5
70583b926be4cebf7847750394f444cf

SHA1
2b758f87034d1f4bcb859fc08a2360e6038d4868

SHA256
b432d62f7deaa9f5e6b57a5a9e2d4957bd3f8b760d9f93c045746d5aec597216

SHA512
1f26968178fc2406cc4449c6e88c12a3b241e92ce1a480a79bd62c0bb87098c308fbcf7ea2a7e7c96e542a2dafb44b01bab3a6f8e0b0788cb189103a240f4951

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4086.exe

Filesize
468KB

MD5
b526b9f05229051b0c7c86c2ca7c7a50

SHA1
356fa98e89fe1391d34e06c7448d427307631cba

SHA256
7f6ae9538e16112522e643758a7313e1d3e3b661ae20982b3cdce4f10b492623

SHA512
4ac8df3d579f0a928fedab4205f6dd671c0ce8693b8a44a8598f97a61f4715914537f1f5eaf0bd1cc97fb0304e89ef3bcbab4e104c7b23b298f079e97170d071

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42438.exe

Filesize
468KB

MD5
5480b475ad86191416bb1be87c0c393c

SHA1
8063a0be169574182b9ef5657d4042989340beca

SHA256
5cd5f2e311669d955e57c1d3630828a2530eaa211dbb71c8ea71162fa6045aa0

SHA512
fd94a72f4f3da08c140f3562815659561e67dc5f3f149049cf037a67193f1c6a9eda40cfa6404f0f1d4bc86526cee21526e9c75763637b7d9f48bfd0bfa72c43

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4285.exe

Filesize
468KB

MD5
3e3266d6af0538a4eef594b815598a1a

SHA1
0bd731b216964729909a67641cc32d2b63547fb1

SHA256
0e266bce663e02092bae45f3ebcf837279f84ae6f943b2a41617f384c20ef316

SHA512
b7c5f99a6a7dc366d706854084b831131ead5399ec5e55092a000827664751b1bc89e15fff40b041ae2eefa7fae2622aac78a572248e55f009785f64edbc2572

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-431.exe

Filesize
468KB

MD5
a60bc8c27770445646638fa5eebdc9af

SHA1
30bbb72fd5b4e6420c6d868e200c52d8581d88c8

SHA256
b64052f39fce3d8bf512b40788b7a989f99b20a2a82fdb0ec1a80cc7ddd77e79

SHA512
28d16faaaf962f21caabebb6840052968007bf1587ac07be686eae258a26d8bbfef78ad29f9ebbbaa35300159f7c120a35d625c01a02d56321a8d2dd36b917e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43856.exe

Filesize
468KB

MD5
42e4f519c405c6fe93a14816d383db73

SHA1
e7e06753213e48e14b2ee98d5add1b8a27f1f3da

SHA256
83622dd7fce18c259d01bc4d2dc1f1cd2bf3cc000b83c71685970b9e4a02532e

SHA512
8c5e2e4ef279fb0c37b755e8dabef1a19b1f8f18efaa79e1db7bd6a5b9f92c559bf1466bc15d79ffcf132ab63248c9fed43871456e9c8d2aa48877159a6e4ef3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44199.exe

Filesize
468KB

MD5
8a0f0618234e0489f7c6b99f0b9184bf

SHA1
ff32789b1def33fcab670672f1e35ec53872263b

SHA256
50227fb6d2299dce17f82c121d2d6f766817ca6e0f1148cb858d63e291858ad6

SHA512
976c18da3450943b70983eb389843ff0f7dc1105856ed5afc26cfad50410b10dc28628d743d92b47663568020a423a99eddbd4412d4eb283337d392080ad7b75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45511.exe

Filesize
468KB

MD5
644c7b2680d179b4806ed2fc8294e47b

SHA1
6136f22c4dc43adffafc9568f0f884393ac45141

SHA256
51799d848506b2d3a15f429da4233784e0038d4af6da830b58b06df3bb446353

SHA512
94670ef0d6358513c6e11010f7b5debac3a01c12afed81ef1193497d86ab17586713e4c18425332564f81ed42c02c1b90c929672454b6273fb3bf105a9c9f150

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45767.exe

Filesize
468KB

MD5
786b48bb8002e3b6af077775597dd18b

SHA1
00405a378f0d06fe666d74dcd52de0dc5d0dc571

SHA256
3f953037b3d0441351759398927b162f5f56acc1793711af9856526e42e893a9

SHA512
b166ad7155827cf62220efba8181f4e92201f30c275f9b5e01b45b354c98a55c5e08c953f6506f29d3c99a6ca543954930ddab0a824df278cdb8a8628021dc57

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45776.exe

Filesize
468KB

MD5
39bfcab2e2a71763a7facf74c184a1a2

SHA1
c8409694014a3cd753ab37bd3cc3d4ee71383a57

SHA256
14be8af8be9bf03a65b4e9a3f9b2ef882a332c6ac11fca880ccdf1865b4b68e3

SHA512
42bfe42dbd298188b1a891f4ce44d2aa907a9dc17f38c675a2857e5db525c6016d93767b5dea199c72fdd5ff36df44bdc411cf0b083eb353a7791998fcc2bd6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46062.exe

Filesize
468KB

MD5
da15bb31418de189418d008a88013985

SHA1
6fb30061206a878ee8940ea1123ba92a6c28a016

SHA256
7d24f2d061852795638f40dd663e63a08e272e5f2875ac9a21b687dda64497f7

SHA512
9695759552299e62eafa6112615632b9ed33e131101771773ffb9f0847326c2e62aeec0627645ec136c3619e71eb680581ead9785d188e77677d36277b32cbe8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50080.exe

Filesize
468KB

MD5
3c26101bb0d0e25d38b7366c6e962058

SHA1
16aff55bb0c32fea1c4ab9b0ae3222c512987b00

SHA256
be6b2fed39ced3b5592c49714976d49fdde095a4b5231a58bbe8ea63f7f2f1c0

SHA512
4e5b19155584952944fc9c2f33399a3132bbd2893dd8e6a8513e132ec347d96f20a4ec11dac75e0fd7b04226ef6cbc3a628767c990d7bfb3cebb336c68f8babd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5245.exe

Filesize
468KB

MD5
48c5d7acb98076d49193c1440d381c9a

SHA1
d3c38504c9ca598a465ff3ce96505cd989083515

SHA256
e7063f2dac3884ec0b758172c7b7a261baf169c997b5057c1e23c772b730df69

SHA512
62e938b048544ee43943bd7a6328a5771720f24089c4b6c6a1a0473f52e18befb457763303d5400a98e89698a61d043ded7671268baa89b5fb336e6f228798f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54032.exe

Filesize
468KB

MD5
8fb68cf14f065c2d90cc222e99fa9fcd

SHA1
35480cd1a7eb58a924307781bd514d7c2ff523c7

SHA256
60aaa711274647c946c8a6d81a3f9ebbb4f36233538a3bbfe3c832287d90f883

SHA512
948876bf637305242d980fea9522108b7ad2b3375ba24183bab0395a0a4c8535ef89a9ddd155e802a954074967ba724fe1a21d1b4db08ba7417bc65935dc510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54049.exe

Filesize
468KB

MD5
8deeaf4572f828dfb08b2a2a30e1d39d

SHA1
e60952e6da42da67a89622065badc37f30d69407

SHA256
57b85a64247b4658502cf6985f2420e047f234d8c4d2d268483c5340cf4f9dc8

SHA512
d7e6014d08ad841cbdc1c2a310f1ba483d8ebe473ca9a1b96ef688544cd804fa560629ed97864eb45e8645f8072e6851c9f85ac516231aa1c6e467af5a9a46e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59808.exe

Filesize
468KB

MD5
7328b7920826ec7a5f35bd7e75511a88

SHA1
b2c3a2d951ae7b01197b192c3ebc3853340e4d5e

SHA256
53586ccd6fcc2ce123fc585e00909c17f1e1bb50ef26adaf9faaa925ea03caf4

SHA512
74f9e6f72b9656f1e94be17e42a2d3466a31555778c88662fe4682d1227bf7db609171d54d0a8d81aa98287ebc01acd52bf0e847f2d0d9b84b67425bef7689dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64807.exe

Filesize
468KB

MD5
2f7c3e5f575c935422e56198487b2aa1

SHA1
1cfddec3a42ba030fdffb857b0c150f288130d39

SHA256
c0052c3ab9263b97a3168659de2af680eb8eb79b13fd0f43883d22925b27882c

SHA512
6a6bbd31aa97c062f3b45cbf5da0aae8a9fa5cbb7c9108119e009cf2e460548c378c8553d258b3d3d66b9a05d0897497bda6d3601af6556bcdbdf65523fc4480

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads