4625e716eabfc924219a7bdb5f7678cad84927fe0667e4731e9ec78c9d977d54

Analysis

max time kernel
120s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 18:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e8486a24af141b64b156dc1e264c7d30N.exe
Size

468KB
MD5

e8486a24af141b64b156dc1e264c7d30
SHA1

de2ee39f2cc5dfb6f4087ea930bcebd0048aa44e
SHA256

4625e716eabfc924219a7bdb5f7678cad84927fe0667e4731e9ec78c9d977d54
SHA512

1abae2da656fb47603635cc2c4c07e29279ff1a382b218719f3e1e0c877eee870db959757e72ad9435fa6676a05b26cddf3a6507cddfaef3471502c53bad62c3
SSDEEP

3072:3FfnogKxjhTUpbYZBz3uqf8/EC3jMIclPmfI5VuRxJH+1wENtllp:3FfotpUpaBDuqfLR9exJeqENt

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
1312	Unicorn-39110.exe
244	Unicorn-57942.exe
3192	Unicorn-38076.exe
2240	Unicorn-12065.exe
1164	Unicorn-49569.exe
4648	Unicorn-36762.exe
5036	Unicorn-30631.exe
2188	Unicorn-46850.exe
2396	Unicorn-18816.exe
4140	Unicorn-14177.exe
3596	Unicorn-59029.exe
1420	Unicorn-10093.exe
648	Unicorn-18262.exe
3968	Unicorn-47597.exe
676	Unicorn-53164.exe
2680	Unicorn-8469.exe
3852	Unicorn-42656.exe
4012	Unicorn-42294.exe
652	Unicorn-10176.exe
3144	Unicorn-58054.exe
3692	Unicorn-39672.exe
3868	Unicorn-37826.exe
4264	Unicorn-28895.exe
3836	Unicorn-10197.exe
4776	Unicorn-57352.exe
4480	Unicorn-41910.exe
4932	Unicorn-17960.exe
4280	Unicorn-5921.exe
3648	Unicorn-35256.exe
2236	Unicorn-42870.exe
2532	Unicorn-38521.exe
2884	Unicorn-49237.exe
3296	Unicorn-7649.exe
3056	Unicorn-52766.exe
3684	Unicorn-943.exe
1488	Unicorn-27686.exe
1524	Unicorn-3928.exe
4048	Unicorn-57.exe
4924	Unicorn-34959.exe
4872	Unicorn-4333.exe
552	Unicorn-29584.exe
5060	Unicorn-3757.exe
4728	Unicorn-56777.exe
2084	Unicorn-65402.exe
2316	Unicorn-25116.exe
2308	Unicorn-32730.exe
2868	Unicorn-4644.exe
4356	Unicorn-41858.exe
5056	Unicorn-58941.exe
2156	Unicorn-21630.exe
1804	Unicorn-46113.exe
3664	Unicorn-55610.exe
2304	Unicorn-17162.exe
4512	Unicorn-13077.exe
1592	Unicorn-17160.exe
1920	Unicorn-22206.exe
5028	Unicorn-2340.exe
4828	Unicorn-9953.exe
4588	Unicorn-57108.exe
3932	Unicorn-38734.exe
4308	Unicorn-18868.exe
3816	Unicorn-40388.exe
3476	Unicorn-46518.exe
2364	Unicorn-15324.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
12900	10896	WerFault.exe	536

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12024.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35428.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32711.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25398.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60182.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10753.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42032.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55261.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13617.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24963.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57961.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-92.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39672.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37332.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59045.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9704.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35066.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16108.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64337.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42656.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42294.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52450.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7483.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31152.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36762.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26882.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10243.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5273.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25889.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48926.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18596.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41092.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43414.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48646.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64370.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62752.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39061.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17992.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60234.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49164.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35629.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45716.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44386.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16211.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e8486a24af141b64b156dc1e264c7d30N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45138.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59533.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39610.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20999.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	12012	dwm.exe
Token: SeChangeNotifyPrivilege	12012	dwm.exe
Token: 33	12012	dwm.exe
Token: SeIncBasePriorityPrivilege	12012	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
3132	e8486a24af141b64b156dc1e264c7d30N.exe
1312	Unicorn-39110.exe
244	Unicorn-57942.exe
3192	Unicorn-38076.exe
2240	Unicorn-12065.exe
4648	Unicorn-36762.exe
1164	Unicorn-49569.exe
5036	Unicorn-30631.exe
2188	Unicorn-46850.exe
4140	Unicorn-14177.exe
1420	Unicorn-10093.exe
2396	Unicorn-18816.exe
3596	Unicorn-59029.exe
648	Unicorn-18262.exe
676	Unicorn-53164.exe
3968	Unicorn-47597.exe
2680	Unicorn-8469.exe
3852	Unicorn-42656.exe
4012	Unicorn-42294.exe
652	Unicorn-10176.exe
3144	Unicorn-58054.exe
3692	Unicorn-39672.exe
3836	Unicorn-10197.exe
4776	Unicorn-57352.exe
3868	Unicorn-37826.exe
4480	Unicorn-41910.exe
4264	Unicorn-28895.exe
4932	Unicorn-17960.exe
4280	Unicorn-5921.exe
3648	Unicorn-35256.exe
2236	Unicorn-42870.exe
2532	Unicorn-38521.exe
3296	Unicorn-7649.exe
2884	Unicorn-49237.exe
3056	Unicorn-52766.exe
3684	Unicorn-943.exe
4924	Unicorn-34959.exe
1524	Unicorn-3928.exe
4048	Unicorn-57.exe
1488	Unicorn-27686.exe
4872	Unicorn-4333.exe
552	Unicorn-29584.exe
5060	Unicorn-3757.exe
4356	Unicorn-41858.exe
2868	Unicorn-4644.exe
5056	Unicorn-58941.exe
2316	Unicorn-25116.exe
2084	Unicorn-65402.exe
2308	Unicorn-32730.exe
2156	Unicorn-21630.exe
1804	Unicorn-46113.exe
3664	Unicorn-55610.exe
4512	Unicorn-13077.exe
1592	Unicorn-17160.exe
1920	Unicorn-22206.exe
5028	Unicorn-2340.exe
4308	Unicorn-18868.exe
3816	Unicorn-40388.exe
4728	Unicorn-56777.exe
2304	Unicorn-17162.exe
2364	Unicorn-15324.exe
4588	Unicorn-57108.exe
3932	Unicorn-38734.exe
3476	Unicorn-46518.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3132 wrote to memory of 1312	3132	e8486a24af141b64b156dc1e264c7d30N.exe	90
PID 3132 wrote to memory of 1312	3132	e8486a24af141b64b156dc1e264c7d30N.exe	90
PID 3132 wrote to memory of 1312	3132	e8486a24af141b64b156dc1e264c7d30N.exe	90
PID 1312 wrote to memory of 244	1312	Unicorn-39110.exe	94
PID 1312 wrote to memory of 244	1312	Unicorn-39110.exe	94
PID 1312 wrote to memory of 244	1312	Unicorn-39110.exe	94
PID 3132 wrote to memory of 3192	3132	e8486a24af141b64b156dc1e264c7d30N.exe	93
PID 3132 wrote to memory of 3192	3132	e8486a24af141b64b156dc1e264c7d30N.exe	93
PID 3132 wrote to memory of 3192	3132	e8486a24af141b64b156dc1e264c7d30N.exe	93
PID 244 wrote to memory of 2240	244	Unicorn-57942.exe	96
PID 244 wrote to memory of 2240	244	Unicorn-57942.exe	96
PID 244 wrote to memory of 2240	244	Unicorn-57942.exe	96
PID 1312 wrote to memory of 1164	1312	Unicorn-39110.exe	97
PID 1312 wrote to memory of 1164	1312	Unicorn-39110.exe	97
PID 1312 wrote to memory of 1164	1312	Unicorn-39110.exe	97
PID 3192 wrote to memory of 4648	3192	Unicorn-38076.exe	101
PID 3192 wrote to memory of 4648	3192	Unicorn-38076.exe	101
PID 3192 wrote to memory of 4648	3192	Unicorn-38076.exe	101
PID 3132 wrote to memory of 5036	3132	e8486a24af141b64b156dc1e264c7d30N.exe	100
PID 3132 wrote to memory of 5036	3132	e8486a24af141b64b156dc1e264c7d30N.exe	100
PID 3132 wrote to memory of 5036	3132	e8486a24af141b64b156dc1e264c7d30N.exe	100
PID 2240 wrote to memory of 2188	2240	Unicorn-12065.exe	102
PID 2240 wrote to memory of 2188	2240	Unicorn-12065.exe	102
PID 2240 wrote to memory of 2188	2240	Unicorn-12065.exe	102
PID 244 wrote to memory of 2396	244	Unicorn-57942.exe	103
PID 244 wrote to memory of 2396	244	Unicorn-57942.exe	103
PID 244 wrote to memory of 2396	244	Unicorn-57942.exe	103
PID 4648 wrote to memory of 4140	4648	Unicorn-36762.exe	104
PID 4648 wrote to memory of 4140	4648	Unicorn-36762.exe	104
PID 4648 wrote to memory of 4140	4648	Unicorn-36762.exe	104
PID 1164 wrote to memory of 1420	1164	Unicorn-49569.exe	105
PID 1164 wrote to memory of 1420	1164	Unicorn-49569.exe	105
PID 1164 wrote to memory of 1420	1164	Unicorn-49569.exe	105
PID 5036 wrote to memory of 648	5036	Unicorn-30631.exe	106
PID 5036 wrote to memory of 648	5036	Unicorn-30631.exe	106
PID 5036 wrote to memory of 648	5036	Unicorn-30631.exe	106
PID 3192 wrote to memory of 3968	3192	Unicorn-38076.exe	107
PID 3192 wrote to memory of 3968	3192	Unicorn-38076.exe	107
PID 3192 wrote to memory of 3968	3192	Unicorn-38076.exe	107
PID 3132 wrote to memory of 3596	3132	e8486a24af141b64b156dc1e264c7d30N.exe	109
PID 3132 wrote to memory of 3596	3132	e8486a24af141b64b156dc1e264c7d30N.exe	109
PID 3132 wrote to memory of 3596	3132	e8486a24af141b64b156dc1e264c7d30N.exe	109
PID 1312 wrote to memory of 676	1312	Unicorn-39110.exe	108
PID 1312 wrote to memory of 676	1312	Unicorn-39110.exe	108
PID 1312 wrote to memory of 676	1312	Unicorn-39110.exe	108
PID 2188 wrote to memory of 2680	2188	Unicorn-46850.exe	110
PID 2188 wrote to memory of 2680	2188	Unicorn-46850.exe	110
PID 2188 wrote to memory of 2680	2188	Unicorn-46850.exe	110
PID 2240 wrote to memory of 3852	2240	Unicorn-12065.exe	111
PID 2240 wrote to memory of 3852	2240	Unicorn-12065.exe	111
PID 2240 wrote to memory of 3852	2240	Unicorn-12065.exe	111
PID 4140 wrote to memory of 4012	4140	Unicorn-14177.exe	112
PID 4140 wrote to memory of 4012	4140	Unicorn-14177.exe	112
PID 4140 wrote to memory of 4012	4140	Unicorn-14177.exe	112
PID 4648 wrote to memory of 652	4648	Unicorn-36762.exe	113
PID 4648 wrote to memory of 652	4648	Unicorn-36762.exe	113
PID 4648 wrote to memory of 652	4648	Unicorn-36762.exe	113
PID 2396 wrote to memory of 3144	2396	Unicorn-18816.exe	114
PID 2396 wrote to memory of 3144	2396	Unicorn-18816.exe	114
PID 2396 wrote to memory of 3144	2396	Unicorn-18816.exe	114
PID 244 wrote to memory of 3692	244	Unicorn-57942.exe	115
PID 244 wrote to memory of 3692	244	Unicorn-57942.exe	115
PID 244 wrote to memory of 3692	244	Unicorn-57942.exe	115
PID 3596 wrote to memory of 3868	3596	Unicorn-59029.exe	117

C:\Users\Admin\AppData\Local\Temp\e8486a24af141b64b156dc1e264c7d30N.exe
"C:\Users\Admin\AppData\Local\Temp\e8486a24af141b64b156dc1e264c7d30N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3132
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39110.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39110.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57942.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57942.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12065.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46850.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:2188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8469.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7649.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18854.exe
        8⤵
        
        PID:4744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32502.exe
        9⤵
        
        PID:6196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        9⤵
        
        PID:8372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12815.exe
        9⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37332.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27218.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64148.exe
        8⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35384.exe
        8⤵
        
        PID:14720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56357.exe
        7⤵
        
        PID:5012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49274.exe
        8⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25362.exe
        9⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39588.exe
        9⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28591.exe
        9⤵
        
        PID:14548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61748.exe
        8⤵
        
        PID:7300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30829.exe
        8⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58552.exe
        8⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57124.exe
        7⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8848.exe
        7⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57628.exe
        7⤵
        
        PID:11668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9832.exe
        7⤵
        
        PID:15488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49237.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2517.exe
        7⤵
        
        PID:1608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50234.exe
        8⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19778.exe
        9⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22658.exe
        10⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29942.exe
        11⤵
        
        PID:12776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
        11⤵
        
        PID:16320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45185.exe
        10⤵
        
        PID:9040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45576.exe
        10⤵
        
        PID:10376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40585.exe
        10⤵
        
        PID:12464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6227.exe
        10⤵
        
        PID:6536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55769.exe
        10⤵
        
        PID:10112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7068.exe
        9⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43414.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:12468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8435.exe
        9⤵
        
        PID:10816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13408.exe
        9⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57665.exe
        8⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24530.exe
        9⤵
        
        PID:224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42060.exe
        8⤵
        
        PID:10504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2356.exe
        7⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12469.exe
        8⤵
        
        PID:4276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59392.exe
        7⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-756.exe
        7⤵
        
        PID:11868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46596.exe
        7⤵
        
        PID:15596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20507.exe
        6⤵
        
        PID:1432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43026.exe
        7⤵
        
        PID:5396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61566.exe
        8⤵
        
        PID:13016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe
        7⤵
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63373.exe
        6⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11161.exe
        7⤵
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24879.exe
        6⤵
        
        PID:8148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41092.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42656.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52766.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55610.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12989.exe
        8⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28330.exe
        9⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64498.exe
        10⤵
        
        PID:13304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        9⤵
        
        PID:10496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        9⤵
        
        PID:14576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27348.exe
        8⤵
        
        PID:6904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2637.exe
        9⤵
        
        PID:8548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        9⤵
        
        PID:11524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27679.exe
        8⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55517.exe
        8⤵
        
        PID:9824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62096.exe
        8⤵
        
        PID:12280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11160.exe
        8⤵
        
        PID:5576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34926.exe
        8⤵
        
        PID:12780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38240.exe
        7⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9149.exe
        8⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18642.exe
        9⤵
        
        PID:10072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40984.exe
        9⤵
        
        PID:14792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        8⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46692.exe
        8⤵
        
        PID:12984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15463.exe
        7⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53270.exe
        8⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44386.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48333.exe
        9⤵
        
        PID:13060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9492.exe
        8⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53324.exe
        8⤵
        
        PID:12460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62133.exe
        7⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19854.exe
        8⤵
        
        PID:12036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
        8⤵
        
        PID:16312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57628.exe
        7⤵
        
        PID:11748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15324.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3233.exe
        7⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23530.exe
        8⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5873.exe
        9⤵
        
        PID:12172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
        8⤵
        
        PID:11196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65397.exe
        7⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62170.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32240.exe
        8⤵
        
        PID:6824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35629.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1183.exe
        7⤵
        
        PID:2488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5655.exe
        6⤵
        
        PID:5524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12024.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45080.exe
        6⤵
        
        PID:10408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51337.exe
        6⤵
        
        PID:15012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-943.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46518.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36098.exe
        7⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38102.exe
        8⤵
        
        PID:10008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47757.exe
        8⤵
        
        PID:12436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65397.exe
        7⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3545.exe
        8⤵
        
        PID:9536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18976.exe
        8⤵
        
        PID:13148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9203.exe
        7⤵
        
        PID:11256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4944.exe
        7⤵
        
        PID:14564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36844.exe
        6⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47686.exe
        7⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54822.exe
        8⤵
        
        PID:9532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40984.exe
        8⤵
        
        PID:14620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62045.exe
        7⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28126.exe
        8⤵
        
        PID:12372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62376.exe
        7⤵
        
        PID:564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4160.exe
        7⤵
        
        PID:3268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35339.exe
        7⤵
        
        PID:12940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57149.exe
        7⤵
        
        PID:14884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28185.exe
        7⤵
        
        PID:16752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39776.exe
        6⤵
        
        PID:6320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9381.exe
        7⤵
        
        PID:12200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34417.exe
        6⤵
        
        PID:9172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51064.exe
        6⤵
        
        PID:15028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25833.exe
        5⤵
        
        PID:1128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35522.exe
        6⤵
        
        PID:6012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53114.exe
        7⤵
        
        PID:6236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        7⤵
        
        PID:8920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32874.exe
        8⤵
        
        PID:11884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53864.exe
        7⤵
        
        PID:14900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26040.exe
        6⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17550.exe
        7⤵
        
        PID:12184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60165.exe
        7⤵
        
        PID:15908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61416.exe
        6⤵
        
        PID:8408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7004.exe
        6⤵
        
        PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59840.exe
        5⤵
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42378.exe
        6⤵
        
        PID:10136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40688.exe
        6⤵
        
        PID:15092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52361.exe
        5⤵
        
        PID:7536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11541.exe
        5⤵
        
        PID:12044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49279.exe
        5⤵
        
        PID:9840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18816.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58054.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4333.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22096.exe
        7⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30494.exe
        8⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40378.exe
        9⤵
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53668.exe
        7⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61670.exe
        8⤵
        
        PID:3140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24189.exe
        7⤵
        
        PID:10788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26590.exe
        8⤵
        
        PID:13168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39616.exe
        7⤵
        
        PID:13188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36600.exe
        6⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11121.exe
        7⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1573.exe
        8⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
        8⤵
        
        PID:11112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42532.exe
        7⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65354.exe
        8⤵
        
        PID:12424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60428.exe
        7⤵
        
        PID:11652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39061.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25974.exe
        7⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27806.exe
        8⤵
        
        PID:7596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
        8⤵
        
        PID:11240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31588.exe
        7⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1625.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48958.exe
        9⤵
        
        PID:10736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37150.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:12328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
        10⤵
        
        PID:15552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-92.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-92.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12756.exe
        8⤵
        
        PID:10752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41234.exe
        9⤵
        
        PID:12312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
        9⤵
        
        PID:15576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33567.exe
        8⤵
        
        PID:11356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20372.exe
        8⤵
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34867.exe
        8⤵
        
        PID:15524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31675.exe
        7⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59189.exe
        7⤵
        
        PID:12504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29103.exe
        6⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21580.exe
        6⤵
        
        PID:10744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9357.exe
        6⤵
        
        PID:8004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29584.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55994.exe
        6⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9689.exe
        7⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42032.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7543.exe
        7⤵
        
        PID:9852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25376.exe
        6⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42060.exe
        6⤵
        
        PID:10512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42464.exe
        5⤵
        
        PID:5116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48646.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35910.exe
        7⤵
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35428.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1139.exe
        6⤵
        
        PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25221.exe
        5⤵
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27218.exe
        6⤵
        
        PID:6212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25751.exe
        5⤵
        
        PID:8276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47340.exe
        5⤵
        
        PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39672.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39672.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3757.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2901.exe
        6⤵
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3425.exe
        7⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33338.exe
        8⤵
        
        PID:9160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62362.exe
        9⤵
        
        PID:2516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64337.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:14420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17992.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41892.exe
        8⤵
        
        PID:12564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61748.exe
        7⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35526.exe
        8⤵
        
        PID:13108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24581.exe
        7⤵
        
        PID:60
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64001.exe
        6⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63550.exe
        7⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19860.exe
        7⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24019.exe
        7⤵
        
        PID:14308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57612.exe
        6⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26758.exe
        7⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20674.exe
        8⤵
        
        PID:12120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59345.exe
        8⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        7⤵
        
        PID:11504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8559.exe
        6⤵
        
        PID:9860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50325.exe
        6⤵
        
        PID:13288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11137.exe
        6⤵
        
        PID:15652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28728.exe
        5⤵
        
        PID:332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48454.exe
        6⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53270.exe
        7⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27742.exe
        8⤵
        
        PID:12784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7456.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46693.exe
        7⤵
        
        PID:11692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8363.exe
        7⤵
        
        PID:15716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63145.exe
        6⤵
        
        PID:8208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62614.exe
        7⤵
        
        PID:12552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48944.exe
        6⤵
        
        PID:11796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23439.exe
        5⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22918.exe
        6⤵
        
        PID:10196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21214.exe
        7⤵
        
        PID:14292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40984.exe
        6⤵
        
        PID:14676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43545.exe
        5⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9137.exe
        6⤵
        
        PID:12516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50881.exe
        6⤵
        
        PID:16188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41832.exe
        5⤵
        
        PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56777.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35522.exe
        5⤵
        
        PID:6020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42590.exe
        6⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50302.exe
        7⤵
        
        PID:10880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40362.exe
        8⤵
        
        PID:11840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54285.exe
        7⤵
        
        PID:11952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12831.exe
        7⤵
        
        PID:15404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27260.exe
        6⤵
        
        PID:868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1139.exe
        6⤵
        
        PID:1676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43684.exe
        5⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42578.exe
        6⤵
        
        PID:12616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-881.exe
        7⤵
        
        PID:2744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57233.exe
        7⤵
        
        PID:15792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
        7⤵
        
        PID:16792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10772.exe
        6⤵
        
        PID:6572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17224.exe
        5⤵
        
        PID:9872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27770.exe
        6⤵
        
        PID:10560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19064.exe
        6⤵
        
        PID:11928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6531.exe
        6⤵
        
        PID:13316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27197.exe
        6⤵
        
        PID:12520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51704.exe
        5⤵
        
        PID:10612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9832.exe
        5⤵
        
        PID:14820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11407.exe
      4⤵
      PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7193.exe
        5⤵
        
        PID:7560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6205.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15432.exe
        6⤵
        
        PID:15500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
        5⤵
        
        PID:11136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        5⤵
        
        PID:15104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6512.exe
      4⤵
      PID:7184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14913.exe
        5⤵
        
        PID:13028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45610.exe
      4⤵
      PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5071.exe
      4⤵
      PID:14384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49569.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49569.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10093.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41910.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21630.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4172.exe
        7⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7513.exe
        8⤵
        
        PID:12968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7456.exe
        8⤵
        
        PID:15960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10243.exe
        7⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47458.exe
        8⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39610.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5984.exe
        8⤵
        
        PID:10028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45716.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25889.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7483.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41399.exe
        8⤵
        
        PID:16876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35901.exe
        7⤵
        
        PID:7360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3273.exe
        8⤵
        
        PID:10552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22163.exe
        7⤵
        
        PID:11092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4057.exe
        8⤵
        
        PID:15324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15080.exe
        6⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36564.exe
        6⤵
        
        PID:7092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3576.exe
        6⤵
        
        PID:10712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19574.exe
        7⤵
        
        PID:12828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7456.exe
        7⤵
        
        PID:15940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39616.exe
        6⤵
        
        PID:12768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46113.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25818.exe
        6⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46010.exe
        7⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31862.exe
        8⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        7⤵
        
        PID:10412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52490.exe
        8⤵
        
        PID:15044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44017.exe
        6⤵
        
        PID:6432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18323.exe
        6⤵
        
        PID:10768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29583.exe
        5⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12445.exe
        6⤵
        
        PID:9804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2640.exe
        6⤵
        
        PID:13196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56025.exe
        5⤵
        
        PID:7144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42746.exe
        6⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41286.exe
        7⤵
        
        PID:11896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59345.exe
        7⤵
        
        PID:6636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27704.exe
        6⤵
        
        PID:11444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8067.exe
        6⤵
        
        PID:5140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41966.exe
        7⤵
        
        PID:14440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28779.exe
        7⤵
        
        PID:16700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62752.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63137.exe
        5⤵
        
        PID:11532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17960.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17960.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38734.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48926.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58122.exe
        7⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46693.exe
        7⤵
        
        PID:11640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57961.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35629.exe
        6⤵
        
        PID:13120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12724.exe
        5⤵
        
        PID:2696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32902.exe
        6⤵
        
        PID:7656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29763.exe
        6⤵
        
        PID:11384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45412.exe
        5⤵
        
        PID:9120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48738.exe
        6⤵
        
        PID:12320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48744.exe
        5⤵
        
        PID:13436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40388.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35714.exe
        5⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42398.exe
        6⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50966.exe
        7⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
        7⤵
        
        PID:11228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49204.exe
        7⤵
        
        PID:15308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13944.exe
        6⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27010.exe
        7⤵
        
        PID:11164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25770.exe
        8⤵
        
        PID:3116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14631.exe
        6⤵
        
        PID:10808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55349.exe
        6⤵
        
        PID:14472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32584.exe
        5⤵
        
        PID:7012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19114.exe
        6⤵
        
        PID:9260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43148.exe
        6⤵
        
        PID:14504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49164.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7004.exe
        5⤵
        
        PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31365.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31365.exe
      4⤵
      PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47360.exe
      4⤵
      PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10753.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44440.exe
        5⤵
        
        PID:5564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20804.exe
      4⤵
      PID:9984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59222.exe
      4⤵
      PID:12292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37847.exe
      4⤵
      PID:15632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53164.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53164.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42870.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45449.exe
        5⤵
        
        PID:4584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13617.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59798.exe
        7⤵
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
        7⤵
        
        PID:11120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36232.exe
        6⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55190.exe
        7⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56714.exe
        8⤵
        
        PID:12988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33480.exe
        7⤵
        
        PID:12096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7543.exe
        7⤵
        
        PID:8072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3559.exe
        6⤵
        
        PID:8420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4264.exe
        6⤵
        
        PID:11964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10607.exe
        6⤵
        
        PID:15676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46320.exe
        5⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38818.exe
        6⤵
        
        PID:8564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32262.exe
        7⤵
        
        PID:14812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        6⤵
        
        PID:11516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55029.exe
        5⤵
        
        PID:8692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63876.exe
        5⤵
        
        PID:2200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2340.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37302.exe
        5⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2637.exe
        6⤵
        
        PID:8536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        6⤵
        
        PID:11496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4057.exe
        7⤵
        
        PID:15316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36232.exe
        5⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5901.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52941.exe
        6⤵
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45848.exe
        5⤵
        
        PID:9292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38494.exe
        6⤵
        
        PID:12632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8032.exe
        6⤵
        
        PID:15756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35593.exe
        5⤵
        
        PID:1044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12479.exe
      4⤵
      PID:5592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28958.exe
        5⤵
        
        PID:1788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28434.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42468.exe
        6⤵
        
        PID:13328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34572.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        5⤵
        
        PID:13244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61069.exe
      4⤵
      PID:4284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18596.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1905.exe
      4⤵
      PID:3456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38521.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38521.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9953.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9953.exe
      4⤵
      Executes dropped EXE
      PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61178.exe
        5⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51822.exe
        6⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31368.exe
        7⤵
        
        PID:13380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34144.exe
        6⤵
        
        PID:10600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61748.exe
        5⤵
        
        PID:7272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44846.exe
        6⤵
        
        PID:12404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12215.exe
        5⤵
        
        PID:10908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57508.exe
      4⤵
      PID:432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6197.exe
        5⤵
        
        PID:9392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40984.exe
        5⤵
        
        PID:14684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33545.exe
      4⤵
      PID:8056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20643.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20643.exe
      4⤵
      PID:4448
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59124.exe
    3⤵
    PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17754.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17754.exe
      4⤵
      PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25398.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38294.exe
        6⤵
        
        PID:10088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43672.exe
        6⤵
        
        PID:12452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        5⤵
        
        PID:10464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20999.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50649.exe
      4⤵
      PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64370.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19410.exe
        6⤵
        
        PID:10352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64913.exe
        6⤵
        
        PID:13424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64705.exe
        5⤵
        
        PID:10604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
        5⤵
        
        PID:5608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27679.exe
      4⤵
      PID:8052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54809.exe
      4⤵
      PID:13632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34472.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34472.exe
    3⤵
    PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3901.exe
      4⤵
      PID:12408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45830.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45830.exe
    3⤵
    PID:7192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36627.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36627.exe
    3⤵
    PID:11724
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38076.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38076.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36762.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36762.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14177.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42294.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27686.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3285.exe
        7⤵
        
        PID:4248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26742.exe
        8⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        8⤵
        
        PID:10480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37232.exe
        8⤵
        
        PID:14508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21292.exe
        7⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42060.exe
        7⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6252.exe
        7⤵
        
        PID:15156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32620.exe
        6⤵
        
        PID:3188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11993.exe
        7⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61514.exe
        8⤵
        
        PID:12076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59345.exe
        8⤵
        
        PID:3532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        7⤵
        
        PID:10472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35027.exe
        6⤵
        
        PID:6916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30637.exe
        6⤵
        
        PID:10568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3928.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22554.exe
        6⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10841.exe
        7⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50198.exe
        8⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
        8⤵
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63145.exe
        7⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60428.exe
        7⤵
        
        PID:11960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-872.exe
        6⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11189.exe
        7⤵
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53657.exe
        7⤵
        
        PID:12440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49396.exe
        7⤵
        
        PID:15584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64148.exe
        6⤵
        
        PID:1824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46586.exe
        6⤵
        
        PID:15072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53372.exe
        5⤵
        
        PID:220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52917.exe
        6⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15169.exe
        7⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40030.exe
        8⤵
        
        PID:10228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33606.exe
        9⤵
        
        PID:15352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
        7⤵
        
        PID:11128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13813.exe
        8⤵
        
        PID:13460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        7⤵
        
        PID:15384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45657.exe
        6⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17882.exe
        7⤵
        
        PID:12852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48105.exe
        7⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57113.exe
        6⤵
        
        PID:11616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46596.exe
        6⤵
        
        PID:16328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49253.exe
        5⤵
        
        PID:7036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19358.exe
        6⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55526.exe
        7⤵
        
        PID:15516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        6⤵
        
        PID:11464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55266.exe
        7⤵
        
        PID:11892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13216.exe
        7⤵
        
        PID:14324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36900.exe
        7⤵
        
        PID:15620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16463.exe
        6⤵
        
        PID:11984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55261.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14187.exe
        5⤵
        
        PID:10648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-829.exe
        6⤵
        
        PID:11416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50221.exe
        5⤵
        
        PID:11836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47126.exe
        5⤵
        
        PID:15536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10176.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11453.exe
        6⤵
        
        PID:4488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11225.exe
        7⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43914.exe
        8⤵
        
        PID:10016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40984.exe
        8⤵
        
        PID:14668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28324.exe
        7⤵
        
        PID:10488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28871.exe
        7⤵
        
        PID:14396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21292.exe
        6⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42060.exe
        6⤵
        
        PID:10528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48333.exe
        6⤵
        
        PID:14732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28152.exe
        5⤵
        
        PID:1756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49082.exe
        6⤵
        
        PID:5704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27166.exe
        7⤵
        
        PID:12992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48105.exe
        7⤵
        
        PID:10896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62045.exe
        6⤵
        
        PID:7460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43797.exe
        6⤵
        
        PID:11368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12199.exe
        5⤵
        
        PID:4180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53218.exe
        6⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17410.exe
        7⤵
        
        PID:14316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16211.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60585.exe
        6⤵
        
        PID:14636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53145.exe
        5⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64358.exe
        6⤵
        
        PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39260.exe
        5⤵
        
        PID:10420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35718.exe
        6⤵
        
        PID:13184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23132.exe
        5⤵
        
        PID:14756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34959.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31874.exe
        5⤵
        
        PID:3920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58542.exe
        6⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49217.exe
        7⤵
        
        PID:9548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32711.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47681.exe
        6⤵
        
        PID:8336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1139.exe
        6⤵
        
        PID:5196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43684.exe
        5⤵
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33595.exe
        5⤵
        
        PID:3828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7004.exe
        5⤵
        
        PID:5500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31609.exe
      4⤵
      PID:3660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32170.exe
        5⤵
        
        PID:7240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38058.exe
        6⤵
        
        PID:11044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15415.exe
        6⤵
        
        PID:14480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30060.exe
        5⤵
        
        PID:11068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37232.exe
        5⤵
        
        PID:14516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32227.exe
      4⤵
      PID:6864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22724.exe
      4⤵
      PID:10440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47597.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10197.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65402.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11837.exe
        6⤵
        
        PID:5144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60514.exe
        7⤵
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2689.exe
        8⤵
        
        PID:9932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11737.exe
        9⤵
        
        PID:14224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40984.exe
        8⤵
        
        PID:14660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        7⤵
        
        PID:8936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9704.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51566.exe
        7⤵
        
        PID:11808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
        7⤵
        
        PID:16304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8131.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52505.exe
        6⤵
        
        PID:5956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41172.exe
        5⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45138.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1241.exe
        7⤵
        
        PID:8740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5185.exe
        8⤵
        
        PID:10860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48338.exe
        9⤵
        
        PID:11740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59345.exe
        9⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20496.exe
        8⤵
        
        PID:11848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7543.exe
        8⤵
        
        PID:12608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37652.exe
        7⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24979.exe
        7⤵
        
        PID:14528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        6⤵
        
        PID:8732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1139.exe
        6⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23439.exe
        5⤵
        
        PID:6340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13996.exe
        5⤵
        
        PID:2260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11027.exe
        5⤵
        
        PID:12716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23606.exe
        6⤵
        
        PID:4660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19848.exe
        6⤵
        
        PID:1624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1648.exe
        5⤵
        
        PID:5360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25116.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62382.exe
        5⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4889.exe
        6⤵
        
        PID:7796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41160.exe
        6⤵
        
        PID:10784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46272.exe
        6⤵
        
        PID:15700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39932.exe
        5⤵
        
        PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24963.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25614.exe
        6⤵
        
        PID:2596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41508.exe
        6⤵
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12639.exe
        6⤵
        
        PID:14836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23876.exe
        6⤵
        
        PID:16716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5992.exe
        5⤵
        
        PID:12004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23579.exe
      4⤵
      PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25066.exe
        5⤵
        
        PID:8268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50777.exe
        5⤵
        
        PID:11548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-579.exe
        5⤵
        
        PID:15480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59533.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21971.exe
      4⤵
      PID:2376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57352.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57352.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32730.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1505.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1505.exe
        5⤵
        
        PID:5408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5273.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37932.exe
        6⤵
        
        PID:11328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8769.exe
        7⤵
        
        PID:540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13932.exe
        6⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7644.exe
        5⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50686.exe
        6⤵
        
        PID:11048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6584.exe
        6⤵
        
        PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34091.exe
        5⤵
        
        PID:10132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59045.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5465.exe
        5⤵
        
        PID:7768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29763.exe
        5⤵
        
        PID:12924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57752.exe
      4⤵
      PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55754.exe
        5⤵
        
        PID:12948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30139.exe
      4⤵
      PID:10872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53745.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53745.exe
      4⤵
      PID:7836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4644.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4644.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44894.exe
      4⤵
      PID:4292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63062.exe
        5⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16042.exe
        6⤵
        
        PID:9104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51544.exe
        6⤵
        
        PID:13428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17556.exe
        5⤵
        
        PID:9148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4123.exe
        5⤵
        
        PID:13236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2168.exe
        5⤵
        
        PID:15080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9704.exe
      4⤵
      PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54858.exe
        5⤵
        
        PID:8044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60030.exe
        6⤵
        
        PID:13084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
        5⤵
        
        PID:11204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11343.exe
      4⤵
      PID:8224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37534.exe
        5⤵
        
        PID:12584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16200.exe
        5⤵
        
        PID:15740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51389.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51389.exe
      4⤵
      PID:11428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5267.exe
      4⤵
      PID:5188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39664.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39664.exe
    3⤵
    PID:1048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25538.exe
      4⤵
      PID:6128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53218.exe
        5⤵
        
        PID:6228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16974.exe
        6⤵
        
        PID:12008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54632.exe
        6⤵
        
        PID:15888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32112.exe
        5⤵
        
        PID:9308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24426.exe
        6⤵
        
        PID:12624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4071.exe
        5⤵
        
        PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58625.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58625.exe
      4⤵
      PID:6660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61350.exe
        5⤵
        
        PID:8924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48930.exe
        6⤵
        
        PID:12324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64653.exe
        5⤵
        
        PID:11556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4972.exe
      4⤵
      PID:9924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1323.exe
      4⤵
      PID:13280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43464.exe
      4⤵
      PID:15840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58401.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58401.exe
    3⤵
    PID:5204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10265.exe
      4⤵
      PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51426.exe
        5⤵
        
        PID:13444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11359.exe
      4⤵
      PID:9888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9988.exe
      4⤵
      PID:13256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60000.exe
      4⤵
      PID:15848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4553.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4553.exe
    3⤵
    PID:6640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8257.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8257.exe
      4⤵
      PID:8964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6937.exe
        5⤵
        
        PID:13136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52401.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52401.exe
      4⤵
      PID:11588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13879.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13879.exe
    3⤵
    PID:8768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9336.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9336.exe
    3⤵
    PID:960
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30631.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30631.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18262.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18262.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5921.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17162.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27738.exe
        6⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14681.exe
        7⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30134.exe
        8⤵
        
        PID:12820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37268.exe
        7⤵
        
        PID:10388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28435.exe
        7⤵
        
        PID:15124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36424.exe
        6⤵
        
        PID:1416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6205.exe
        7⤵
        
        PID:1576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47880.exe
        6⤵
        
        PID:3000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34737.exe
        6⤵
        
        PID:14352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60825.exe
        5⤵
        
        PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34879.exe
        5⤵
        
        PID:9116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42170.exe
        5⤵
        
        PID:14176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18868.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56902.exe
        5⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61566.exe
        6⤵
        
        PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62045.exe
        5⤵
        
        PID:7428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35629.exe
        5⤵
        
        PID:13112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59040.exe
        5⤵
        
        PID:15036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59174.exe
        6⤵
        
        PID:15604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42796.exe
      4⤵
      PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60182.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29114.exe
        6⤵
        
        PID:10896
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10896 -s 720
        7⤵
        Program crash
        
        PID:12900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37232.exe
        6⤵
        
        PID:13068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37932.exe
        5⤵
        
        PID:11320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34322.exe
        6⤵
        
        PID:14196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18680.exe
        5⤵
        
        PID:5772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16108.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33274.exe
        5⤵
        
        PID:4796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18596.exe
      4⤵
      PID:11344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18921.exe
      4⤵
      PID:15928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35256.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35256.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22206.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49362.exe
        5⤵
        
        PID:5312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61526.exe
        6⤵
        
        PID:1084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54446.exe
        7⤵
        
        PID:12732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
        7⤵
        
        PID:15116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61748.exe
        6⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40362.exe
        7⤵
        
        PID:11824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60165.exe
        7⤵
        
        PID:7156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12215.exe
        6⤵
        
        PID:1112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23132.exe
        6⤵
        
        PID:14772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30752.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23082.exe
        6⤵
        
        PID:13008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27679.exe
        5⤵
        
        PID:7180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54809.exe
        5⤵
        
        PID:1436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46596.exe
        5⤵
        
        PID:15564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64281.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64281.exe
      4⤵
      PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48522.exe
        5⤵
        
        PID:8776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        5⤵
        
        PID:11476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29739.exe
      4⤵
      PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8856.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8856.exe
      4⤵
      PID:14180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57108.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57108.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14333.exe
      4⤵
      PID:5760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26882.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60234.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6477.exe
        7⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53810.exe
        8⤵
        
        PID:10912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7212.exe
        8⤵
        
        PID:15816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37652.exe
        7⤵
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        6⤵
        
        PID:8752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1139.exe
        6⤵
        
        PID:3184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52813.exe
        5⤵
        
        PID:6152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55546.exe
        6⤵
        
        PID:4388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56040.exe
        5⤵
        
        PID:10956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6444.exe
        5⤵
        
        PID:15376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33632.exe
      4⤵
      PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1729.exe
        5⤵
        
        PID:9684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40984.exe
        5⤵
        
        PID:14692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37680.exe
      4⤵
      PID:2756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1296.exe
      4⤵
      PID:2820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20072.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20072.exe
    3⤵
    PID:4740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54806.exe
      4⤵
      PID:8448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50201.exe
      4⤵
      PID:11936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7443.exe
    3⤵
    PID:7508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29190.exe
      4⤵
      PID:520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24460.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24460.exe
    3⤵
    PID:11012
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59029.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59029.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37826.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37826.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41858.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40426.exe
        5⤵
        
        PID:3052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36202.exe
        6⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60066.exe
        7⤵
        
        PID:10996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        6⤵
        
        PID:8992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16619.exe
        6⤵
        
        PID:14484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9704.exe
        5⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28086.exe
        6⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24890.exe
        7⤵
        
        PID:9592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22763.exe
        7⤵
        
        PID:13396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18428.exe
        6⤵
        
        PID:10152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42468.exe
        6⤵
        
        PID:14748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26963.exe
        5⤵
        
        PID:7316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35131.exe
        5⤵
        
        PID:12904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1856.exe
        5⤵
        
        PID:15948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57509.exe
      4⤵
      PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1661.exe
        5⤵
        
        PID:5728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35066.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27394.exe
        7⤵
        
        PID:11056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37652.exe
        6⤵
        
        PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31152.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52054.exe
        6⤵
        
        PID:13192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1139.exe
        5⤵
        
        PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43388.exe
      4⤵
      PID:7064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15938.exe
        5⤵
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24838.exe
        6⤵
        
        PID:10668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6361.exe
        7⤵
        
        PID:1960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49869.exe
        6⤵
        
        PID:12964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11420.exe
        5⤵
        
        PID:10580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20319.exe
        5⤵
        
        PID:4716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17208.exe
      4⤵
      PID:8232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37534.exe
        5⤵
        
        PID:12592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3948.exe
        5⤵
        
        PID:15800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57628.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57628.exe
      4⤵
      PID:3484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58941.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58941.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57338.exe
      4⤵
      PID:4620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47494.exe
        5⤵
        
        PID:6092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25014.exe
        6⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60198.exe
        7⤵
        
        PID:8840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3200.exe
        7⤵
        
        PID:11488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11359.exe
        6⤵
        
        PID:9880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9988.exe
        6⤵
        
        PID:13272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51583.exe
        5⤵
        
        PID:2896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4085.exe
        6⤵
        
        PID:9748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22763.exe
        6⤵
        
        PID:13384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32163.exe
        5⤵
        
        PID:10076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1820.exe
        5⤵
        
        PID:12376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12828.exe
      4⤵
      PID:6260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54446.exe
        5⤵
        
        PID:12724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48105.exe
        5⤵
        
        PID:6736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17224.exe
      4⤵
      PID:9896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54608.exe
      4⤵
      PID:12384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54565.exe
      4⤵
      PID:6768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42464.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42464.exe
    3⤵
    PID:3628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60514.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60514.exe
      4⤵
      PID:4720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4005.exe
        5⤵
        
        PID:3048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
      4⤵
      PID:9004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11627.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11627.exe
      4⤵
      PID:12404
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29305.exe
    3⤵
    PID:6372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59326.exe
      4⤵
      PID:7936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
      4⤵
      PID:11220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50152.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50152.exe
    3⤵
    PID:8320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17298.exe
      4⤵
      PID:10232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7653.exe
        5⤵
        
        PID:14296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28732.exe
      4⤵
      PID:14780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13596.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13596.exe
    3⤵
    PID:9068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45910.exe
      4⤵
      PID:4808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52450.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52450.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:14648
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28895.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28895.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13077.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13077.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6549.exe
      4⤵
      PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2481.exe
        5⤵
        
        PID:6740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31978.exe
        6⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4661.exe
        7⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6724.exe
        7⤵
        
        PID:13208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13576.exe
        6⤵
        
        PID:10096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61492.exe
        6⤵
        
        PID:12484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6444.exe
        6⤵
        
        PID:15472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42392.exe
        5⤵
        
        PID:7812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34283.exe
        5⤵
        
        PID:10644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60585.exe
        5⤵
        
        PID:14628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15864.exe
      4⤵
      PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24158.exe
        5⤵
        
        PID:9332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42468.exe
        5⤵
        
        PID:13320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42060.exe
      4⤵
      PID:10432
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-472.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-472.exe
    3⤵
    PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6005.exe
      4⤵
      PID:9284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13237.exe
        5⤵
        
        PID:428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40984.exe
      4⤵
      PID:14700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10243.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10243.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53745.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53745.exe
    3⤵
    PID:10396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26071.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26071.exe
    3⤵
    PID:14372
- C:\Users\Admin\AppData\Local\Temp\Unicorn-17160.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-17160.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10441.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10441.exe
    3⤵
    PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65050.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23252.exe
      4⤵
      PID:12600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24699.exe
      4⤵
      PID:15440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57421.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57421.exe
    3⤵
    PID:7276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35526.exe
      4⤵
      PID:13072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35629.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35629.exe
    3⤵
    PID:11376
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26738.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26738.exe
  2⤵
  PID:5672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63742.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63742.exe
    3⤵
    PID:6952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14209.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14209.exe
      4⤵
      PID:7908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
      4⤵
      PID:11212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54785.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54785.exe
    3⤵
    PID:8036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60428.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60428.exe
    3⤵
    PID:11680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51832.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51832.exe
    3⤵
    PID:15868
- C:\Users\Admin\AppData\Local\Temp\Unicorn-47023.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-47023.exe
  2⤵
  PID:6980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42606.exe
    3⤵
    PID:8060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45398.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45398.exe
      4⤵
      PID:7712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10865.exe
        5⤵
        
        PID:10636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35348.exe
      4⤵
      PID:10728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47681.exe
    3⤵
    PID:8572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1139.exe
    3⤵
    PID:2712
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48372.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48372.exe
  2⤵
  PID:8100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54846.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54846.exe
    3⤵
    PID:14312
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26880.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26880.exe
  2⤵
  PID:9716
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25141.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25141.exe
  2⤵
  PID:11276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14581.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14581.exe
    3⤵
    PID:14432
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42701.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42701.exe
  2⤵
  PID:13344
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15496.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15496.exe
  2⤵
  PID:15772
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61371.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61371.exe
  2⤵
  PID:16768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 10896 -ip 10896
1⤵
PID:12720

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:12012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10093.exe

Filesize
468KB

MD5
900d463021d169e41e090567b2672cf7

SHA1
a2fe3c9a72e5c5f8a6bcaf5eb19ff463b84c99d8

SHA256
561050141bb7f70abb71e390666ccd2f19b6c75c7ccffb0e3693c952151852ec

SHA512
3c3a931bdad0e70fdd5e54fd5369968803dccaad66abd555725fff9e6d6f23ecb65aea00c3f72a3d6126b14622c98b122772855cbcc58850d29429601078a336

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10176.exe

Filesize
468KB

MD5
09abbcaa4cbc7c3f55bc21fb0831ced8

SHA1
7952ef8220e77ae6fa4fcc288615f3345542612a

SHA256
a96a7670297e578030f16337c3463abf2dcb7ea144718346dbf30c05996dfda3

SHA512
38f4b44c24821ca7d584d6388b4def0c2ee47b1f8657bcfeb55125706091f5a59e016356a52d539697c0ebae0108dd319c94e3f911ab8d35b5b318300ccbe3bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10197.exe

Filesize
468KB

MD5
9998b01614a2e13d2e06101c545fcc30

SHA1
5ad832671f69db4561e6c868b876b518e8921115

SHA256
fe792fc092ca4c89f7c42c340ab738bebe68062799aaa2046f4b7bef34dce175

SHA512
00fb33ff23faa4cd2269dc2f634002eae4e1c5affb37b65d6367890daa328902e1c154efab41fe781cb23fdd5563b2b65c6870649eabde1c60c86c6e4204d323

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12065.exe

Filesize
468KB

MD5
f8bc4b1ea68c113f76587d7fe92cb8b6

SHA1
ebd14943ee466e0f5b0a6db97e25ee2c6e084f48

SHA256
30aec58c28a6ded7eb902b9e745ae1cb7dd57d937126514aeae5736f44dd2923

SHA512
45417d83d638b899e1cf140b1df426136f3ed61b23138b790c4e2e540f40849c2492923686ca1e286c3b05d5954736348e63255893931369c58699c8861b8c4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14177.exe

Filesize
468KB

MD5
cf6485ddadb3b179e110f067a0ea6754

SHA1
1f8cc567d4460e48719b7de2cbf3a3246f95b84d

SHA256
e2ce6e181dc0bbb33571f52561a51bdfa5e8e8da56f9b76a0f56222f2955655c

SHA512
52b17c08167de3e89592dbc9ff36e3f771f52e21a92af4da01975d167c3d7695caad8a5472636d11ba02c87547946fd99d98cd80e991c5d6d04313f1d622a9b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17960.exe

Filesize
468KB

MD5
a4b6356bbeed511525fceefff02f6f4f

SHA1
c02ded08ff900cca52e10328e7eee204d64057a6

SHA256
b64395c7e75c273e59a2b169c80a9bf5d67d38555d11143795b803bc785a897c

SHA512
892038d00fe41595eeaf8781ac46ab793a9b4c5a108c0180c37579972827bcc868b3b9c69dc31030da145979bb680725f8632fe2dda9ad2ce84b17ee69e7be38

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18262.exe

Filesize
468KB

MD5
72f634fcd186088784ee813e2268d56d

SHA1
4acb41663a04e4e4fbe22f62a25063a1f74b216e

SHA256
67668b12dc99406626eb3c42f8691b09dc2c3f59acf2d48ceb2e8e082082263a

SHA512
7ff5ce8c84df855b03b9e9bdb001d17e32d5073ac05f8ecfc6be26795e5cf55583a777e7cba88e2d34915c3feff831d7bc7d548fa30db5f4eb2c4196b88adb5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18816.exe

Filesize
468KB

MD5
dc16d723cd7305a1492942a61092dd5e

SHA1
9edee117be5b8a4761f20c292f8f33ba70c2d902

SHA256
2b613bdb537c3c474ee164b992f21d134fdac3cfafca90627dec0376510a18a7

SHA512
22b7aedfce72c267a6021424c62889c996525d7c4ba9b7b8939bf159e4e9c3f57175646d71a14e6b0c2c94019bf6aa2629789e2ba2a93662b1d03747d5c3627e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27738.exe

Filesize
468KB

MD5
06d13a71797dc4a997ccce160bb75003

SHA1
148cb6c107065ad12b80ea9fc96242cc3f72c62c

SHA256
bf2f7ace7d0e95b9a12accdf9b09cfb4ec3992822f180d55460f3ab85112b620

SHA512
d36808c6a60553e20a8cec91662a0d3b4dac19728b3e9d6a2359be31e2c403194edf701894c7151018e6f7abf85ad7886628b83423b08c55bccce8cca71e8e36

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28895.exe

Filesize
468KB

MD5
b44a55ab733bbf08c2c7ec5b4612e6a2

SHA1
1f7d79bfac453cbab97bcaff5f3f14268b6d952d

SHA256
f6129fde697f1be6d10b49f6046f083f7734ff05bce765a47d9e7764eda24eb9

SHA512
e00c7bbf09759a4d9ca3e845eed7e278df1e24727727bc73422d2cb59d438bdb2a3792ceabccb70bdf5744f44f206c36d397782016eeea30603aed29789c0125

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30631.exe

Filesize
468KB

MD5
996e41abcfa38143163958e4e10be9f3

SHA1
14f00fd4c30972919cb0c412ace68f9d601aa91e

SHA256
a6967217a96cdb3f7a244c720e4a3021a1b4b63d73dfce50cd06dde65f4d069a

SHA512
76e53a6bef0f5a92cff2a1b344ff1bbe474049cda44de03b54f4df6b271d134d71337130ecfcc603e89056118df7a2b22304031db4e7544211e8bf3685369055

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35256.exe

Filesize
468KB

MD5
9a46b31cbb3be68b41177698c928879b

SHA1
969ce1053f355720604487e004ebe8b7c9029fba

SHA256
a563a1fa44cd54c9a94c9ee97806113760892e529bc65b036ec3066634097c81

SHA512
07e54bd47173362abad906cfc3d830922ab83178aeba0907452964f579d3ad237cc3d26f200d7ac6910b3b2594b2630ce4af373c1afee74ca3fc0be5065a6061

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36762.exe

Filesize
468KB

MD5
65577f09427bf95215fb35f14c1a5a5b

SHA1
783624651bba0c721e1f18c1168b5e5bdca3268c

SHA256
86fdd4962816ca598fe8d903d2bfadff0e1c33c50dba94dedfe9d3f99ee4d6c3

SHA512
b1a4237ac1e24abae966265aa126e0baef48e4e4e782e686dc304f27ac25c6bd4188679d05aefe392ef103a9133705090baa956adb40da47878527b3f818dbad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37826.exe

Filesize
468KB

MD5
a2db46a8c7fcd4e7cc41fb4a7adfa934

SHA1
13cb62d4c10fd92b3327f3e23c413f70aefee86f

SHA256
84b557bc5ca8840d3378cee83e46bb6191253746afde6c004594376c8c82a702

SHA512
6f1984fd26c61cebb6cc43a5e3e0107012f2ddbb92c51a48e8068d2b0afbeff95dea58994dc5e1bfd0af6dc7a05aedbb981ecb1703b422afebb95db1925717d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38076.exe

Filesize
468KB

MD5
ba0ba154e726b256a9326409661b0cec

SHA1
c211cbd9acd96fd0507b6f771c866d08fb554687

SHA256
942f95547e3f06ff9aa805049fc05d4936c80721d390f51f76c77dade69afa5b

SHA512
897ade1ded64490b56a475a83e4e69ed93a7fcea09fb9ac5535579e7631d7fca5db8955069d4bec6da6896091116b061eb88a79560a438ff663bffa9360ec27e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38521.exe

Filesize
468KB

MD5
1d9423315e0aba94f3e78e7ca93a562e

SHA1
3ba9ac22f34308e1fff93d45802fa5953e85891f

SHA256
71ae6208983f130aa6793c5884c50f825b3464d2960638c91706fb382011a05e

SHA512
e0b2a67f32ac4f43cd9961508b28fee50dd90d4466abfc6d4b2862c9fc30be4f51775db991a335976d7dbe5255dc1a2c0b475d7ea45d5005098e3ea1404ffa66

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39110.exe

Filesize
468KB

MD5
9ab4d491a56e37b653d5d9fce7e8292e

SHA1
c09813e3c08be1248d318f0c62cda1f3508e1f59

SHA256
2c840fca0d98878b9877028a9e4523a934aa697650c9e4abf0d40b8dc0d28be7

SHA512
cf49dee8a88fba31a470f1a08c9420830c494b8d57288670b7b6c0f7b310f5d3ac91faed60dad0643820a03cf01a5af66605b29e429d00cd0fe21b691daaca72

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39672.exe

Filesize
468KB

MD5
5a92c1c3cc11e01df994d18055b8e073

SHA1
ea51d2a8132e38510179fbdca762f886f959db60

SHA256
8e2383b6a3071fae0acf5af3b61ac5ed8502e46798fcb4746a71f95ac2c0fb53

SHA512
4ab520cc8f37e6b7c1da08c3851d6fe6d50262152dece92cde00bd2d5dc39c9ba6aa0c0a7f6339c2c027f2174b549fdf7f2058e6653c29c69db8504708803f48

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41910.exe

Filesize
468KB

MD5
6f9fbb6f3c493db820222066894f3b83

SHA1
07e27478e59e860b9a562a2cfe39807747503232

SHA256
aa5c83d73c489babdf2673257aa53905377f89ae7aa01eae0a6b8831a0beda32

SHA512
fed20d3f596e9e8a8b3b21e47381aa02972bd0ee63cea704074e38f88d2cd4287d18905d98406f1e8c9d6a9d3a079a5704378490f675eec762ce0d3ff795605a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42294.exe

Filesize
468KB

MD5
3e5fd4d291b657ef832cd19524d5f12c

SHA1
e7a52af85207959b189cc06c10857ef3f69d3f8b

SHA256
b6e7d90df082b01386bfd44ccca4c4ec7790e7589e40ec2360323481b266272d

SHA512
cca7a04acfaa52474f53fa75f907f18190861d5ff7972e905a1c80491b92cbd4e4e775a579648e6e9652501849786c7109a24491c447b0b9014b46dbc7011e46

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42656.exe

Filesize
468KB

MD5
8a906957a2e359d66fa081aada71877e

SHA1
c39b95e1d3edb3056eea159fcc9183a782724b79

SHA256
f83654e1cf6738cb8a64b2345fcbce6a5ca0f21b208e15eb428b7e99d2ccf4e8

SHA512
b5eb840ec3d0fb0ceb2727a2ecc05862c9c3406c9301caf49b297688c7c9cea543a449e07c3e87f0caa429f0ee44751b5dd299f2f0ed8fb05a9a68df2f4c3c95

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42870.exe

Filesize
468KB

MD5
f5799b3ab4bc6b27fb2542ae5e5dbb2f

SHA1
b1e3a34ec19884da776aa42ce8a32bd402dbaffe

SHA256
cf2307cb0b87a7832c3655bc49847c07502c700b353c9e1daace68bc3f058cce

SHA512
25dcd9a940171d0172933487c127e318cd79f34da80882c0b64510bf50480b8f990c8eb26f7ef971e5d183ccbbbe0c776e0a1b89ebba2fed514275517fa24b58

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46850.exe

Filesize
468KB

MD5
68a61c71d838857eabb14603c40d5f69

SHA1
499558bd66d93af3d4eca4ac8dcbc98c514a6922

SHA256
b8d65f404b8e9bfcb5e6c7531aaca4cd0433d3890751eb6814b6cad9f1e2ae07

SHA512
a05f3b6911b1d90433bfe1b26b9ad24c7cecb84e44ec3406f5d1e7183bcd9395f866e840dcf3f375dcc5fca18d088ea0a4d9ef4f5ce58d58dc437b8874780587

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47597.exe

Filesize
468KB

MD5
cf75fb099cd7b4cd548eb7b440b0efce

SHA1
1967b92bda09f519c80a4306c66dfe408cab25ff

SHA256
b656c645e71efa979c35cceac17402b4c295c6c842010e98765f97d7a134e341

SHA512
0872b3d45d3aa2ca7e77beb6cac30bbd744fa0a35639e44b0ef31841c9b59016d2328f5bcea766e57c1f1423e795aa3308b6ab65cce7f7363c7081031f944842

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49237.exe

Filesize
468KB

MD5
c63cad7194dc43f55a87dfb16c0614c8

SHA1
323b9e5e2319735e58875a5229395ba11cd9e08f

SHA256
c422f803365cc50e9cba07dd672096e8449616566ea051ca76336fc9ab7c1307

SHA512
37675cbeab904dc9a58cb18e8a5e91693a6b152a9e40e12cd360c76c9820591dafa97bed25bab51a9c08dc0ed6a12ca671403ab3072044bdd3a0701f8ea58196

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49569.exe

Filesize
468KB

MD5
426c9a79aa54bccb2aa191800aba2122

SHA1
0a24822014c4fb5cbd9cb836aecc063773dcc474

SHA256
1eb206a834dd99cce0b27df5c0e04f88b2a9d97f638b31b3808d28a3158329d7

SHA512
f885253f9c2bd4321680c5b35762bb0c8dd469afdc894a1dc3a931958cd004398a8b10923e98e71593c175b0c69f6b3e637301088054ea13c24599f2e7f55d1a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53164.exe

Filesize
468KB

MD5
715241c1c38efb2987cbbf2930b040e3

SHA1
fddc284c0f60b12adc788efb4dd3674b5622edd5

SHA256
41bea65a97142b513f369f550627cba784e6dbc2a3d24ee06f98a20cd718baee

SHA512
f365e5e09a1e83583cb7a2473e2333dfbd700a5d2d7b64339e7bbcfab56aee0e381a9624b2bce655eb9a7df213428585685cb5d221259cd4537fb21c6d2abec5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57352.exe

Filesize
468KB

MD5
37295bb29798a2b08fbcba6d7fb7733f

SHA1
407ff690b9e80ff1c69b5e476130dfacce16f74f

SHA256
5edaab36c72904a0bded41109a70d4bb6dc27d5504e1f4bc6c4e82be900b01b5

SHA512
7587defbb788456ece6dc915e81d133c03a8a945fd9bd691f1daf49dbcb4aa3088ed3707e0a88169cfc79dad591aed52ab2e6b4ddcc461d44e605597cb04366d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57942.exe

Filesize
468KB

MD5
cf00322e71bbaa2b675610fcc0ae6fb5

SHA1
aad65650314c08f1fa9f031bafc193c569257148

SHA256
b90fb651a50cd21deb1681558b11f2ee38d47221eb856766371973ea45028f03

SHA512
2d7b68fafd746a7cc83eb2c3b807c77f6cfe4001b562f259fd3f338fda735766ab3fd076f19803ecd6e3eee437937f410adc5b2486bb416df2292981c41c61bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58054.exe

Filesize
468KB

MD5
060ba465babc066a4f977605b98b46fd

SHA1
78918fa7fb1e6440a999337038a24598b54e97d6

SHA256
fff3178296fdb505b000d8ca598f3e56f59d1d58a76df005002368346efd08a1

SHA512
3c25c1d07f055df7b47092323da90d0e8901b00314e6b46dcdc4a46ae5c1ef0efaa75e6c6a357cda6983803cdb2984369bfa93d7be08203f7964a7a40f8be43c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59029.exe

Filesize
468KB

MD5
3cc29ed2bd607f434988e9c64561f9df

SHA1
c053c9d0054be21957a31d224c314b807c117c7a

SHA256
758607bc6bc704e1978e63b83c20781faa372f0abb532ee8d89242708992ad5e

SHA512
68c67ddfda09b4658a471cdb363875891d71ec807aa84ff7e29919aa240f7faf33ac632ef851cb0cc1556a52a1a5221cb4cf2ae40ae04f2ee4875f1a3d08712b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5921.exe

Filesize
468KB

MD5
1a3e732e55536d9caa4d645be13fdd8d

SHA1
164d0fbc87d021b2f0693bc010ca1fb9bd27d4e7

SHA256
77bc53829ff493422c8946d42541934a522d325e83716f612ca3fd3d30c86df3

SHA512
70ee737d0148342b60a2abfef6203f1c5d76b51591f2ff19aa343ec2e7c89f29355aa228edddf32f928ff5a08e127f85a5f4c4ce47f9af5371979369cc543253

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8469.exe

Filesize
468KB

MD5
b6b437bba8d243e03fc895eb8249d106

SHA1
b85a5cc2c353969e0772971f383c12ff9708a7ce

SHA256
aa12b226485cec495b5a59e73305ea9a8e420f2ee7bb904725fbc739d31d90fa

SHA512
76385ef224e2976aa32377cf41bc051826246142a7bc2ff1f68aa2a79a144753e5bff9c3424a4745fb7fd4577539f5c362610ef04b21a7dd94c3f913f1b60358

Download Submit
memory/220-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/244-15-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/332-529-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/552-273-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/648-87-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/652-131-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/676-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1048-527-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1128-446-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1164-33-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1312-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1420-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1432-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1488-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1524-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1592-354-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1608-460-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1756-458-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1804-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1920-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2084-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2156-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2188-56-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2236-199-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2240-28-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2304-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2308-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2316-293-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2364-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2396-60-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2532-200-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2680-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2868-299-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2880-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2884-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3052-534-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3056-236-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3132-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3144-144-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3188-466-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3192-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3296-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3476-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3596-78-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3628-539-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3648-198-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3660-463-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3664-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3684-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3692-145-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3760-461-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3816-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3836-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3852-116-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3868-171-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3920-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3932-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3968-88-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4012-128-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4048-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4140-75-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4248-465-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4264-174-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4280-193-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4292-487-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4296-449-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4308-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4356-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4480-184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4488-464-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4512-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4584-488-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4588-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4620-522-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4648-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4728-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4744-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4776-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4828-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4872-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4908-443-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4924-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4932-192-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5012-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5028-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5036-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5056-301-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5060-275-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5116-530-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5144-542-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5156-543-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5172-544-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5244-546-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5268-482-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5312-486-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5432-547-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/11616-2795-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/12036-2798-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/12172-2796-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/12624-2797-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/12732-2784-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads