af9a09e1100acb8c8282411bf20a8d68bc5687c0c4803b41b45d5e3bd1c8be6b

Analysis

max time kernel
150s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/01/2025, 09:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

af9a09e1100acb8c8282411bf20a8d68bc5687c0c4803b41b45d5e3bd1c8be6b.exe
Size

468KB
MD5

0232a14faeb51ca4b027a8ce5d58efcb
SHA1

34732b5e0dfdafbfd25a6e5d73e27e404bac371a
SHA256

af9a09e1100acb8c8282411bf20a8d68bc5687c0c4803b41b45d5e3bd1c8be6b
SHA512

0834e565b5e8eee877e0c1832bb857c339811b642f30b761e4251c8628c6a914065b0693cc899d08b2c0b078a4d67922743de434c7494b2b991a0227b156016a
SSDEEP

3072:4bSlogxaIU573bY4Pzcfmbff/n2DnsIHzQmyeQBRA2Vukt2buxuly:4bUoCc73LP4fmbfva5d2V/8bux

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3404	Unicorn-60474.exe
940	Unicorn-10048.exe
824	Unicorn-29914.exe
4716	Unicorn-7521.exe
3360	Unicorn-9559.exe
4908	Unicorn-27942.exe
4384	Unicorn-12160.exe
3052	Unicorn-54714.exe
2656	Unicorn-43016.exe
5016	Unicorn-43806.exe
4728	Unicorn-51709.exe
4428	Unicorn-51974.exe
2976	Unicorn-40276.exe
3068	Unicorn-54012.exe
2580	Unicorn-54278.exe
2776	Unicorn-34412.exe
2248	Unicorn-58362.exe
3316	Unicorn-38496.exe
3908	Unicorn-15283.exe
1776	Unicorn-4693.exe
2320	Unicorn-3931.exe
2744	Unicorn-21030.exe
3132	Unicorn-35320.exe
5096	Unicorn-41450.exe
4208	Unicorn-45534.exe
4664	Unicorn-49353.exe
656	Unicorn-33836.exe
4436	Unicorn-43910.exe
2272	Unicorn-47994.exe
4280	Unicorn-41864.exe
5104	Unicorn-56162.exe
2312	Unicorn-40380.exe
2728	Unicorn-17167.exe
4568	Unicorn-11600.exe
4812	Unicorn-31201.exe
2140	Unicorn-41672.exe
3568	Unicorn-27936.exe
1560	Unicorn-57122.exe
472	Unicorn-49509.exe
4864	Unicorn-36510.exe
4072	Unicorn-44678.exe
4336	Unicorn-31464.exe
2148	Unicorn-56930.exe
404	Unicorn-50800.exe
2560	Unicorn-61014.exe
2204	Unicorn-15632.exe
3704	Unicorn-11051.exe
3032	Unicorn-19982.exe
1232	Unicorn-8284.exe
3288	Unicorn-61569.exe
1636	Unicorn-116.exe
4204	Unicorn-38600.exe
4340	Unicorn-38600.exe
828	Unicorn-47174.exe
4404	Unicorn-47174.exe
432	Unicorn-55342.exe
984	Unicorn-39560.exe
3948	Unicorn-18394.exe
4276	Unicorn-18394.exe
456	Unicorn-26562.exe
4532	Unicorn-34730.exe
2284	Unicorn-51621.exe
1572	Unicorn-46790.exe
1028	Unicorn-46790.exe

Program crash 6 IoCs

pid	pid_target	Process	procid_target
7356	4212	WerFault.exe	172
16588	16460	WerFault.exe	810
8976	18672	Process not Found	995
8820	19752	Process not Found	1054
6208	19752	Process not Found	1054
9832	9844	Process not Found	1282

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56816.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13970.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47174.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19162.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54708.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62104.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33638.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25287.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62475.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21495.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37722.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20367.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31483.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48648.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44681.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-452.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28122.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8568.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7192.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37892.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35034.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18616.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38168.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54870.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13227.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50845.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24157.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3617.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32305.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17768.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61044.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18640.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1675.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38600.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33638.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33895.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13832.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Process not Found

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
15652	svchost.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	17288	dwm.exe
Token: SeChangeNotifyPrivilege	17288	dwm.exe
Token: 33	17288	dwm.exe
Token: SeIncBasePriorityPrivilege	17288	dwm.exe
Token: SeCreateGlobalPrivilege	20368	Process not Found
Token: SeChangeNotifyPrivilege	20368	Process not Found
Token: 33	20368	Process not Found
Token: SeIncBasePriorityPrivilege	20368	Process not Found

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
428	af9a09e1100acb8c8282411bf20a8d68bc5687c0c4803b41b45d5e3bd1c8be6b.exe
3404	Unicorn-60474.exe
940	Unicorn-10048.exe
824	Unicorn-29914.exe
4716	Unicorn-7521.exe
3360	Unicorn-9559.exe
4908	Unicorn-27942.exe
4384	Unicorn-12160.exe
3052	Unicorn-54714.exe
2656	Unicorn-43016.exe
5016	Unicorn-43806.exe
4728	Unicorn-51709.exe
2976	Unicorn-40276.exe
3068	Unicorn-54012.exe
4428	Unicorn-51974.exe
2776	Unicorn-34412.exe
2580	Unicorn-54278.exe
3316	Unicorn-38496.exe
2248	Unicorn-58362.exe
3908	Unicorn-15283.exe
1776	Unicorn-4693.exe
2320	Unicorn-3931.exe
3132	Unicorn-35320.exe
656	Unicorn-33836.exe
4664	Unicorn-49353.exe
5096	Unicorn-41450.exe
2744	Unicorn-21030.exe
4208	Unicorn-45534.exe
4436	Unicorn-43910.exe
4280	Unicorn-41864.exe
2272	Unicorn-47994.exe
2312	Unicorn-40380.exe
5104	Unicorn-56162.exe
2728	Unicorn-17167.exe
3568	Unicorn-27936.exe
2140	Unicorn-41672.exe
4568	Unicorn-11600.exe
4812	Unicorn-31201.exe
472	Unicorn-49509.exe
1560	Unicorn-57122.exe
4072	Unicorn-44678.exe
4864	Unicorn-36510.exe
404	Unicorn-50800.exe
4336	Unicorn-31464.exe
2560	Unicorn-61014.exe
1636	Unicorn-116.exe
3032	Unicorn-19982.exe
3288	Unicorn-61569.exe
2148	Unicorn-56930.exe
3704	Unicorn-11051.exe
1232	Unicorn-8284.exe
2204	Unicorn-15632.exe
4340	Unicorn-38600.exe
4204	Unicorn-38600.exe
828	Unicorn-47174.exe
4404	Unicorn-47174.exe
432	Unicorn-55342.exe
984	Unicorn-39560.exe
4532	Unicorn-34730.exe
4276	Unicorn-18394.exe
456	Unicorn-26562.exe
3948	Unicorn-18394.exe
2284	Unicorn-51621.exe
1572	Unicorn-46790.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 428 wrote to memory of 3404	428	af9a09e1100acb8c8282411bf20a8d68bc5687c0c4803b41b45d5e3bd1c8be6b.exe	84
PID 428 wrote to memory of 3404	428	af9a09e1100acb8c8282411bf20a8d68bc5687c0c4803b41b45d5e3bd1c8be6b.exe	84
PID 428 wrote to memory of 3404	428	af9a09e1100acb8c8282411bf20a8d68bc5687c0c4803b41b45d5e3bd1c8be6b.exe	84
PID 428 wrote to memory of 940	428	af9a09e1100acb8c8282411bf20a8d68bc5687c0c4803b41b45d5e3bd1c8be6b.exe	87
PID 428 wrote to memory of 940	428	af9a09e1100acb8c8282411bf20a8d68bc5687c0c4803b41b45d5e3bd1c8be6b.exe	87
PID 428 wrote to memory of 940	428	af9a09e1100acb8c8282411bf20a8d68bc5687c0c4803b41b45d5e3bd1c8be6b.exe	87
PID 3404 wrote to memory of 824	3404	Unicorn-60474.exe	88
PID 3404 wrote to memory of 824	3404	Unicorn-60474.exe	88
PID 3404 wrote to memory of 824	3404	Unicorn-60474.exe	88
PID 940 wrote to memory of 4716	940	Unicorn-10048.exe	91
PID 940 wrote to memory of 4716	940	Unicorn-10048.exe	91
PID 940 wrote to memory of 4716	940	Unicorn-10048.exe	91
PID 428 wrote to memory of 3360	428	af9a09e1100acb8c8282411bf20a8d68bc5687c0c4803b41b45d5e3bd1c8be6b.exe	92
PID 428 wrote to memory of 3360	428	af9a09e1100acb8c8282411bf20a8d68bc5687c0c4803b41b45d5e3bd1c8be6b.exe	92
PID 428 wrote to memory of 3360	428	af9a09e1100acb8c8282411bf20a8d68bc5687c0c4803b41b45d5e3bd1c8be6b.exe	92
PID 824 wrote to memory of 4908	824	Unicorn-29914.exe	93
PID 824 wrote to memory of 4908	824	Unicorn-29914.exe	93
PID 824 wrote to memory of 4908	824	Unicorn-29914.exe	93
PID 3404 wrote to memory of 4384	3404	Unicorn-60474.exe	94
PID 3404 wrote to memory of 4384	3404	Unicorn-60474.exe	94
PID 3404 wrote to memory of 4384	3404	Unicorn-60474.exe	94
PID 4716 wrote to memory of 3052	4716	Unicorn-7521.exe	97
PID 4716 wrote to memory of 3052	4716	Unicorn-7521.exe	97
PID 4716 wrote to memory of 3052	4716	Unicorn-7521.exe	97
PID 940 wrote to memory of 2656	940	Unicorn-10048.exe	98
PID 940 wrote to memory of 2656	940	Unicorn-10048.exe	98
PID 940 wrote to memory of 2656	940	Unicorn-10048.exe	98
PID 3360 wrote to memory of 5016	3360	Unicorn-9559.exe	100
PID 3360 wrote to memory of 5016	3360	Unicorn-9559.exe	100
PID 3360 wrote to memory of 5016	3360	Unicorn-9559.exe	100
PID 428 wrote to memory of 4728	428	af9a09e1100acb8c8282411bf20a8d68bc5687c0c4803b41b45d5e3bd1c8be6b.exe	101
PID 428 wrote to memory of 4728	428	af9a09e1100acb8c8282411bf20a8d68bc5687c0c4803b41b45d5e3bd1c8be6b.exe	101
PID 428 wrote to memory of 4728	428	af9a09e1100acb8c8282411bf20a8d68bc5687c0c4803b41b45d5e3bd1c8be6b.exe	101
PID 4384 wrote to memory of 4428	4384	Unicorn-12160.exe	102
PID 4384 wrote to memory of 4428	4384	Unicorn-12160.exe	102
PID 4384 wrote to memory of 4428	4384	Unicorn-12160.exe	102
PID 824 wrote to memory of 2976	824	Unicorn-29914.exe	103
PID 824 wrote to memory of 2976	824	Unicorn-29914.exe	103
PID 824 wrote to memory of 2976	824	Unicorn-29914.exe	103
PID 3404 wrote to memory of 3068	3404	Unicorn-60474.exe	104
PID 3404 wrote to memory of 3068	3404	Unicorn-60474.exe	104
PID 3404 wrote to memory of 3068	3404	Unicorn-60474.exe	104
PID 3052 wrote to memory of 2580	3052	Unicorn-54714.exe	105
PID 3052 wrote to memory of 2580	3052	Unicorn-54714.exe	105
PID 3052 wrote to memory of 2580	3052	Unicorn-54714.exe	105
PID 4908 wrote to memory of 2776	4908	Unicorn-27942.exe	106
PID 4908 wrote to memory of 2776	4908	Unicorn-27942.exe	106
PID 4908 wrote to memory of 2776	4908	Unicorn-27942.exe	106
PID 2656 wrote to memory of 2248	2656	Unicorn-43016.exe	107
PID 2656 wrote to memory of 2248	2656	Unicorn-43016.exe	107
PID 2656 wrote to memory of 2248	2656	Unicorn-43016.exe	107
PID 4716 wrote to memory of 3316	4716	Unicorn-7521.exe	108
PID 4716 wrote to memory of 3316	4716	Unicorn-7521.exe	108
PID 4716 wrote to memory of 3316	4716	Unicorn-7521.exe	108
PID 940 wrote to memory of 3908	940	Unicorn-10048.exe	109
PID 940 wrote to memory of 3908	940	Unicorn-10048.exe	109
PID 940 wrote to memory of 3908	940	Unicorn-10048.exe	109
PID 4728 wrote to memory of 1776	4728	Unicorn-51709.exe	110
PID 4728 wrote to memory of 1776	4728	Unicorn-51709.exe	110
PID 4728 wrote to memory of 1776	4728	Unicorn-51709.exe	110
PID 428 wrote to memory of 2320	428	af9a09e1100acb8c8282411bf20a8d68bc5687c0c4803b41b45d5e3bd1c8be6b.exe	111
PID 428 wrote to memory of 2320	428	af9a09e1100acb8c8282411bf20a8d68bc5687c0c4803b41b45d5e3bd1c8be6b.exe	111
PID 428 wrote to memory of 2320	428	af9a09e1100acb8c8282411bf20a8d68bc5687c0c4803b41b45d5e3bd1c8be6b.exe	111
PID 2976 wrote to memory of 2744	2976	Unicorn-40276.exe	112

C:\Users\Admin\AppData\Local\Temp\af9a09e1100acb8c8282411bf20a8d68bc5687c0c4803b41b45d5e3bd1c8be6b.exe
"C:\Users\Admin\AppData\Local\Temp\af9a09e1100acb8c8282411bf20a8d68bc5687c0c4803b41b45d5e3bd1c8be6b.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:428
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60474.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60474.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29914.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29914.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27942.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34412.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:2776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43910.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25492.exe
        7⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40070.exe
        8⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59678.exe
        9⤵
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24422.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:13048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22766.exe
        10⤵
        
        PID:20180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17820.exe
        9⤵
        
        PID:13532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
        9⤵
        
        PID:19664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21660.exe
        8⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23322.exe
        9⤵
        
        PID:12680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20680.exe
        9⤵
        
        PID:6456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27663.exe
        8⤵
        
        PID:13692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7582.exe
        8⤵
        
        PID:18764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19523.exe
        7⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50421.exe
        8⤵
        
        PID:17636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27613.exe
        7⤵
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17567.exe
        7⤵
        
        PID:14636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62475.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:19616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26924.exe
        6⤵
        
        PID:344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33490.exe
        7⤵
        
        PID:3432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51754.exe
        8⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40898.exe
        9⤵
        
        PID:11152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe
        9⤵
        
        PID:16052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe
        9⤵
        
        PID:20072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38520.exe
        8⤵
        
        PID:9772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15584.exe
        8⤵
        
        PID:17308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34192.exe
        7⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        8⤵
        
        PID:14468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1431.exe
        7⤵
        
        PID:11900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3524.exe
        7⤵
        
        PID:10916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
        6⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41806.exe
        7⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8609.exe
        8⤵
        
        PID:11812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-452.exe
        9⤵
        
        PID:4772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe
        8⤵
        
        PID:16256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30523.exe
        8⤵
        
        PID:2240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24157.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54724.exe
        7⤵
        
        PID:17764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43845.exe
        6⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61044.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1868.exe
        6⤵
        
        PID:2612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41864.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47174.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1201.exe
        7⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48814.exe
        8⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21106.exe
        9⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8691.exe
        9⤵
        
        PID:15460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14188.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:17672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
        8⤵
        
        PID:10104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27383.exe
        8⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
        8⤵
        
        PID:19024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57161.exe
        7⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24370.exe
        8⤵
        
        PID:11200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe
        8⤵
        
        PID:16072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50918.exe
        8⤵
        
        PID:19076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44664.exe
        7⤵
        
        PID:12004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27723.exe
        7⤵
        
        PID:1640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55425.exe
        6⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29362.exe
        7⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46337.exe
        8⤵
        
        PID:4956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        7⤵
        
        PID:12504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10103.exe
        7⤵
        
        PID:2988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29777.exe
        6⤵
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40774.exe
        7⤵
        
        PID:16624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56233.exe
        7⤵
        
        PID:19408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52788.exe
        6⤵
        
        PID:14348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27045.exe
        6⤵
        
        PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11112.exe
        5⤵
        
        PID:3136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41472.exe
        5⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12249.exe
        6⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19606.exe
        7⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
        8⤵
        
        PID:19580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17436.exe
        7⤵
        
        PID:13652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
        7⤵
        
        PID:19872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17576.exe
        6⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61178.exe
        7⤵
        
        PID:13004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56041.exe
        7⤵
        
        PID:18680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55588.exe
        6⤵
        
        PID:14356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-380.exe
        5⤵
        
        PID:7792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63046.exe
        6⤵
        
        PID:12036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33440.exe
        6⤵
        
        PID:16728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22355.exe
        6⤵
        
        PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61086.exe
        5⤵
        
        PID:11076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54511.exe
        5⤵
        
        PID:15372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25866.exe
        5⤵
        
        PID:18932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40276.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21030.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19982.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2633.exe
        7⤵
        
        PID:1096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2545.exe
        8⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33446.exe
        9⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61282.exe
        10⤵
        
        PID:16872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15636.exe
        10⤵
        
        PID:16688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        9⤵
        
        PID:12392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9143.exe
        9⤵
        
        PID:14676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
        8⤵
        
        PID:9728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34084.exe
        9⤵
        
        PID:17444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61453.exe
        8⤵
        
        PID:13608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19529.exe
        8⤵
        
        PID:19372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61045.exe
        7⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43342.exe
        8⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42014.exe
        9⤵
        
        PID:17004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54505.exe
        9⤵
        
        PID:17548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24644.exe
        8⤵
        
        PID:12996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13227.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31311.exe
        7⤵
        
        PID:7172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20612.exe
        7⤵
        
        PID:4724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56286.exe
        7⤵
        
        PID:18900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19524.exe
        6⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59914.exe
        7⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43970.exe
        8⤵
        
        PID:6908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28122.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52149.exe
        9⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31660.exe
        8⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15584.exe
        8⤵
        
        PID:1920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39620.exe
        7⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60144.exe
        7⤵
        
        PID:13056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63389.exe
        7⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5159.exe
        6⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-633.exe
        7⤵
        
        PID:11912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64156.exe
        7⤵
        
        PID:17532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24951.exe
        6⤵
        
        PID:9476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46532.exe
        6⤵
        
        PID:15688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56816.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:18892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8284.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23246.exe
        6⤵
        
        PID:1316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38534.exe
        7⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39502.exe
        8⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4577.exe
        9⤵
        
        PID:9220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29600.exe
        9⤵
        
        PID:13416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56637.exe
        8⤵
        
        PID:9304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27383.exe
        8⤵
        
        PID:3928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30717.exe
        8⤵
        
        PID:14928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21940.exe
        7⤵
        
        PID:7928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29606.exe
        8⤵
        
        PID:8584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58085.exe
        8⤵
        
        PID:12744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47820.exe
        8⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1431.exe
        7⤵
        
        PID:11856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36389.exe
        7⤵
        
        PID:4116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35476.exe
        6⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38734.exe
        7⤵
        
        PID:11828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe
        7⤵
        
        PID:15924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15147.exe
        7⤵
        
        PID:5376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43757.exe
        6⤵
        
        PID:10788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38756.exe
        6⤵
        
        PID:15596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37586.exe
        6⤵
        
        PID:20232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8755.exe
        5⤵
        
        PID:4160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2545.exe
        6⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
        7⤵
        
        PID:7704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15241.exe
        8⤵
        
        PID:9548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13648.exe
        8⤵
        
        PID:11676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38520.exe
        7⤵
        
        PID:10284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16788.exe
        8⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23177.exe
        7⤵
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11992.exe
        6⤵
        
        PID:9204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61905.exe
        7⤵
        
        PID:1076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60913.exe
        6⤵
        
        PID:12320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38580.exe
        6⤵
        
        PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11984.exe
        5⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2309.exe
        6⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62434.exe
        7⤵
        
        PID:17024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13280.exe
        7⤵
        
        PID:17768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24644.exe
        6⤵
        
        PID:12988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10103.exe
        6⤵
        
        PID:3444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44848.exe
        5⤵
        
        PID:8140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-452.exe
        6⤵
        
        PID:536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60949.exe
        5⤵
        
        PID:14244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5835.exe
        5⤵
        
        PID:19988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35320.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15632.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6717.exe
        5⤵
        
        PID:1892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59914.exe
        6⤵
        
        PID:5932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10913.exe
        7⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29819.exe
        7⤵
        
        PID:14972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32568.exe
        7⤵
        
        PID:17416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39620.exe
        6⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60144.exe
        6⤵
        
        PID:13052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48615.exe
        6⤵
        
        PID:18840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61045.exe
        5⤵
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17562.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2538.exe
        6⤵
        
        PID:19768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33617.exe
        5⤵
        
        PID:9768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63068.exe
        5⤵
        
        PID:15680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54307.exe
        5⤵
        
        PID:20044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30459.exe
      4⤵
      PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50329.exe
        5⤵
        
        PID:7328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14229.exe
        6⤵
        
        PID:11572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3700.exe
        6⤵
        
        PID:15964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14187.exe
        6⤵
        
        PID:4012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37892.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47421.exe
        5⤵
        
        PID:15512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38580.exe
        5⤵
        
        PID:2188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52321.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32974.exe
        5⤵
        
        PID:9468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8691.exe
        5⤵
        
        PID:15476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7417.exe
      4⤵
      PID:10384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62104.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52674.exe
      4⤵
      PID:19780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12160.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12160.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51974.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51974.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45534.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51621.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5285.exe
        7⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39502.exe
        8⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50410.exe
        9⤵
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49585.exe
        9⤵
        
        PID:16824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25287.exe
        9⤵
        
        PID:17392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38520.exe
        8⤵
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31153.exe
        8⤵
        
        PID:208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21940.exe
        7⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29606.exe
        8⤵
        
        PID:10624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58085.exe
        8⤵
        
        PID:12764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26545.exe
        8⤵
        
        PID:6372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1431.exe
        7⤵
        
        PID:12060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37349.exe
        7⤵
        
        PID:18236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33171.exe
        6⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8749.exe
        7⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53726.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe
        8⤵
        
        PID:16248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10103.exe
        8⤵
        
        PID:3184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19984.exe
        7⤵
        
        PID:12548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63196.exe
        7⤵
        
        PID:10872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31401.exe
        6⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52684.exe
        6⤵
        
        PID:13300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7680.exe
        6⤵
        
        PID:17776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-116.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38320.exe
        6⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55646.exe
        7⤵
        
        PID:8088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40898.exe
        8⤵
        
        PID:11036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe
        8⤵
        
        PID:15428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54665.exe
        7⤵
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50684.exe
        7⤵
        
        PID:16308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22138.exe
        7⤵
        
        PID:19628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43652.exe
        6⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-644.exe
        7⤵
        
        PID:496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64281.exe
        6⤵
        
        PID:12356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11579.exe
        6⤵
        
        PID:17468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25091.exe
        5⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
        6⤵
        
        PID:6168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8749.exe
        7⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61905.exe
        8⤵
        
        PID:4104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60528.exe
        7⤵
        
        PID:13668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30717.exe
        7⤵
        
        PID:4984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11800.exe
        6⤵
        
        PID:1124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
        6⤵
        
        PID:12300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        6⤵
        
        PID:20052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1407.exe
        5⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51686.exe
        6⤵
        
        PID:20968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49064.exe
        5⤵
        
        PID:9684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48414.exe
        5⤵
        
        PID:16260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
        5⤵
        
        PID:18520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33836.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44678.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27522.exe
        6⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58954.exe
        7⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55838.exe
        8⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65402.exe
        9⤵
        
        PID:11136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe
        9⤵
        
        PID:16044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38520.exe
        8⤵
        
        PID:10404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1675.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37980.exe
        7⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52248.exe
        7⤵
        
        PID:12836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44602.exe
        7⤵
        
        PID:19524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37884.exe
        6⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24038.exe
        7⤵
        
        PID:12984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2538.exe
        7⤵
        
        PID:19640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26516.exe
        6⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33249.exe
        6⤵
        
        PID:13208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40910.exe
        6⤵
        
        PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52581.exe
        5⤵
        
        PID:1916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36370.exe
        6⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56030.exe
        7⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55890.exe
        8⤵
        
        PID:9584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43772.exe
        8⤵
        
        PID:15284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2699.exe
        8⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4696.exe
        7⤵
        
        PID:10948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12775.exe
        7⤵
        
        PID:15364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60867.exe
        7⤵
        
        PID:18940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51540.exe
        6⤵
        
        PID:9432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57816.exe
        7⤵
        
        PID:19708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61453.exe
        6⤵
        
        PID:14412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27697.exe
        6⤵
        
        PID:19160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2035.exe
        5⤵
        
        PID:7064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43342.exe
        6⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36654.exe
        7⤵
        
        PID:10892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55048.exe
        6⤵
        
        PID:12296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37177.exe
        5⤵
        
        PID:8776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11947.exe
        5⤵
        
        PID:14272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62475.exe
        5⤵
        
        PID:19600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50800.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11377.exe
        5⤵
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30366.exe
        6⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27442.exe
        7⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-633.exe
        8⤵
        
        PID:11504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65153.exe
        8⤵
        
        PID:15892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14187.exe
        8⤵
        
        PID:2072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31660.exe
        7⤵
        
        PID:12128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40054.exe
        7⤵
        
        PID:21384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2340.exe
        6⤵
        
        PID:9904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54708.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34296.exe
        6⤵
        
        PID:3744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19436.exe
        5⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37722.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        7⤵
        
        PID:17376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49435.exe
        7⤵
        
        PID:20336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60913.exe
        6⤵
        
        PID:13076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39369.exe
        6⤵
        
        PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33895.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        6⤵
        
        PID:9236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4924.exe
        5⤵
        
        PID:15232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26666.exe
        5⤵
        
        PID:4556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39317.exe
      4⤵
      PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59914.exe
        5⤵
        
        PID:6000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43342.exe
        6⤵
        
        PID:8784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20560.exe
        6⤵
        
        PID:12964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30629.exe
        6⤵
        
        PID:3596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50249.exe
        5⤵
        
        PID:9244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37806.exe
        6⤵
        
        PID:12708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43336.exe
        5⤵
        
        PID:14212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10104.exe
        5⤵
        
        PID:17616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2359.exe
      4⤵
      PID:6792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58334.exe
        5⤵
        
        PID:8680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61593.exe
        5⤵
        
        PID:12928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14379.exe
        5⤵
        
        PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39256.exe
      4⤵
      PID:9168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12477.exe
      4⤵
      PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12701.exe
      4⤵
      PID:20124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54012.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41450.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56930.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19162.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63998.exe
        7⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29362.exe
        8⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        8⤵
        
        PID:12400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26439.exe
        8⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
        7⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49201.exe
        7⤵
        
        PID:14236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61138.exe
        7⤵
        
        PID:19880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61045.exe
        6⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27774.exe
        7⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37856.exe
        7⤵
        
        PID:13176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56180.exe
        7⤵
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54508.exe
        6⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20612.exe
        6⤵
        
        PID:12728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3188.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63998.exe
        6⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8749.exe
        7⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43638.exe
        8⤵
        
        PID:10052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2443.exe
        8⤵
        
        PID:16404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14816.exe
        8⤵
        
        PID:376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9740.exe
        7⤵
        
        PID:10796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9843.exe
        7⤵
        
        PID:15952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8568.exe
        7⤵
        
        PID:17732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15551.exe
        6⤵
        
        PID:9932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49201.exe
        6⤵
        
        PID:13172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29855.exe
        5⤵
        
        PID:6664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4717.exe
        6⤵
        
        PID:11556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31483.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:20548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32382.exe
        5⤵
        
        PID:7432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24583.exe
        5⤵
        
        PID:13832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31582.exe
        5⤵
        
        PID:19008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61569.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14885.exe
        5⤵
        
        PID:5032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6437.exe
        6⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29362.exe
        7⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57810.exe
        8⤵
        
        PID:11840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe
        8⤵
        
        PID:15648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10103.exe
        8⤵
        
        PID:4784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24068.exe
        7⤵
        
        PID:12560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22355.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56917.exe
        6⤵
        
        PID:1212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22811.exe
        6⤵
        
        PID:13284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        6⤵
        
        PID:20000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33416.exe
        5⤵
        
        PID:6996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28454.exe
        6⤵
        
        PID:10432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53477.exe
        6⤵
        
        PID:15936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12812.exe
        5⤵
        
        PID:10248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14053.exe
        6⤵
        
        PID:15204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37182.exe
        6⤵
        
        PID:18952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47884.exe
        5⤵
        
        PID:16332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17768.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25091.exe
      4⤵
      PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11865.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32412.exe
        6⤵
        
        PID:7720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63844.exe
        6⤵
        
        PID:13236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32305.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20160.exe
        5⤵
        
        PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8779.exe
        5⤵
        
        PID:14132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:20080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32213.exe
      4⤵
      PID:6220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61562.exe
        5⤵
        
        PID:9564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41852.exe
        5⤵
        
        PID:14404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6887.exe
      4⤵
      PID:10356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61242.exe
      4⤵
      PID:16672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23251.exe
      4⤵
      PID:1500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49353.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49353.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61014.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61014.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60386.exe
        5⤵
        
        PID:1804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38918.exe
        6⤵
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35034.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4717.exe
        8⤵
        
        PID:11496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        8⤵
        
        PID:19940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54665.exe
        7⤵
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13735.exe
        7⤵
        
        PID:16288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22430.exe
        7⤵
        
        PID:6288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63741.exe
        6⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40898.exe
        7⤵
        
        PID:11048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe
        7⤵
        
        PID:16036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41380.exe
        7⤵
        
        PID:2264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32951.exe
        6⤵
        
        PID:11352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35865.exe
        6⤵
        
        PID:18976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60469.exe
        5⤵
        
        PID:2004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
        6⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        6⤵
        
        PID:12384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17311.exe
        6⤵
        
        PID:2668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25727.exe
        5⤵
        
        PID:7352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
        5⤵
        
        PID:13220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7879.exe
        5⤵
        
        PID:17680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40328.exe
      4⤵
      PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5669.exe
        5⤵
        
        PID:5616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
        6⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16788.exe
        7⤵
        
        PID:17132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        6⤵
        
        PID:12408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9719.exe
        6⤵
        
        PID:17056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
        5⤵
        
        PID:9744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49201.exe
        5⤵
        
        PID:14308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5523.exe
        5⤵
        
        PID:19436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe
      4⤵
      PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14229.exe
        5⤵
        
        PID:11584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9143.exe
        5⤵
        
        PID:14916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26060.exe
      4⤵
      PID:12256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29338.exe
      4⤵
      PID:17052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27117.exe
      4⤵
      PID:18996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11051.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11051.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23246.exe
      4⤵
      PID:2876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11865.exe
        5⤵
        
        PID:6264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8277.exe
        6⤵
        
        PID:9588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41852.exe
        6⤵
        
        PID:14452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30497.exe
        6⤵
        
        PID:19132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
        5⤵
        
        PID:9256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6963.exe
        5⤵
        
        PID:15192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36363.exe
        5⤵
        
        PID:19152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57921.exe
      4⤵
      PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-633.exe
        5⤵
        
        PID:11488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25287.exe
        5⤵
        
        PID:4260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-175.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-175.exe
      4⤵
      PID:10308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38485.exe
      4⤵
      PID:14908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10555.exe
      4⤵
      PID:7296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63125.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63125.exe
    3⤵
    PID:3496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18690.exe
      4⤵
      PID:5796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11105.exe
        5⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63046.exe
        6⤵
        
        PID:12100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63196.exe
        6⤵
        
        PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31660.exe
        5⤵
        
        PID:12088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21012.exe
        5⤵
        
        PID:17492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47789.exe
      4⤵
      PID:9040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15027.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15027.exe
      4⤵
      PID:13120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
      4⤵
      PID:19068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49350.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49350.exe
    3⤵
    PID:6844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51510.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51510.exe
      4⤵
      PID:8872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17820.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17820.exe
      4⤵
      PID:13032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10103.exe
      4⤵
      PID:1412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7511.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7511.exe
    3⤵
    PID:8604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38168.exe
      4⤵
      PID:17644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51148.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51148.exe
    3⤵
    PID:14128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48706.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48706.exe
    3⤵
    PID:19976
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10048.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10048.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7521.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54714.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54278.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47994.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47174.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57610.exe
        8⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15565.exe
        9⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37058.exe
        10⤵
        
        PID:9536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8691.exe
        10⤵
        
        PID:15444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
        10⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22620.exe
        9⤵
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27383.exe
        9⤵
        
        PID:14288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26208.exe
        8⤵
        
        PID:6412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50410.exe
        9⤵
        
        PID:11092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17311.exe
        9⤵
        
        PID:15284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21747.exe
        8⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11188.exe
        8⤵
        
        PID:4324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17132.exe
        7⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19842.exe
        8⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40898.exe
        9⤵
        
        PID:11144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe
        9⤵
        
        PID:15404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35180.exe
        9⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43232.exe
        8⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54505.exe
        9⤵
        
        PID:17664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27383.exe
        8⤵
        
        PID:14316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39944.exe
        7⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21106.exe
        8⤵
        
        PID:9264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8691.exe
        8⤵
        
        PID:15492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59497.exe
        8⤵
        
        PID:956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43373.exe
        7⤵
        
        PID:9636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29819.exe
        7⤵
        
        PID:14980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44602.exe
        7⤵
        
        PID:19688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39560.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5285.exe
        7⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5233.exe
        8⤵
        
        PID:6552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5293.exe
        9⤵
        
        PID:11632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29347.exe
        9⤵
        
        PID:19284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8012.exe
        8⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61282.exe
        9⤵
        
        PID:16812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60945.exe
        9⤵
        
        PID:1852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20367.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57161.exe
        7⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28454.exe
        8⤵
        
        PID:9948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49393.exe
        8⤵
        
        PID:15884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe
        8⤵
        
        PID:20088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3631.exe
        7⤵
        
        PID:12052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11387.exe
        7⤵
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41341.exe
        6⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5677.exe
        7⤵
        
        PID:12136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10103.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35091.exe
        6⤵
        
        PID:10736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22220.exe
        6⤵
        
        PID:3456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61668.exe
        6⤵
        
        PID:19492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40380.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18394.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54294.exe
        7⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57366.exe
        8⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37058.exe
        9⤵
        
        PID:9456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1012.exe
        9⤵
        
        PID:13332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1437.exe
        9⤵
        
        PID:20840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        8⤵
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57508.exe
        8⤵
        
        PID:15276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4266.exe
        8⤵
        
        PID:19804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5980.exe
        7⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54665.exe
        8⤵
        
        PID:10980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
        8⤵
        
        PID:4036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63356.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22725.exe
        7⤵
        
        PID:15316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5305.exe
        7⤵
        
        PID:20036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39621.exe
        6⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15870.exe
        7⤵
        
        PID:13512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1386.exe
        7⤵
        
        PID:19400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42596.exe
        6⤵
        
        PID:12272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15975.exe
        6⤵
        
        PID:19184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5247.exe
        5⤵
        
        PID:1128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14413.exe
        6⤵
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28018.exe
        7⤵
        
        PID:2460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65029.exe
        8⤵
        
        PID:4408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55625.exe
        7⤵
        
        PID:11860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50108.exe
        7⤵
        
        PID:16284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20052.exe
        7⤵
        
        PID:2616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10456.exe
        6⤵
        
        PID:8276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29232.exe
        7⤵
        
        PID:1900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6283.exe
        6⤵
        
        PID:12752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39513.exe
        6⤵
        
        PID:12556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39037.exe
        5⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25470.exe
        6⤵
        
        PID:7468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34581.exe
        6⤵
        
        PID:19124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22927.exe
        5⤵
        
        PID:9144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61282.exe
        6⤵
        
        PID:16852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-644.exe
        6⤵
        
        PID:4928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44508.exe
        5⤵
        
        PID:13260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64170.exe
        5⤵
        
        PID:21276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38496.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38496.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38600.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40158.exe
        6⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32094.exe
        7⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61178.exe
        8⤵
        
        PID:12516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27452.exe
        8⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2200.exe
        7⤵
        
        PID:9524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27383.exe
        7⤵
        
        PID:13272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8350.exe
        7⤵
        
        PID:19908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-123.exe
        6⤵
        
        PID:8108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36342.exe
        7⤵
        
        PID:12948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38168.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59700.exe
        6⤵
        
        PID:12372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27332.exe
        6⤵
        
        PID:4352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42196.exe
        5⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11289.exe
        6⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21106.exe
        7⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29600.exe
        7⤵
        
        PID:13096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
        6⤵
        
        PID:9064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27383.exe
        6⤵
        
        PID:15356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49601.exe
        6⤵
        
        PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32213.exe
        5⤵
        
        PID:5860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12901.exe
        6⤵
        
        PID:13576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35018.exe
        6⤵
        
        PID:20160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6887.exe
        5⤵
        
        PID:10348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23996.exe
        6⤵
        
        PID:4368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13284.exe
        5⤵
        
        PID:14948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24169.exe
        5⤵
        
        PID:3564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17167.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34730.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16312.exe
        6⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42818.exe
        7⤵
        
        PID:11988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10103.exe
        7⤵
        
        PID:4488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15935.exe
        6⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6373.exe
        7⤵
        
        PID:17384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31126.exe
        7⤵
        
        PID:19900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33249.exe
        6⤵
        
        PID:13040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1439.exe
        6⤵
        
        PID:18672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39621.exe
        5⤵
        
        PID:6672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38734.exe
        6⤵
        
        PID:11872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33462.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63223.exe
        7⤵
        
        PID:18756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe
        6⤵
        
        PID:16240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52096.exe
        6⤵
        
        PID:17320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42596.exe
        5⤵
        
        PID:8584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36396.exe
        5⤵
        
        PID:18852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58000.exe
      4⤵
      PID:5788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54242.exe
        5⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15521.exe
        6⤵
        
        PID:7464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8691.exe
        6⤵
        
        PID:15484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23772.exe
        5⤵
        
        PID:9716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8308.exe
        5⤵
        
        PID:16416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22487.exe
        5⤵
        
        PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59729.exe
      4⤵
      PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44982.exe
        5⤵
        
        PID:11124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe
        5⤵
        
        PID:15412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9529.exe
      4⤵
      PID:12080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13832.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3872
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43016.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43016.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58362.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38600.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36074.exe
        6⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40070.exe
        7⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37058.exe
        8⤵
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11552.exe
        9⤵
        
        PID:16548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29600.exe
        8⤵
        
        PID:12732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
        8⤵
        
        PID:19856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
        7⤵
        
        PID:10164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27383.exe
        7⤵
        
        PID:2996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32305.exe
        7⤵
        
        PID:4444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5788.exe
        6⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44982.exe
        7⤵
        
        PID:9680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53477.exe
        7⤵
        
        PID:15900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59086.exe
        7⤵
        
        PID:18876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21747.exe
        6⤵
        
        PID:10568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60712.exe
        6⤵
        
        PID:16712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38188.exe
        6⤵
        
        PID:17704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46280.exe
        5⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64574.exe
        6⤵
        
        PID:6700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21106.exe
        7⤵
        
        PID:9324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57006.exe
        8⤵
        
        PID:16944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61521.exe
        8⤵
        
        PID:17296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29600.exe
        7⤵
        
        PID:13328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8323.exe
        7⤵
        
        PID:17608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12781.exe
        6⤵
        
        PID:10156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27383.exe
        6⤵
        
        PID:15336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        6⤵
        
        PID:20028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45617.exe
        5⤵
        
        PID:6776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12745.exe
        6⤵
        
        PID:9312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29600.exe
        6⤵
        
        PID:13352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35756.exe
        6⤵
        
        PID:7292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30431.exe
        5⤵
        
        PID:10256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38172.exe
        5⤵
        
        PID:15236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48648.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:18964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27936.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59042.exe
        5⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59146.exe
        6⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-581.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42818.exe
        8⤵
        
        PID:11980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13227.exe
        8⤵
        
        PID:2916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24068.exe
        7⤵
        
        PID:12568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26439.exe
        7⤵
        
        PID:4108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48557.exe
        6⤵
        
        PID:8548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56828.exe
        6⤵
        
        PID:13504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13202.exe
        6⤵
        
        PID:15096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3100.exe
        5⤵
        
        PID:2104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-581.exe
        6⤵
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        6⤵
        
        PID:12488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10103.exe
        6⤵
        
        PID:4220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25535.exe
        5⤵
        
        PID:5416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61349.exe
        5⤵
        
        PID:11248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61138.exe
        5⤵
        
        PID:19888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54064.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54064.exe
      4⤵
      PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54870.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51754.exe
        6⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28454.exe
        7⤵
        
        PID:10280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53477.exe
        7⤵
        
        PID:15916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exe
        7⤵
        
        PID:18828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38520.exe
        6⤵
        
        PID:8388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52798.exe
        7⤵
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49340.exe
        6⤵
        
        PID:15840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64951.exe
        6⤵
        
        PID:18864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21940.exe
        5⤵
        
        PID:8224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe
        5⤵
        
        PID:12520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48833.exe
        5⤵
        
        PID:3152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57485.exe
      4⤵
      PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28698.exe
        5⤵
        
        PID:9624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8691.exe
        5⤵
        
        PID:15768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23716.exe
      4⤵
      PID:10212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8048.exe
      4⤵
      PID:13620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45550.exe
      4⤵
      PID:18436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15283.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15283.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56162.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56162.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55342.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5477.exe
        6⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61834.exe
        7⤵
        
        PID:6860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47426.exe
        8⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18291.exe
        8⤵
        
        PID:14260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22138.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:19648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21660.exe
        7⤵
        
        PID:8928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11552.exe
        8⤵
        
        PID:752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55588.exe
        7⤵
        
        PID:14340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4266.exe
        7⤵
        
        PID:19504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5788.exe
        6⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49310.exe
        7⤵
        
        PID:9552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-452.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41852.exe
        7⤵
        
        PID:14396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57524.exe
        7⤵
        
        PID:17280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9687.exe
        6⤵
        
        PID:10392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26233.exe
        6⤵
        
        PID:14944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61138.exe
        6⤵
        
        PID:19672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39621.exe
        5⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54494.exe
        6⤵
        
        PID:11348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2703.exe
        6⤵
        
        PID:17624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42596.exe
        5⤵
        
        PID:11360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12272.exe
        5⤵
        
        PID:17064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14003.exe
        5⤵
        
        PID:19736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61133.exe
      4⤵
      PID:1416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13261.exe
        5⤵
        
        PID:6004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48814.exe
        6⤵
        
        PID:6324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61318.exe
        7⤵
        
        PID:11060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe
        7⤵
        
        PID:15144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55002.exe
        7⤵
        
        PID:20396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61489.exe
        6⤵
        
        PID:10376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49648.exe
        7⤵
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20367.exe
        6⤵
        
        PID:12648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13970.exe
        6⤵
        
        PID:20008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65329.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56902.exe
        6⤵
        
        PID:12844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11799.exe
        5⤵
        
        PID:12072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53041.exe
        5⤵
        
        PID:16600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11387.exe
        5⤵
        
        PID:3060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12559.exe
      4⤵
      PID:5948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16534.exe
        5⤵
        
        PID:7448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51230.exe
        6⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58765.exe
        6⤵
        
        PID:15180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16273.exe
        6⤵
        
        PID:19752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41836.exe
        5⤵
        
        PID:10744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41556.exe
        5⤵
        
        PID:15572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63581.exe
        5⤵
        
        PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59221.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59221.exe
      4⤵
      PID:9012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4059.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4059.exe
      4⤵
      PID:13080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35666.exe
      4⤵
      PID:18820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31201.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18394.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33874.exe
        5⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24502.exe
        6⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4717.exe
        7⤵
        
        PID:11424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28396.exe
        7⤵
        
        PID:15536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14187.exe
        7⤵
        
        PID:500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48277.exe
        6⤵
        
        PID:10064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8308.exe
        6⤵
        
        PID:16424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11387.exe
        6⤵
        
        PID:17248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1896.exe
        5⤵
        
        PID:7764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38734.exe
        6⤵
        
        PID:11820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe
        6⤵
        
        PID:444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4266.exe
        6⤵
        
        PID:20100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63356.exe
        5⤵
        
        PID:11096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18640.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60370.exe
        5⤵
        
        PID:6040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10971.exe
      4⤵
      PID:7060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32647.exe
        5⤵
        
        PID:10232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13648.exe
        5⤵
        
        PID:12556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42596.exe
      4⤵
      PID:12284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12109.exe
      4⤵
      PID:1276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2447.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2447.exe
    3⤵
    PID:2852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59146.exe
      4⤵
      PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7524.exe
        5⤵
        
        PID:8596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42604.exe
        5⤵
        
        PID:12860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52641.exe
      4⤵
      PID:8564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8779.exe
      4⤵
      PID:14140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47053.exe
      4⤵
      PID:18444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47852.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47852.exe
    3⤵
    PID:6224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37530.exe
      4⤵
      PID:6484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22398.exe
        5⤵
        
        PID:11668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3700.exe
        5⤵
        
        PID:16460
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 16460 -s 212
        6⤵
        Program crash
        
        PID:16588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25287.exe
        5⤵
        
        PID:1688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60913.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60913.exe
      4⤵
      PID:12596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61138.exe
      4⤵
      PID:19680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31434.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31434.exe
    3⤵
    PID:8456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25916.exe
      4⤵
      PID:18216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-355.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-355.exe
    3⤵
    PID:13404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14382.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14382.exe
    3⤵
    PID:19564
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9559.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9559.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43806.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43806.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11600.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26562.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1009.exe
        6⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27420.exe
        7⤵
        
        PID:8072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2863.exe
        7⤵
        
        PID:9124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56549.exe
        7⤵
        
        PID:16268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4537.exe
        7⤵
        
        PID:18772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7192.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7192.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8609.exe
        7⤵
        
        PID:11692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36372.exe
        7⤵
        
        PID:16112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13227.exe
        7⤵
        
        PID:1944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52256.exe
        6⤵
        
        PID:10264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55205.exe
        6⤵
        
        PID:15848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61138.exe
        6⤵
        
        PID:19696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36732.exe
        5⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57862.exe
        6⤵
        
        PID:9276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29600.exe
        6⤵
        
        PID:12820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:19796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20019.exe
        5⤵
        
        PID:9620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33249.exe
        5⤵
        
        PID:12604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23639.exe
        5⤵
        
        PID:1576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21583.exe
      4⤵
      PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42618.exe
        5⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23358.exe
        6⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44982.exe
        7⤵
        
        PID:11176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe
        7⤵
        
        PID:15420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31660.exe
        6⤵
        
        PID:12172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27523.exe
        6⤵
        
        PID:17040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22138.exe
        6⤵
        
        PID:20112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39620.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6859.exe
        5⤵
        
        PID:13084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18616.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37722.exe
        5⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44982.exe
        6⤵
        
        PID:11116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64577.exe
        6⤵
        
        PID:16064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35760.exe
        6⤵
        
        PID:7632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19216.exe
        5⤵
        
        PID:10616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40054.exe
        5⤵
        
        PID:6888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27011.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27011.exe
      4⤵
      PID:9188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23250.exe
        5⤵
        
        PID:1248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44508.exe
      4⤵
      PID:13252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37382.exe
      4⤵
      PID:888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41672.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41672.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47065.exe
      4⤵
      PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20418.exe
        5⤵
        
        PID:3584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-109.exe
        6⤵
        
        PID:9600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37400.exe
        7⤵
        
        PID:3424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8691.exe
        6⤵
        
        PID:15468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16075.exe
        5⤵
        
        PID:11924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53041.exe
        5⤵
        
        PID:16720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7303.exe
        5⤵
        
        PID:17476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37072.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37072.exe
      4⤵
      PID:8056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28454.exe
        5⤵
        
        PID:10288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52149.exe
        6⤵
        
        PID:5500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53477.exe
        5⤵
        
        PID:15908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8728.exe
      4⤵
      PID:10252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47884.exe
      4⤵
      PID:16324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48233.exe
      4⤵
      PID:19036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59929.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59929.exe
    3⤵
    PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56982.exe
      4⤵
      PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37722.exe
        5⤵
        
        PID:7788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40404.exe
        5⤵
        
        PID:12616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14187.exe
        5⤵
        
        PID:4844
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 716
      4⤵
      Program crash
      PID:7356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32867.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32867.exe
    3⤵
    PID:6896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8469.exe
      4⤵
      PID:9480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61178.exe
        5⤵
        
        PID:12608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45351.exe
        5⤵
        
        PID:18912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29600.exe
      4⤵
      PID:12628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63938.exe
      4⤵
      PID:19812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50845.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50845.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55238.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55238.exe
    3⤵
    PID:15248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43453.exe
    3⤵
    PID:18796
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51709.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51709.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4693.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4693.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57122.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46790.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30366.exe
        6⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62794.exe
        7⤵
        
        PID:7744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37058.exe
        8⤵
        
        PID:9528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41852.exe
        8⤵
        
        PID:14380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53440.exe
        8⤵
        
        PID:17724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11328.exe
        7⤵
        
        PID:10100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20367.exe
        7⤵
        
        PID:14928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56783.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9688.exe
        6⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54494.exe
        7⤵
        
        PID:11596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13227.exe
        7⤵
        
        PID:2600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1431.exe
        6⤵
        
        PID:9896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31153.exe
        6⤵
        
        PID:2008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37884.exe
        5⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45994.exe
        6⤵
        
        PID:10168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29600.exe
        6⤵
        
        PID:12956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37104.exe
        6⤵
        
        PID:19448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33617.exe
        5⤵
        
        PID:9448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7043.exe
        5⤵
        
        PID:15968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40328.exe
      4⤵
      PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27242.exe
        5⤵
        
        PID:5852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48984.exe
        7⤵
        
        PID:21460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
        6⤵
        
        PID:12480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25287.exe
        6⤵
        
        PID:604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
        5⤵
        
        PID:9704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49201.exe
        5⤵
        
        PID:12464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48118.exe
        5⤵
        
        PID:19088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6119.exe
      4⤵
      PID:3680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-633.exe
        5⤵
        
        PID:11416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48838.exe
        6⤵
        
        PID:16960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16595.exe
        6⤵
        
        PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61261.exe
        5⤵
        
        PID:16296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8105.exe
        5⤵
        
        PID:20064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4147.exe
      4⤵
      PID:11008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31348.exe
      4⤵
      PID:16300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5835.exe
      4⤵
      PID:19956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49509.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49509.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46790.exe
      4⤵
      Executes dropped EXE
      PID:1028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14413.exe
        5⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55838.exe
        6⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-633.exe
        7⤵
        
        PID:11408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61261.exe
        7⤵
        
        PID:16084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17311.exe
        7⤵
        
        PID:1100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38520.exe
        6⤵
        
        PID:10428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63128.exe
        6⤵
        
        PID:15868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4266.exe
        6⤵
        
        PID:19844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21940.exe
        5⤵
        
        PID:8232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2201.exe
        6⤵
        
        PID:17564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29635.exe
        5⤵
        
        PID:12528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8568.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3100.exe
      4⤵
      PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10913.exe
        5⤵
        
        PID:7424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4717.exe
        6⤵
        
        PID:11480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61905.exe
        7⤵
        
        PID:4848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26439.exe
        6⤵
        
        PID:1148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7819.exe
        5⤵
        
        PID:13344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45517.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:18224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61524.exe
      4⤵
      PID:9028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20892.exe
      4⤵
      PID:13112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57272.exe
      4⤵
      PID:5304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54064.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54064.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18690.exe
      4⤵
      PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25470.exe
        5⤵
        
        PID:6984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29819.exe
        5⤵
        
        PID:14820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
      4⤵
      PID:9852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50421.exe
        5⤵
        
        PID:17944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49201.exe
      4⤵
      PID:14300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11792.exe
    3⤵
    PID:5840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42434.exe
      4⤵
      PID:12216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25287.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25287.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6887.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6887.exe
    3⤵
    PID:10412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1032.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1032.exe
    3⤵
    PID:14896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14003.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14003.exe
    3⤵
    PID:19720
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36510.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36510.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60386.exe
      4⤵
      PID:1016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14413.exe
        5⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17486.exe
        6⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5293.exe
        7⤵
        
        PID:11644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49585.exe
        7⤵
        
        PID:16836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14379.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8012.exe
        6⤵
        
        PID:10552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20367.exe
        6⤵
        
        PID:14956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27090.exe
        6⤵
        
        PID:19044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22700.exe
        5⤵
        
        PID:7648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24376.exe
        6⤵
        
        PID:19176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43320.exe
        5⤵
        
        PID:10728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47421.exe
        5⤵
        
        PID:15548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3100.exe
      4⤵
      PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25470.exe
        5⤵
        
        PID:8116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8833.exe
        6⤵
        
        PID:17696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53233.exe
        5⤵
        
        PID:10620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10103.exe
        5⤵
        
        PID:2492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25693.exe
      4⤵
      PID:9720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40536.exe
      4⤵
      PID:2176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54307.exe
      4⤵
      PID:20020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32160.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32160.exe
    3⤵
    PID:4680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58954.exe
      4⤵
      PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50721.exe
        5⤵
        
        PID:8700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9791.exe
        5⤵
        
        PID:12920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32305.exe
        5⤵
        
        PID:1400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51540.exe
      4⤵
      PID:9424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26882.exe
        5⤵
        
        PID:15796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26850.exe
        5⤵
        
        PID:20204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20612.exe
      4⤵
      PID:13880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22487.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22487.exe
      4⤵
      PID:15924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21495.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21495.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:6780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10477.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10477.exe
      4⤵
      PID:9080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17436.exe
      4⤵
      PID:13156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30523.exe
      4⤵
      PID:10888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57597.exe
    3⤵
    PID:8672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52788.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52788.exe
    3⤵
    PID:14364
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44602.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44602.exe
    3⤵
    PID:19788
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31464.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31464.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39582.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39582.exe
    3⤵
    PID:452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11865.exe
      4⤵
      PID:6256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33742.exe
        5⤵
        
        PID:10176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65050.exe
        6⤵
        
        PID:17144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8691.exe
        5⤵
        
        PID:15452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14836.exe
      4⤵
      PID:8780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6963.exe
      4⤵
      PID:15324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33416.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33416.exe
    3⤵
    PID:6988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25382.exe
      4⤵
      PID:9176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41852.exe
      4⤵
      PID:12456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20767.exe
      4⤵
      PID:5492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62012.exe
    3⤵
    PID:10040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63373.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63373.exe
    3⤵
    PID:15304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5305.exe
    3⤵
    PID:19924
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14653.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14653.exe
  2⤵
  PID:4720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2353.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2353.exe
    3⤵
    PID:5524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33638.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3617.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7032.exe
        5⤵
        
        PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44681.exe
      4⤵
      PID:12424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10103.exe
      4⤵
      PID:3484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19827.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19827.exe
    3⤵
    PID:9736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61453.exe
    3⤵
    PID:14420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46927.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46927.exe
    3⤵
    PID:7344
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23543.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23543.exe
  2⤵
  PID:6900
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48386.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48386.exe
    3⤵
    PID:8544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31490.exe
      4⤵
      PID:12780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30000.exe
      4⤵
      PID:17504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45205.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45205.exe
    3⤵
    PID:12700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36995.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36995.exe
    3⤵
    PID:18780
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62918.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62918.exe
  2⤵
  PID:7412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44858.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44858.exe
    3⤵
    PID:16644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31728.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31728.exe
    3⤵
    PID:504
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2448.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2448.exe
  2⤵
  PID:15348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35797.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35797.exe
  2⤵
  PID:17716

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 428 -p 4212 -ip 4212
1⤵
PID:8668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 16424 -ip 16424
1⤵
PID:16648

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 444 -ip 444
1⤵
PID:16696

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:15652

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:17288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10048.exe

Filesize
468KB

MD5
a529efbf27a79dcfbea1a837e28d7f37

SHA1
766d974ffa51e9906f40504f76d0bfe2ea4a8af5

SHA256
b1bdfe0c806e5a34cc2c7aed205552c6eedde76e7f1127a2dccda73ae65fa76a

SHA512
1aecd6aaac46ee14c2939967081b072ff7ec33739d73d1d1585fd1b835feca48741798fbfac716797ea9472af245d42d90b2a8bfa46ceb629519e03d4542e40b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12160.exe

Filesize
468KB

MD5
89473ec3c9c8ab47f8a948a7cbe911e5

SHA1
eadd88e1e9666b097fc06846d693349aeed3ec4b

SHA256
2f6bc67a1cf4c76eae7307bb8d6461d2e74a38c4b46ef519fb80aa96b9e397fe

SHA512
2eb8bddba52f58f7662c547a0eefad92a10c511a4d76763b840c30a80d1bbff5d43e12b68c47b370acf8892486ac202e8870dca2afc6a73f6df3be0a8d1f9e25

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15282.exe

Filesize
468KB

MD5
bfdbc87f23b9fc5f008137519f51fae2

SHA1
f36b7748f8f0141a9f446242d08a35643077a2b9

SHA256
db16f299f6bec3b4edfde34f03c093a2e8374a01349dcb371f9ee1521973b672

SHA512
f84068689c2f206df716379975208cf1b6c0382dbf264113ce132bbbdd3bcfc6f14913a25af35f1e5c355a4d5319cc697e74d5ae9ae944a830bb1894c8c42ac2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15283.exe

Filesize
468KB

MD5
3752996e0d5b90fa535448d7faa26183

SHA1
a7b0bc87c109cedd1fabaea3827822c3c4bf8c1c

SHA256
d4070158e8f012279be866db23bcafa221c6c02c2debc9f2871f780dcb3260aa

SHA512
6ecb5d22ff830e88cd8eb1948204bb4a19cfd33b26e472bc1f71504abe5de87b783a61d52481ddf9ea679958a5eb7f636789d7b89c96ac8493d2b34f418843ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21030.exe

Filesize
468KB

MD5
96dc72e287a390c2e002b0b913436513

SHA1
50b09d90dd475741d29c20fe69a2a77993c5a1a8

SHA256
eb92b328c4fb0b84191f9be90c5ea34e5ca60744292ad9d6cacd9c8f0680604a

SHA512
5fd021abd476ae049f07b3b12ee1c27ad3bed3dfcf2a6d919d2a9999f9ca729b1aa8d4429595924f9e98e7cd5dafc4635f7ce3ee13f8b4b63be5710e50f67e4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27942.exe

Filesize
468KB

MD5
aea78549c6f5f17e57e711a4fe7f77ba

SHA1
77cc4e8cf167c400169a2a4328a3577d53a8db0b

SHA256
34ee3ec76f203c017cc469ea708ccc4d18e2389475e6038b3d3de429384ffae7

SHA512
967736f895a4e9068c646ba0e9c355c6524815a02eae8107f25e61d90ce61e713643833404ef9bf3bcd89db86649e3879006dcdbe708277e0658f2de6937d5cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29914.exe

Filesize
468KB

MD5
f0ea0f1101e8fecd54f47a52f72c06a0

SHA1
2a16e3dd13e2afe27fc4343864288c4c664d0d67

SHA256
b8619a161d0e8b20ac3caf3e5e4c69647c35f885ade3e1280584edfceeef1eab

SHA512
0a7530090aeb00e997936ec9487357f77d4c0cad06fc7fc30e424b23ecc430313cd2b683e979a92fa47ace9861d6bcba0ec91e31683cead565e802de59756421

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33836.exe

Filesize
468KB

MD5
5a3537fc3eed94102c2dc3c1d7449863

SHA1
b6d9d250daae8f6caa30a00fa15e17b5df4f4fcb

SHA256
0cac38f22a6879146b92bf710aa89dc1769bf210eed3043a363acaeb39662e53

SHA512
09e35cc1ad4abf6a62114a2d1fdcd1ffef55f9af6f36f5fcaa942806b809b1b34fcc05eb5fc31357df2357e2d12056658527556b3da0d485a7229bf74716273c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34412.exe

Filesize
468KB

MD5
33c963783d5dc81205b16a080e808481

SHA1
0ff5698579c8c7967f2ebca72208020c49c1b7e7

SHA256
b192a17f767cdf6fe1be04d8e773aa8c023e866db88df804b32052aef0806a41

SHA512
80ddfaf731c81bd34903b825e7710a2906469992e343e44b02c0e6373fcd448a06c4cb174d5f157e2723fee49a2e4b60273f27fd0d6e6d199a862f33a8f7b113

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35320.exe

Filesize
468KB

MD5
aa8b490afcc4fef6415a059910e70504

SHA1
df7cf3816940cfe7bbf1204d019561d791c782f5

SHA256
d94a6cab9849722335848481fd43e0780abde775f879eb5744726b76fdeade77

SHA512
0d9938eff17d62cb2069eb39e5872e9db89ea42473063cc6ee1035d45ccb29f1f38e40c1f6b3bc3d10f28a14401c61b7a0c66b7944fb3562cbda9c9b1f004233

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38496.exe

Filesize
468KB

MD5
7fa9344eff7c7eae0e118826fe3d1bc5

SHA1
49d8196f9ae40ff961cc7cdd310b9e3a74db1dd6

SHA256
b937d48e6b77deac4c6ca73005c7bb0eaede602862fcb83314fad6a892167993

SHA512
0e80cda7134eed21ee842495c7a7b9b008383c69ec39ff634b8da4680e8448148664572b57a5964cd3e4579a37a8d6961094e4191fdfe1c20b9498ad190ecc0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3931.exe

Filesize
468KB

MD5
52ed623d8c1e1937fc4a4cf2f11d9782

SHA1
b4e2578542c1731967f44718565f78846c61ed24

SHA256
388c0846fa1302f67fe443b635f19629c931e20c8befe3bb3374776bcdc6cd82

SHA512
b25ef380f5d623efa23cf50f824f706e72e8571131f81cb894b4deff35a57952a4dc34dd20c93533471101cb8ae04f6d865a70085b36a191382a16b8cc2b20d5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40276.exe

Filesize
468KB

MD5
52c9dc6785ab7d9484e1cf857a52d923

SHA1
4bf424d53691d549a38a8373a9d26501787c1208

SHA256
eec71e831989addec0c1c0568096eab02290447369221b2a9c9c6051c08a246b

SHA512
83f330b6391be33fdb337e14db4fe4ef20581c50b3c23aee97c465c8031c04e9426f0bb7ffc64e075aaac6b0364324d6b3747d50e897fd8e468da11e0735d311

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41450.exe

Filesize
468KB

MD5
44e031b75120bbc5c68e97fbf86bc34e

SHA1
e2112084c91c23468f2f341579dc5e658eab8fc1

SHA256
bf6e0b6a283fe27ce9cc936f99f80f5db618e28e86636925edb705c34da31971

SHA512
64cb6adf99164073587f3b45fadb3b781ff72314a091aec77866bdbcfee0ac5a6f372bd9c6e2787bc553d1352d82dfb9d87547855db3a4b0d4e359a5c696f73b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41864.exe

Filesize
468KB

MD5
fdd832dd718ec82d0dd8e0f48d7b0901

SHA1
f92bc22bf73b40f91bcc2d59ad88a5f35515156a

SHA256
99f19ba2b47868745464c8143208ef107a5004f47c82207c8cb7d40ecc8aba87

SHA512
38b693953e19063f6761d52d14c0ae913ac85b12b2507b5725b93b33ea50c265004b4869eaf0bc4230aec129d5f761bdc2c29a67fc4d60771246724c40509e5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43016.exe

Filesize
468KB

MD5
d94175da1d2ed04df3df03aa962c6367

SHA1
7e20b53d6a4479a28e6dac9089a36e3a16dc8701

SHA256
99d0e44a7464432aa7b19bc81f380721054114274faa4dc23dfdb248ccb90a00

SHA512
f84c0ae086b4f19330434d998469c161a646f2c7584e582be3dfac13bfd4e9082be2931e29484b5f7e7f8c6d056611cdfbc801ed6081970deb300829b09ad3f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43806.exe

Filesize
468KB

MD5
9f46b46a4f687c45bdb540843359e0d7

SHA1
c2f6bbc3fe00805aaaf1da60912cce6d7a57c3b2

SHA256
6813a2dbad517b6baf936c4b6df905b07f0b216deeeaf04a2423c124b5ca0f44

SHA512
ad82337fc32384dd010e3e3b8f6b2308a41753f25682a6247ee8a50b804f7cb6ccbcaa1758fb9875b5def3e8278416fa069c7534bd28b4dd29039994ff59a307

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43910.exe

Filesize
468KB

MD5
726300188c26772b1e7926c7e53097d9

SHA1
c7f83088459e6f8fd722da55448e7fe5098e6b2a

SHA256
4cf95cace5fe071a9e3bc77d1948d83d475d8edbbe79d602e2da9f0c974b356d

SHA512
dfb826470dd44eee921d93383540a73bf37818b4c8f9f49e82339ec71054f02f44aebcfaa995595cee5fec53fe57a5bc86eba29b56d89ac85d5d06c27f94e642

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45534.exe

Filesize
468KB

MD5
7d7434169b9e84babf4e6db843773def

SHA1
dd2b857311d2f5c6f48dde6143843f7f2e7f3f8f

SHA256
38b683f99e718712e12d1103b07bd6a65e40854d22f821159a34040d2afcb511

SHA512
540dcd136a70b9b0b3dfe9dc599599b3423bb7aa7b35de2a6119ecdf4335d9d6e6c352b14c97fff6574191ab6766fefec74094c8ce7d3a6e716376e799c4fbd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4693.exe

Filesize
468KB

MD5
0a8ba3f14ffcc6faf5a8d4895533a793

SHA1
76815b47d11330c465fcbf205f75df7763c8dc20

SHA256
73324f7b4e60ae38dcba742de6fdfc6157c1de77767053e8a31f0c5df4fa2140

SHA512
062fd6785a5f6ba9b562348ec86694ce47d910d0f1bf9e7bdeb85cea1f54767ae16fd23b7c7057e0a53e0e3b8f0c87c5a323452f094968db670d14d835f2cd60

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47426.exe

Filesize
468KB

MD5
2f8a2e2ed47ed8fb250d64b33289f3d8

SHA1
bec979920c689bdc338601a0c3598e506a0233c1

SHA256
44b016d2375395362dd82c2b96d0d0073cdfde352308b743d7a65a086a3a4471

SHA512
9345108d252cc164b6276761300890fafc884e6447717f82237ff52a4f5a24bc79f90c3ba9f800bf8167e5e6fa967eb029256660a7189e6eeaeb5c7cd9d0dcca

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47994.exe

Filesize
468KB

MD5
8c92e6597324c96d22a8d76d21d580ce

SHA1
47e246c70a6900a226a1d9f0c127c36cc77daed6

SHA256
d65ad94746e814c19e644d9e01d33e02d78b1ce54b923cf004dc645c8a7c0667

SHA512
f79bd3765666b8e78e6eba7d0146e2b4df046b12a84526d21d51faf6fa3a7ed06527a264c4539b68386986b00f3b6efb504244d6dac786eabe3d9d24917fabe1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49353.exe

Filesize
468KB

MD5
5b2deb36f70770bc8bb3071909d406be

SHA1
912b53c0017cac0642fe9b05e4df433566f5eb80

SHA256
271b182569850ad5dcea3ce773aec051dbf05d42223466c17fb4b5774716d7e9

SHA512
f2e6ea35ab59fddd62c1cd7e5416a46c7455143b41b8f51b73a3ab544c46de472c0bd0a0670fa690a41a8896a805f7dadab0ba4858d4b3b912df47cc6a7be615

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51709.exe

Filesize
468KB

MD5
ab1b3878ea9caf953d4f1a20670afcdd

SHA1
e0b4300b2f7ce2bd03fdf63da820ef06ff560451

SHA256
71e97d365e1f5c44ebc538ae85a8b562e337e3e92496ed3f05a2cbee5ed07b32

SHA512
3d229e19576728efd7c9206671caccef2a544feeba184a3ff5ffcea26d134c562277b6cb94279ae66eb24f3699d209a6f802b608402b04c5a7526b5b82212ffe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51974.exe

Filesize
468KB

MD5
bc48ae8026402f86c0d2f29466621d2e

SHA1
9eddeeadfe239da8cc243b00d77253c0399f7b0c

SHA256
3c0828a45a27f255176f315b4fdf3b552f38a7aaae89bb7a99a9b85dfa0d26d1

SHA512
be3f17b7c1e24969c4f34ea4bf38363023ef69991559df1b3a49f077982e640416c33e0ca147fd08817183882030c0f9c5fbe94ae281b4e0c691542ebf9ce991

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54012.exe

Filesize
468KB

MD5
cd60adeaf7d432fc34e107e1b04e088a

SHA1
7a4fc3509babca64e2302658ede182d7eb93b4dd

SHA256
0dfdb676f378f61f4262c5ca7f2b97e8b39701a6d6921606506ce591e58df663

SHA512
467127eb5bea65bdd600fc1850a907d2fe9fddd9f851c3455d904751f2bdba9df5598167f88b087cedb4afcee07b14c117b8b711f46d310a1edc47040f3c9f37

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54278.exe

Filesize
468KB

MD5
8d241cc3dbd8b161c8e3906bc8503dc1

SHA1
9e5e018ac53a1c8c42f1cc14de15295e654936e2

SHA256
62ee54318e213160fc989ba2a4215c7dbf294df087824d74e7e3dc62b245be63

SHA512
fc52f1ff2675700e0701cd3c743d108d345136e01850749c23f210407892a5cccdad5858e93d5b3aeb65b75f1276c70bb6bfd541c96698b79538657037b40f2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54714.exe

Filesize
468KB

MD5
22bcea0913974626ebf1fd9226bb8064

SHA1
b7bebfe8029f896c4684a9b765b5e6ac0b0a2b6a

SHA256
1047b826b11359aef37f5f7aa4d30d87b6322daf25bd57065761522b1840f595

SHA512
2f5a33e6b623caf15fb96bdf37bb8a9177a17caad7e0f3c016517d5c992c200e3133b1b7f2ac4b55fde4a384f72eae34661292678fdae8aaebc0352904498c2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55372.exe

Filesize
468KB

MD5
71fb3b3a384935c58e9cb24a3fbe78d1

SHA1
0807680abaa94ba96c56c544a05ae2e5da77019c

SHA256
e03fb45eeac8341f78ff58eb594b1646ac84ed3eb5252666729fef5791835f6f

SHA512
9784350a63bcfd1054525d8a87e1bcf3bcfd2d0bc5b13dbec0941a9b6f26448440101c56dabf7a56163e491c78da14ebe590bb49bd15c5d1a3688071adb44fbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56162.exe

Filesize
468KB

MD5
c296d08b95849fc8951a70682d126860

SHA1
073f63cf8e7d6612461c3e0569e30c19c9399dd8

SHA256
6e79e917d5c52a454dfbc25ba015578d58be0f12eb2132381b71dbdda56e05e8

SHA512
1488cd37fdaba8d42051392fa26f28b4fc32a020d500e51bc0ff4fda623689d809005aad6a8d7098d6316ae113560ab6646b27c8d48b81ec2c5228009babd3de

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58362.exe

Filesize
468KB

MD5
c64b781182326721f68da67c17191969

SHA1
daf1675ba2d81744fc2bb5581a1ae87aa24d2f8a

SHA256
554a9ad851d1dd9edbe492ef40b3d53cdc0f597b9944e520225ed17367b89ee2

SHA512
2f044402fb8a89dd1ba94df40e2a2b390740d5ce23e116a4014e18ba3cf9635d4ead7b93c679797a567f15214106a17931412c8cfe2a831ea47a012e696eae47

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60474.exe

Filesize
468KB

MD5
e0a0b0ed4e7f71047894472974ac5cd1

SHA1
b56caa7c3b497264314163d97844d8d526d18aba

SHA256
a367a46bcad7fc30c1e68293c889394d8951859482df1df6e71853e64c1eca50

SHA512
43abd0354150a9942b26c684f7416a08d00e04125daafd155c258cec1c747616c6aa620e7eaffec6445ea890ca6f43c1a51c7284be67c61e62e0a7a93dc8a10b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7521.exe

Filesize
468KB

MD5
1d135806668ca7ca0eb1f23ce3fb60b0

SHA1
601f3962409e94ed7670bdb5cd8b6d593bc15e35

SHA256
e5437aee48004b6fa1bbab8f1ecf9e397a5b8896364cf776a4e8a0fa5a392303

SHA512
255016becb1bac08d9526882add515438e49be85d6202e0eb18652bea3badaf5b80b354050ad7a380dc7d4ab6caa283b635914fb7eaaf0807968e6a5a0f1a619

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9559.exe

Filesize
468KB

MD5
3ebc86202a473ee1af678a8349730938

SHA1
547aba500b0e0975cf8443a54db216f7b2214be5

SHA256
29381a4627196d0fb60b205ebc7075bebb519cced971902318f25ec748a3a916

SHA512
2020c5a2b647db8482bfcf08c7454f5a3c39f252c53f20fb235cbe3bc8fea10b0c9c3cbaacd38bac8a4b9c7e225684d3308913b6f4907f74b01352fd090fda9e

Download Submit
memory/9848-6027-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/12656-4401-0x0000000076E60000-0x0000000076EF6000-memory.dmp

Filesize
600KB

Download
memory/14484-6026-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15640-5832-0x00007FFE29FC0000-0x00007FFE2A019000-memory.dmp

Filesize
356KB

Download
memory/20204-3319-0x00000000760D0000-0x000000007618F000-memory.dmp

Filesize
764KB

Download
memory/20224-5971-0x00007FFE2A3C0000-0x00007FFE2A443000-memory.dmp

Filesize
524KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads