870bcecf6eaa098dc38086aa10052f31ed46fb804bf9789860b1c624b435c15a

Analysis

max time kernel
120s
max time network
115s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/09/2024, 18:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e3955fa144c21a8c8faa226ccc9fac0N.exe
Size

468KB
MD5

3e3955fa144c21a8c8faa226ccc9fac0
SHA1

ef29d73e1adee0036b93d6d8a672d5a3861f4fab
SHA256

870bcecf6eaa098dc38086aa10052f31ed46fb804bf9789860b1c624b435c15a
SHA512

0c5cbb9cbcbafd5086e819b8d9b196fd34524ef410d1fca811083ea3a738d9de9408074917d9e2c0a1a4c4a1aa2b47cf836d52ca8667037c045c110c479c4ba5
SSDEEP

3072:W1N/ogLda58Un+/LPz5FafwcfhzWI8hnmHe0V3+H2uaabkN4Elk:W11o9qUnQP1FafGxXZH2dYkN4

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3436	Unicorn-43082.exe
2688	Unicorn-36620.exe
1652	Unicorn-56486.exe
4820	Unicorn-24774.exe
2932	Unicorn-61622.exe
1384	Unicorn-54130.exe
3584	Unicorn-34264.exe
424	Unicorn-20280.exe
4880	Unicorn-8582.exe
936	Unicorn-24364.exe
4032	Unicorn-9973.exe
4336	Unicorn-55645.exe
460	Unicorn-3843.exe
1072	Unicorn-9973.exe
1140	Unicorn-9708.exe
2288	Unicorn-819.exe
4296	Unicorn-819.exe
4424	Unicorn-60802.exe
1316	Unicorn-47067.exe
4332	Unicorn-15593.exe
2300	Unicorn-65349.exe
2984	Unicorn-19678.exe
4316	Unicorn-58572.exe
1312	Unicorn-62656.exe
3628	Unicorn-1203.exe
2240	Unicorn-36014.exe
3900	Unicorn-938.exe
1064	Unicorn-8093.exe
2336	Unicorn-57810.exe
3560	Unicorn-46875.exe
2152	Unicorn-55811.exe
4628	Unicorn-43544.exe
2220	Unicorn-43544.exe
1684	Unicorn-19594.exe
1560	Unicorn-59688.exe
528	Unicorn-59688.exe
4784	Unicorn-48104.exe
5016	Unicorn-53969.exe
3356	Unicorn-27400.exe
3456	Unicorn-15702.exe
3244	Unicorn-4841.exe
1292	Unicorn-4841.exe
3784	Unicorn-39652.exe
1644	Unicorn-4026.exe
228	Unicorn-58702.exe
4992	Unicorn-17761.exe
1488	Unicorn-4026.exe
3532	Unicorn-23892.exe
1980	Unicorn-40228.exe
1748	Unicorn-31098.exe
4676	Unicorn-63341.exe
4300	Unicorn-36044.exe
2828	Unicorn-17670.exe
4016	Unicorn-65287.exe
2392	Unicorn-3279.exe
3228	Unicorn-50342.exe
3952	Unicorn-3279.exe
3212	Unicorn-58245.exe
1472	Unicorn-52380.exe
376	Unicorn-49580.exe
3960	Unicorn-19616.exe
2264	Unicorn-38644.exe
4360	Unicorn-34481.exe
4460	Unicorn-1525.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
6584	3896	WerFault.exe	161
5920	5644	WerFault.exe	189

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21126.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30911.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44317.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22141.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36019.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37401.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53990.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36750.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24331.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38770.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4026.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52199.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47157.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40917.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32307.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47659.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19285.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49582.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47470.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4841.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64285.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61805.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17186.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17124.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55609.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13208.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56204.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23892.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56616.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41350.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4570.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43430.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36606.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38116.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54177.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41410.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3279.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49548.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26056.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36343.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13837.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52758.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34228.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8016.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	3740	dwm.exe
Token: SeChangeNotifyPrivilege	3740	dwm.exe
Token: 33	3740	dwm.exe
Token: SeIncBasePriorityPrivilege	3740	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2500	3e3955fa144c21a8c8faa226ccc9fac0N.exe
3436	Unicorn-43082.exe
1652	Unicorn-56486.exe
2688	Unicorn-36620.exe
4820	Unicorn-24774.exe
1384	Unicorn-54130.exe
3584	Unicorn-34264.exe
2932	Unicorn-61622.exe
424	Unicorn-20280.exe
4880	Unicorn-8582.exe
460	Unicorn-3843.exe
936	Unicorn-24364.exe
4032	Unicorn-9973.exe
1072	Unicorn-9973.exe
4336	Unicorn-55645.exe
1140	Unicorn-9708.exe
2288	Unicorn-819.exe
4296	Unicorn-819.exe
1316	Unicorn-47067.exe
4424	Unicorn-60802.exe
4332	Unicorn-15593.exe
2300	Unicorn-65349.exe
4316	Unicorn-58572.exe
2984	Unicorn-19678.exe
2240	Unicorn-36014.exe
1312	Unicorn-62656.exe
3628	Unicorn-1203.exe
3560	Unicorn-46875.exe
2336	Unicorn-57810.exe
2152	Unicorn-55811.exe
1064	Unicorn-8093.exe
3900	Unicorn-938.exe
1684	Unicorn-19594.exe
4628	Unicorn-43544.exe
2220	Unicorn-43544.exe
528	Unicorn-59688.exe
1560	Unicorn-59688.exe
4784	Unicorn-48104.exe
5016	Unicorn-53969.exe
3356	Unicorn-27400.exe
3244	Unicorn-4841.exe
3456	Unicorn-15702.exe
1292	Unicorn-4841.exe
3784	Unicorn-39652.exe
1644	Unicorn-4026.exe
228	Unicorn-58702.exe
3532	Unicorn-23892.exe
4992	Unicorn-17761.exe
1488	Unicorn-4026.exe
1980	Unicorn-40228.exe
1748	Unicorn-31098.exe
4676	Unicorn-63341.exe
4300	Unicorn-36044.exe
2392	Unicorn-3279.exe
2828	Unicorn-17670.exe
4016	Unicorn-65287.exe
1472	Unicorn-52380.exe
376	Unicorn-49580.exe
3952	Unicorn-3279.exe
2264	Unicorn-38644.exe
3960	Unicorn-19616.exe
3228	Unicorn-50342.exe
3212	Unicorn-58245.exe
4360	Unicorn-34481.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 3436	2500	3e3955fa144c21a8c8faa226ccc9fac0N.exe	89
PID 2500 wrote to memory of 3436	2500	3e3955fa144c21a8c8faa226ccc9fac0N.exe	89
PID 2500 wrote to memory of 3436	2500	3e3955fa144c21a8c8faa226ccc9fac0N.exe	89
PID 2500 wrote to memory of 2688	2500	3e3955fa144c21a8c8faa226ccc9fac0N.exe	93
PID 2500 wrote to memory of 2688	2500	3e3955fa144c21a8c8faa226ccc9fac0N.exe	93
PID 2500 wrote to memory of 2688	2500	3e3955fa144c21a8c8faa226ccc9fac0N.exe	93
PID 3436 wrote to memory of 1652	3436	Unicorn-43082.exe	94
PID 3436 wrote to memory of 1652	3436	Unicorn-43082.exe	94
PID 3436 wrote to memory of 1652	3436	Unicorn-43082.exe	94
PID 2688 wrote to memory of 4820	2688	Unicorn-36620.exe	97
PID 2688 wrote to memory of 4820	2688	Unicorn-36620.exe	97
PID 2688 wrote to memory of 4820	2688	Unicorn-36620.exe	97
PID 2500 wrote to memory of 2932	2500	3e3955fa144c21a8c8faa226ccc9fac0N.exe	98
PID 2500 wrote to memory of 2932	2500	3e3955fa144c21a8c8faa226ccc9fac0N.exe	98
PID 2500 wrote to memory of 2932	2500	3e3955fa144c21a8c8faa226ccc9fac0N.exe	98
PID 1652 wrote to memory of 1384	1652	Unicorn-56486.exe	99
PID 1652 wrote to memory of 1384	1652	Unicorn-56486.exe	99
PID 1652 wrote to memory of 1384	1652	Unicorn-56486.exe	99
PID 3436 wrote to memory of 3584	3436	Unicorn-43082.exe	100
PID 3436 wrote to memory of 3584	3436	Unicorn-43082.exe	100
PID 3436 wrote to memory of 3584	3436	Unicorn-43082.exe	100
PID 4820 wrote to memory of 424	4820	Unicorn-24774.exe	101
PID 4820 wrote to memory of 424	4820	Unicorn-24774.exe	101
PID 4820 wrote to memory of 424	4820	Unicorn-24774.exe	101
PID 2688 wrote to memory of 4880	2688	Unicorn-36620.exe	102
PID 2688 wrote to memory of 4880	2688	Unicorn-36620.exe	102
PID 2688 wrote to memory of 4880	2688	Unicorn-36620.exe	102
PID 2932 wrote to memory of 936	2932	Unicorn-61622.exe	103
PID 2932 wrote to memory of 936	2932	Unicorn-61622.exe	103
PID 2932 wrote to memory of 936	2932	Unicorn-61622.exe	103
PID 1384 wrote to memory of 4032	1384	Unicorn-54130.exe	105
PID 1384 wrote to memory of 4032	1384	Unicorn-54130.exe	105
PID 1384 wrote to memory of 4032	1384	Unicorn-54130.exe	105
PID 1652 wrote to memory of 4336	1652	Unicorn-56486.exe	108
PID 1652 wrote to memory of 4336	1652	Unicorn-56486.exe	108
PID 1652 wrote to memory of 4336	1652	Unicorn-56486.exe	108
PID 3436 wrote to memory of 460	3436	Unicorn-43082.exe	104
PID 3436 wrote to memory of 460	3436	Unicorn-43082.exe	104
PID 3436 wrote to memory of 460	3436	Unicorn-43082.exe	104
PID 3584 wrote to memory of 1072	3584	Unicorn-34264.exe	106
PID 3584 wrote to memory of 1072	3584	Unicorn-34264.exe	106
PID 3584 wrote to memory of 1072	3584	Unicorn-34264.exe	106
PID 2500 wrote to memory of 1140	2500	3e3955fa144c21a8c8faa226ccc9fac0N.exe	107
PID 2500 wrote to memory of 1140	2500	3e3955fa144c21a8c8faa226ccc9fac0N.exe	107
PID 2500 wrote to memory of 1140	2500	3e3955fa144c21a8c8faa226ccc9fac0N.exe	107
PID 424 wrote to memory of 4296	424	Unicorn-20280.exe	109
PID 4880 wrote to memory of 2288	4880	Unicorn-8582.exe	110
PID 424 wrote to memory of 4296	424	Unicorn-20280.exe	109
PID 424 wrote to memory of 4296	424	Unicorn-20280.exe	109
PID 4880 wrote to memory of 2288	4880	Unicorn-8582.exe	110
PID 4880 wrote to memory of 2288	4880	Unicorn-8582.exe	110
PID 2688 wrote to memory of 4424	2688	Unicorn-36620.exe	111
PID 2688 wrote to memory of 4424	2688	Unicorn-36620.exe	111
PID 2688 wrote to memory of 4424	2688	Unicorn-36620.exe	111
PID 4820 wrote to memory of 1316	4820	Unicorn-24774.exe	112
PID 4820 wrote to memory of 1316	4820	Unicorn-24774.exe	112
PID 4820 wrote to memory of 1316	4820	Unicorn-24774.exe	112
PID 4032 wrote to memory of 4332	4032	Unicorn-9973.exe	113
PID 4032 wrote to memory of 4332	4032	Unicorn-9973.exe	113
PID 4032 wrote to memory of 4332	4032	Unicorn-9973.exe	113
PID 1384 wrote to memory of 2300	1384	Unicorn-54130.exe	114
PID 1384 wrote to memory of 2300	1384	Unicorn-54130.exe	114
PID 1384 wrote to memory of 2300	1384	Unicorn-54130.exe	114
PID 936 wrote to memory of 2984	936	Unicorn-24364.exe	115

C:\Users\Admin\AppData\Local\Temp\3e3955fa144c21a8c8faa226ccc9fac0N.exe
"C:\Users\Admin\AppData\Local\Temp\3e3955fa144c21a8c8faa226ccc9fac0N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Users\Admin\AppData\Local\Temp\Unicorn-43082.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-43082.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56486.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56486.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54130.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9973.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15593.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27400.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30498.exe
        8⤵
        
        PID:3252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-321.exe
        9⤵
        
        PID:3292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11665.exe
        10⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62677.exe
        10⤵
        
        PID:12860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43717.exe
        10⤵
        
        PID:16692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25763.exe
        9⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7612.exe
        9⤵
        
        PID:12604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10408.exe
        9⤵
        
        PID:15364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12913.exe
        9⤵
        
        PID:10648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58629.exe
        8⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        9⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4348.exe
        9⤵
        
        PID:11596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        9⤵
        
        PID:15680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31025.exe
        8⤵
        
        PID:9104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60513.exe
        8⤵
        
        PID:11468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6900.exe
        8⤵
        
        PID:15968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54379.exe
        7⤵
        
        PID:3660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58821.exe
        8⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15173.exe
        9⤵
        
        PID:9576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19122.exe
        9⤵
        
        PID:13068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-930.exe
        9⤵
        
        PID:15880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-781.exe
        9⤵
        
        PID:10524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47746.exe
        8⤵
        
        PID:1012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7804.exe
        8⤵
        
        PID:12452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39957.exe
        8⤵
        
        PID:320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39363.exe
        8⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60112.exe
        7⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13419.exe
        8⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61717.exe
        8⤵
        
        PID:12664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46073.exe
        8⤵
        
        PID:8
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41630.exe
        7⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21690.exe
        7⤵
        
        PID:13112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34073.exe
        7⤵
        
        PID:15992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15054.exe
        7⤵
        
        PID:11320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15702.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30834.exe
        7⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        8⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20898.exe
        9⤵
        
        PID:13220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26089.exe
        9⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54423.exe
        9⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25396.exe
        8⤵
        
        PID:9628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15535.exe
        8⤵
        
        PID:12900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
        8⤵
        
        PID:16556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26199.exe
        7⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38173.exe
        7⤵
        
        PID:11280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20444.exe
        7⤵
        
        PID:15456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47157.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54867.exe
        7⤵
        
        PID:8376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2961.exe
        6⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-129.exe
        7⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40280.exe
        8⤵
        
        PID:8692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28660.exe
        8⤵
        
        PID:9872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        8⤵
        
        PID:15656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55410.exe
        8⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3205.exe
        7⤵
        
        PID:8996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15780.exe
        7⤵
        
        PID:12632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6324.exe
        7⤵
        
        PID:15604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45365.exe
        6⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58178.exe
        7⤵
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35484.exe
        7⤵
        
        PID:10824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49503.exe
        7⤵
        
        PID:14920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
        7⤵
        
        PID:16648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15589.exe
        6⤵
        
        PID:8632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64285.exe
        6⤵
        
        PID:11452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61140.exe
        6⤵
        
        PID:15836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12843.exe
        6⤵
        
        PID:11056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65349.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17670.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
        7⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9963.exe
        8⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-595.exe
        8⤵
        
        PID:12176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64269.exe
        8⤵
        
        PID:3796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32949.exe
        8⤵
        
        PID:8356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34228.exe
        7⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14409.exe
        7⤵
        
        PID:10784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55368.exe
        7⤵
        
        PID:15152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40917.exe
        7⤵
        
        PID:16600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37248.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2781.exe
        7⤵
        
        PID:2696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26056.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
        8⤵
        
        PID:13052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6384.exe
        8⤵
        
        PID:3496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58150.exe
        8⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60591.exe
        7⤵
        
        PID:10420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13759.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        7⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51088.exe
        6⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20898.exe
        7⤵
        
        PID:12820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26089.exe
        7⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42171.exe
        7⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38173.exe
        6⤵
        
        PID:9592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35820.exe
        6⤵
        
        PID:12508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55902.exe
        6⤵
        
        PID:15856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36044.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
        6⤵
        
        PID:5724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8619.exe
        7⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20898.exe
        8⤵
        
        PID:13204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25897.exe
        8⤵
        
        PID:3596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60453.exe
        8⤵
        
        PID:10448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31078.exe
        7⤵
        
        PID:9536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41794.exe
        7⤵
        
        PID:13828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33438.exe
        7⤵
        
        PID:13992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51623.exe
        7⤵
        
        PID:4576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55443.exe
        6⤵
        
        PID:7688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32307.exe
        6⤵
        
        PID:9656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44486.exe
        6⤵
        
        PID:14364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63693.exe
        6⤵
        
        PID:3656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56849.exe
        5⤵
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36606.exe
        6⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37211.exe
        7⤵
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18572.exe
        6⤵
        
        PID:10044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38621.exe
        6⤵
        
        PID:14344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37522.exe
        6⤵
        
        PID:5344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-476.exe
        6⤵
        
        PID:9692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22605.exe
        5⤵
        
        PID:7280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25800.exe
        5⤵
        
        PID:10404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47233.exe
        5⤵
        
        PID:14972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54918.exe
        5⤵
        
        PID:10208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62044.exe
        5⤵
        
        PID:8740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55645.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1203.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40228.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9091.exe
        7⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53990.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62236.exe
        9⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40040.exe
        9⤵
        
        PID:11688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33438.exe
        9⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39179.exe
        9⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31296.exe
        8⤵
        
        PID:8624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18083.exe
        8⤵
        
        PID:11536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28856.exe
        8⤵
        
        PID:5976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51424.exe
        8⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50269.exe
        7⤵
        
        PID:6532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45926.exe
        8⤵
        
        PID:7364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8378.exe
        9⤵
        
        PID:10904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47470.exe
        9⤵
        
        PID:17088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31400.exe
        8⤵
        
        PID:11360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14500.exe
        8⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
        8⤵
        
        PID:16708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18389.exe
        7⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2045.exe
        7⤵
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58232.exe
        7⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
        7⤵
        
        PID:7592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63123.exe
        6⤵
        
        PID:5644
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5644 -s 488
        7⤵
        Program crash
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25405.exe
        6⤵
        
        PID:7332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51001.exe
        6⤵
        
        PID:10704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46703.exe
        6⤵
        
        PID:15020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37401.exe
        6⤵
        
        PID:16768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65287.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
        6⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15672.exe
        7⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19388.exe
        8⤵
        
        PID:10852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63204.exe
        8⤵
        
        PID:14768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43717.exe
        8⤵
        
        PID:16564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        7⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33049.exe
        7⤵
        
        PID:12780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44154.exe
        7⤵
        
        PID:10224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21426.exe
        6⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1359.exe
        7⤵
        
        PID:9944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48287.exe
        7⤵
        
        PID:11908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-930.exe
        7⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18519.exe
        6⤵
        
        PID:10248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61063.exe
        6⤵
        
        PID:1552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10382.exe
        6⤵
        
        PID:15868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6307.exe
        6⤵
        
        PID:1320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50984.exe
        5⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48858.exe
        6⤵
        
        PID:7720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8622.exe
        7⤵
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18572.exe
        6⤵
        
        PID:9492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38621.exe
        6⤵
        
        PID:14528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33438.exe
        6⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31010.exe
        6⤵
        
        PID:10580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59859.exe
        5⤵
        
        PID:7740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42336.exe
        5⤵
        
        PID:10432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30167.exe
        5⤵
        
        PID:14940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64197.exe
        5⤵
        
        PID:2888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8093.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3279.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56346.exe
        6⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14047.exe
        7⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31321.exe
        7⤵
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37626.exe
        7⤵
        
        PID:15812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe
        7⤵
        
        PID:10660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34228.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45136.exe
        6⤵
        
        PID:10560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49801.exe
        6⤵
        
        PID:15852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17007.exe
        6⤵
        
        PID:15952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36393.exe
        6⤵
        
        PID:11760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52136.exe
        5⤵
        
        PID:6848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13637.exe
        6⤵
        
        PID:8468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4348.exe
        6⤵
        
        PID:2212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        6⤵
        
        PID:14908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9525.exe
        6⤵
        
        PID:9988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6548.exe
        5⤵
        
        PID:8748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64676.exe
        5⤵
        
        PID:12400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16815.exe
        5⤵
        
        PID:1344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58245.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
        5⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        6⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21312.exe
        6⤵
        
        PID:8688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15535.exe
        6⤵
        
        PID:13328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6795.exe
        6⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        6⤵
        
        PID:10800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
        5⤵
        
        PID:7600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41350.exe
        5⤵
        
        PID:12264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31319.exe
        5⤵
        
        PID:15836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33497.exe
        5⤵
        
        PID:15428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48184.exe
      4⤵
      PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14047.exe
        5⤵
        
        PID:7540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18572.exe
        5⤵
        
        PID:10456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38621.exe
        5⤵
        
        PID:4396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6795.exe
        5⤵
        
        PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22842.exe
        5⤵
        
        PID:7044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8016.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42866.exe
      4⤵
      PID:10360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25702.exe
      4⤵
      PID:14884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33247.exe
      4⤵
      PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31433.exe
      4⤵
      PID:9484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34264.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34264.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9973.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36014.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3279.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
        7⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49460.exe
        8⤵
        
        PID:6492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26056.exe
        9⤵
        
        PID:9712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
        9⤵
        
        PID:13032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39633.exe
        9⤵
        
        PID:15924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56204.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6730.exe
        8⤵
        
        PID:10372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65312.exe
        8⤵
        
        PID:13864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6795.exe
        8⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20896.exe
        8⤵
        
        PID:3056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37352.exe
        7⤵
        
        PID:7864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10103.exe
        8⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28058.exe
        8⤵
        
        PID:13876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36125.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16381.exe
        7⤵
        
        PID:10332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36367.exe
        7⤵
        
        PID:13812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        7⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59592.exe
        7⤵
        
        PID:8204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37248.exe
        6⤵
        
        PID:5412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25890.exe
        7⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4732.exe
        7⤵
        
        PID:12516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        7⤵
        
        PID:15704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36288.exe
        6⤵
        
        PID:8208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2045.exe
        6⤵
        
        PID:13228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9607.exe
        6⤵
        
        PID:2440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38644.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
        6⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3741.exe
        7⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34332.exe
        7⤵
        
        PID:10816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29876.exe
        7⤵
        
        PID:14728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33438.exe
        7⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39371.exe
        7⤵
        
        PID:9188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64955.exe
        6⤵
        
        PID:7260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6506.exe
        6⤵
        
        PID:14216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23740.exe
        6⤵
        
        PID:16832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10527.exe
        5⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15802.exe
        6⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45327.exe
        7⤵
        
        PID:15312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8575.exe
        7⤵
        
        PID:17052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23834.exe
        6⤵
        
        PID:11096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37853.exe
        6⤵
        
        PID:15044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41990.exe
        6⤵
        
        PID:16956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47415.exe
        5⤵
        
        PID:8032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17639.exe
        5⤵
        
        PID:10900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30167.exe
        5⤵
        
        PID:15072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33855.exe
        5⤵
        
        PID:16964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55811.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50342.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7721.exe
        6⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        7⤵
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19362.exe
        8⤵
        
        PID:12260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60926.exe
        8⤵
        
        PID:15648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21312.exe
        7⤵
        
        PID:9732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15535.exe
        7⤵
        
        PID:13040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6795.exe
        7⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-476.exe
        7⤵
        
        PID:9184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
        6⤵
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-238.exe
        6⤵
        
        PID:11508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57393.exe
        6⤵
        
        PID:14964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59384.exe
        6⤵
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19288.exe
        6⤵
        
        PID:10884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
        5⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62236.exe
        6⤵
        
        PID:8300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47711.exe
        6⤵
        
        PID:10776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35767.exe
        6⤵
        
        PID:15684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9070.exe
        5⤵
        
        PID:8456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7115.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17007.exe
        5⤵
        
        PID:15996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52380.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52380.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33788.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe
        6⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21204.exe
        7⤵
        
        PID:8972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51795.exe
        7⤵
        
        PID:12300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        7⤵
        
        PID:15772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52485.exe
        6⤵
        
        PID:9136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17124.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40917.exe
        6⤵
        
        PID:16684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7420.exe
        5⤵
        
        PID:6700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16134.exe
        6⤵
        
        PID:9684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20274.exe
        6⤵
        
        PID:14260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61807.exe
        6⤵
        
        PID:5880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51036.exe
        5⤵
        
        PID:9380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47659.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53937.exe
        5⤵
        
        PID:16756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15816.exe
      4⤵
      PID:5652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39870.exe
        5⤵
        
        PID:9364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50538.exe
        5⤵
        
        PID:14156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6795.exe
        5⤵
        
        PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39371.exe
        5⤵
        
        PID:9140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47686.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47686.exe
      4⤵
      PID:8392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64285.exe
      4⤵
      PID:11328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34498.exe
      4⤵
      PID:15712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13035.exe
      4⤵
      PID:8956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3843.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3843.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62656.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4841.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30834.exe
        6⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        7⤵
        
        PID:6956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35021.exe
        8⤵
        
        PID:13716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26089.exe
        8⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13390.exe
        8⤵
        
        PID:9884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62842.exe
        7⤵
        
        PID:11156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42348.exe
        7⤵
        
        PID:15180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47331.exe
        7⤵
        
        PID:15460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49477.exe
        7⤵
        
        PID:9444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26199.exe
        6⤵
        
        PID:7628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38173.exe
        6⤵
        
        PID:9404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35820.exe
        6⤵
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8237.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5562.exe
        5⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        6⤵
        
        PID:6936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38116.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28250.exe
        7⤵
        
        PID:13472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43717.exe
        7⤵
        
        PID:16528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62842.exe
        6⤵
        
        PID:11148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42348.exe
        6⤵
        
        PID:15132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28856.exe
        6⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39171.exe
        6⤵
        
        PID:6884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26199.exe
        5⤵
        
        PID:7604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24331.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53334.exe
        6⤵
        
        PID:15848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38173.exe
        5⤵
        
        PID:9956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49793.exe
        5⤵
        
        PID:15816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
        5⤵
        
        PID:15764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4026.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64322.exe
        5⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58074.exe
        6⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25890.exe
        7⤵
        
        PID:8932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41410.exe
        7⤵
        
        PID:12236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
        7⤵
        
        PID:16616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31296.exe
        6⤵
        
        PID:8588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63995.exe
        6⤵
        
        PID:13172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48125.exe
        6⤵
        
        PID:16368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6307.exe
        6⤵
        
        PID:8700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50269.exe
        5⤵
        
        PID:6524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13637.exe
        6⤵
        
        PID:8912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41410.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45498.exe
        6⤵
        
        PID:1460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31409.exe
        5⤵
        
        PID:5252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8459.exe
        5⤵
        
        PID:13512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42039.exe
        5⤵
        
        PID:7300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50216.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50216.exe
      4⤵
      PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43430.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23062.exe
        6⤵
        
        PID:11520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29353.exe
        6⤵
        
        PID:14568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13182.exe
        6⤵
        
        PID:5484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19255.exe
        6⤵
        
        PID:9976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6730.exe
        5⤵
        
        PID:10364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26204.exe
        5⤵
        
        PID:13676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        5⤵
        
        PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-277.exe
        5⤵
        
        PID:8512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44317.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29507.exe
      4⤵
      PID:9940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19285.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25303.exe
      4⤵
      PID:1620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30082.exe
      4⤵
      PID:5780
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19616.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3061.exe
        5⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        6⤵
        
        PID:7164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57166.exe
        7⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28058.exe
        7⤵
        
        PID:13804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-930.exe
        7⤵
        
        PID:6484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21312.exe
        6⤵
        
        PID:9252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15535.exe
        6⤵
        
        PID:14308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2711.exe
        6⤵
        
        PID:5836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24440.exe
        6⤵
        
        PID:5532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
        5⤵
        
        PID:7564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20898.exe
        6⤵
        
        PID:12020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50594.exe
        6⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56369.exe
        6⤵
        
        PID:10840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20274.exe
        5⤵
        
        PID:10764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46703.exe
        5⤵
        
        PID:14960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37401.exe
        5⤵
        
        PID:16808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55609.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55609.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56782.exe
        5⤵
        
        PID:9736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
        5⤵
        
        PID:13076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31656.exe
        5⤵
        
        PID:4272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62234.exe
        5⤵
        
        PID:4204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21593.exe
      4⤵
      PID:9504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22458.exe
      4⤵
      PID:13820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49999.exe
      4⤵
      PID:6400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61349.exe
      4⤵
      PID:10028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49580.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21536.exe
      4⤵
      PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49460.exe
        5⤵
        
        PID:2772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41816.exe
        6⤵
        
        PID:9428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21260.exe
        6⤵
        
        PID:12852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-930.exe
        6⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60288.exe
        6⤵
        
        PID:9892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12952.exe
        5⤵
        
        PID:10296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24471.exe
        5⤵
        
        PID:13376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2711.exe
        5⤵
        
        PID:14224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39371.exe
        5⤵
        
        PID:8496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59911.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59911.exe
      4⤵
      PID:7832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32307.exe
      4⤵
      PID:9648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44486.exe
      4⤵
      PID:13912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53937.exe
      4⤵
      PID:16776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5582.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5582.exe
    3⤵
    PID:6048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48038.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48038.exe
      4⤵
      PID:9312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50538.exe
      4⤵
      PID:14140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
      4⤵
      PID:16656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48216.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48216.exe
    3⤵
    PID:8424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
    3⤵
    PID:11892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60387.exe
    3⤵
    PID:16336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2637.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2637.exe
    3⤵
    PID:2908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46676.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46676.exe
    3⤵
    PID:3648
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36620.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36620.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24774.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24774.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20280.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-819.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43544.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25790.exe
        7⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29486.exe
        8⤵
        
        PID:7036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56206.exe
        9⤵
        
        PID:9548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42178.exe
        9⤵
        
        PID:14324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
        9⤵
        
        PID:16540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52485.exe
        8⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1939.exe
        8⤵
        
        PID:12408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65534.exe
        8⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12219.exe
        7⤵
        
        PID:5752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40446.exe
        8⤵
        
        PID:9620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53933.exe
        8⤵
        
        PID:13060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46073.exe
        8⤵
        
        PID:14496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34414.exe
        8⤵
        
        PID:10180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13922.exe
        7⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38994.exe
        7⤵
        
        PID:13708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47131.exe
        7⤵
        
        PID:1972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13642.exe
        7⤵
        
        PID:10140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32806.exe
        6⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34172.exe
        7⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        8⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13165.exe
        9⤵
        
        PID:10908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63204.exe
        9⤵
        
        PID:14780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27572.exe
        9⤵
        
        PID:10232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60288.exe
        9⤵
        
        PID:9776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47955.exe
        8⤵
        
        PID:9424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15535.exe
        8⤵
        
        PID:6152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
        8⤵
        
        PID:16640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
        7⤵
        
        PID:7616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20898.exe
        8⤵
        
        PID:13128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe
        8⤵
        
        PID:16900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41350.exe
        7⤵
        
        PID:11220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37349.exe
        7⤵
        
        PID:15880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31743.exe
        7⤵
        
        PID:16332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63295.exe
        7⤵
        
        PID:9256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46944.exe
        6⤵
        
        PID:6892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31700.exe
        6⤵
        
        PID:9356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39524.exe
        6⤵
        
        PID:13728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20108.exe
        6⤵
        
        PID:5504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57959.exe
        6⤵
        
        PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34481.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37632.exe
        6⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45926.exe
        7⤵
        
        PID:7344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35698.exe
        8⤵
        
        PID:11984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9700.exe
        8⤵
        
        PID:16028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39874.exe
        7⤵
        
        PID:10740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48736.exe
        7⤵
        
        PID:16000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        7⤵
        
        PID:6944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41309.exe
        7⤵
        
        PID:8016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45032.exe
        6⤵
        
        PID:8560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48261.exe
        6⤵
        
        PID:11072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63693.exe
        6⤵
        
        PID:15748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57454.exe
        6⤵
        
        PID:9528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57425.exe
        5⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52724.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4348.exe
        6⤵
        
        PID:11932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23986.exe
        6⤵
        
        PID:16376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30911.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29403.exe
        5⤵
        
        PID:8236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64285.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54944.exe
        5⤵
        
        PID:15544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57959.exe
        5⤵
        
        PID:11112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47067.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47067.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59688.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32828.exe
        6⤵
        
        PID:2532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34172.exe
        7⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14047.exe
        8⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9636.exe
        8⤵
        
        PID:10924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11402.exe
        8⤵
        
        PID:14760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6795.exe
        8⤵
        
        PID:2492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47539.exe
        8⤵
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13616.exe
        7⤵
        
        PID:2056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44448.exe
        7⤵
        
        PID:12904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37401.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26069.exe
        6⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38770.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16743.exe
        7⤵
        
        PID:17104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6548.exe
        6⤵
        
        PID:8720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64676.exe
        6⤵
        
        PID:12440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39949.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41550.exe
        5⤵
        
        PID:4872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30472.exe
        6⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14047.exe
        7⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42308.exe
        7⤵
        
        PID:11036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37853.exe
        7⤵
        
        PID:15028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45498.exe
        7⤵
        
        PID:6460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13616.exe
        6⤵
        
        PID:7392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6506.exe
        6⤵
        
        PID:14236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60113.exe
        6⤵
        
        PID:1480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60808.exe
        6⤵
        
        PID:2328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60112.exe
        5⤵
        
        PID:6332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23944.exe
        6⤵
        
        PID:8900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6102.exe
        6⤵
        
        PID:11116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13208.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3303.exe
        6⤵
        
        PID:10476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6548.exe
        5⤵
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57461.exe
        5⤵
        
        PID:13520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33855.exe
        5⤵
        
        PID:16944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48104.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34774.exe
        5⤵
        
        PID:1348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64898.exe
        6⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45926.exe
        7⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44150.exe
        7⤵
        
        PID:10168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58466.exe
        7⤵
        
        PID:15868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4570.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19327.exe
        7⤵
        
        PID:8256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24306.exe
        6⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8954.exe
        7⤵
        
        PID:15372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44232.exe
        7⤵
        
        PID:16524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60294.exe
        6⤵
        
        PID:11972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63728.exe
        6⤵
        
        PID:15496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63667.exe
        6⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-277.exe
        6⤵
        
        PID:10276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45993.exe
        5⤵
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exe
        6⤵
        
        PID:7212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4348.exe
        6⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36343.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19759.exe
        5⤵
        
        PID:8460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20898.exe
        6⤵
        
        PID:13244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47470.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46849.exe
        5⤵
        
        PID:14244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54918.exe
        5⤵
        
        PID:15628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4675.exe
        5⤵
        
        PID:8432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42677.exe
      4⤵
      PID:2796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14135.exe
        5⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34468.exe
        6⤵
        
        PID:7524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47208.exe
        7⤵
        
        PID:9844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1800.exe
        7⤵
        
        PID:14296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-930.exe
        7⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43952.exe
        7⤵
        
        PID:9384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28494.exe
        6⤵
        
        PID:11208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50681.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50681.exe
        6⤵
        
        PID:15252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33438.exe
        6⤵
        
        PID:16024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10590.exe
        6⤵
        
        PID:9996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36672.exe
        5⤵
        
        PID:8860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60513.exe
        5⤵
        
        PID:12472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6900.exe
        5⤵
        
        PID:15944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56928.exe
      4⤵
      PID:6036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56808.exe
        5⤵
        
        PID:8152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4348.exe
        5⤵
        
        PID:11864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23986.exe
        5⤵
        
        PID:16344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43744.exe
        5⤵
        
        PID:6732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4560.exe
        5⤵
        
        PID:9028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-424.exe
      4⤵
      PID:8380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37604.exe
      4⤵
      PID:10712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54269.exe
      4⤵
      PID:4892
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-819.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43544.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44504.exe
        6⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58292.exe
        7⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        8⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33024.exe
        8⤵
        
        PID:9856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3283.exe
        8⤵
        
        PID:14272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12464.exe
        7⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32307.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44486.exe
        7⤵
        
        PID:14536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23210.exe
        7⤵
        
        PID:16820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52136.exe
        6⤵
        
        PID:6840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21396.exe
        7⤵
        
        PID:9332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62293.exe
        7⤵
        
        PID:12912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43717.exe
        7⤵
        
        PID:16584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11287.exe
        6⤵
        
        PID:9604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22458.exe
        6⤵
        
        PID:13768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10720.exe
        6⤵
        
        PID:16788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63533.exe
        5⤵
        
        PID:3896
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 636
        6⤵
        Program crash
        
        PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59728.exe
        5⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56616.exe
        6⤵
        
        PID:8880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40912.exe
        6⤵
        
        PID:10692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13208.exe
        6⤵
        
        PID:15532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38069.exe
        5⤵
        
        PID:8248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16430.exe
        6⤵
        
        PID:12000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26089.exe
        6⤵
        
        PID:13980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15283.exe
        5⤵
        
        PID:11528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21218.exe
        5⤵
        
        PID:5580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10010.exe
        5⤵
        
        PID:8704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19594.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1525.exe
        5⤵
        Executes dropped EXE
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62952.exe
        6⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63248.exe
        7⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54177.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42562.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33438.exe
        7⤵
        
        PID:2840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10590.exe
        7⤵
        
        PID:10008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44535.exe
        6⤵
        
        PID:4796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38338.exe
        6⤵
        
        PID:10416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59452.exe
        6⤵
        
        PID:14896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40917.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60880.exe
        5⤵
        
        PID:6044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62236.exe
        6⤵
        
        PID:8272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47711.exe
        6⤵
        
        PID:10808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        6⤵
        
        PID:404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51857.exe
        5⤵
        
        PID:9224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30249.exe
        5⤵
        
        PID:12756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47157.exe
        5⤵
        
        PID:15780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18110.exe
        5⤵
        
        PID:11676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3563.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3563.exe
      4⤵
      PID:2412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34172.exe
        5⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36606.exe
        6⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42308.exe
        6⤵
        
        PID:11028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37853.exe
        6⤵
        
        PID:15052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33438.exe
        6⤵
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4560.exe
        6⤵
        
        PID:9152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40258.exe
        5⤵
        
        PID:7792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6506.exe
        5⤵
        
        PID:14228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60113.exe
        5⤵
        
        PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30622.exe
        5⤵
        
        PID:9044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26507.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56616.exe
        5⤵
        
        PID:8524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47632.exe
        5⤵
        
        PID:12480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6795.exe
        5⤵
        
        PID:6592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42232.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42232.exe
      4⤵
      PID:8580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23060.exe
      4⤵
      PID:10552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7430.exe
      4⤵
      PID:15852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60802.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60802.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59688.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63554.exe
        5⤵
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64898.exe
        6⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31178.exe
        7⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7005.exe
        8⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2786.exe
        8⤵
        
        PID:12972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41963.exe
        8⤵
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56012.exe
        8⤵
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61805.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41794.exe
        7⤵
        
        PID:13780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4657.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57653.exe
        7⤵
        
        PID:10640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
        6⤵
        
        PID:7676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41350.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9376.exe
        6⤵
        
        PID:13996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60880.exe
        5⤵
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34250.exe
        6⤵
        
        PID:4580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4348.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23986.exe
        6⤵
        
        PID:16352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
        6⤵
        
        PID:16664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39221.exe
        5⤵
        
        PID:9060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7307.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23421.exe
        5⤵
        
        PID:1152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56621.exe
        5⤵
        
        PID:10352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60025.exe
      4⤵
      PID:3276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34172.exe
        5⤵
        
        PID:6128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36606.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52060.exe
        7⤵
        
        PID:10948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48814.exe
        7⤵
        
        PID:14812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39825.exe
        7⤵
        
        PID:4496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47844.exe
        7⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50477.exe
        6⤵
        
        PID:11080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37853.exe
        6⤵
        
        PID:15036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33438.exe
        6⤵
        
        PID:6516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13616.exe
        5⤵
        
        PID:2680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50015.exe
        5⤵
        
        PID:10984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63999.exe
        5⤵
        
        PID:15960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24381.exe
        5⤵
        
        PID:16676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1208.exe
      4⤵
      PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42008.exe
        5⤵
        
        PID:7664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15230.exe
        5⤵
        
        PID:12712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        5⤵
        
        PID:15720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43192.exe
      4⤵
      PID:9112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13714.exe
      4⤵
      PID:12748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64223.exe
      4⤵
      PID:15800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53969.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53969.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5016
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34774.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34774.exe
      4⤵
      PID:1188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58821.exe
        5⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37732.exe
        6⤵
        
        PID:9508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2786.exe
        6⤵
        
        PID:12964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43333.exe
        6⤵
        
        PID:5868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47746.exe
        5⤵
        
        PID:7884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8459.exe
        5⤵
        
        PID:13528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37401.exe
        5⤵
        
        PID:16852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31410.exe
      4⤵
      PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46502.exe
        5⤵
        
        PID:8836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6102.exe
        5⤵
        
        PID:2740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        5⤵
        
        PID:15808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9070.exe
      4⤵
      PID:8244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7115.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7115.exe
      4⤵
      PID:12648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55326.exe
      4⤵
      PID:15620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34011.exe
    3⤵
    PID:3116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11997.exe
      4⤵
      PID:5696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54260.exe
        5⤵
        
        PID:8872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19314.exe
        5⤵
        
        PID:13308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28366.exe
        5⤵
        
        PID:16348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22552.exe
      4⤵
      PID:8216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
        5⤵
        
        PID:14492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52758.exe
        5⤵
        
        PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63995.exe
      4⤵
      PID:13164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39957.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39957.exe
      4⤵
      PID:16340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37033.exe
      4⤵
      PID:3476
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13558.exe
    3⤵
    PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56616.exe
      4⤵
      PID:8676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24576.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24576.exe
      4⤵
      PID:968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40427.exe
      4⤵
      PID:15832
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48216.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48216.exe
    3⤵
    PID:8416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59819.exe
    3⤵
    PID:11912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65240.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65240.exe
    3⤵
    PID:16368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53783.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53783.exe
    3⤵
    PID:5884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38508.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38508.exe
    3⤵
    PID:9180
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61622.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61622.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24364.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24364.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19678.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39652.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49548.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57690.exe
        7⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56616.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6102.exe
        8⤵
        
        PID:10328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        8⤵
        
        PID:15692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36744.exe
        8⤵
        
        PID:8672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36750.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39874.exe
        7⤵
        
        PID:10696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48736.exe
        7⤵
        
        PID:16008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36832.exe
        7⤵
        
        PID:6872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2223.exe
        7⤵
        
        PID:824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46377.exe
        6⤵
        
        PID:6308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13829.exe
        7⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4348.exe
        7⤵
        
        PID:11940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23986.exe
        7⤵
        
        PID:16312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45498.exe
        7⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18758.exe
        7⤵
        
        PID:10452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45032.exe
        6⤵
        
        PID:8568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52199.exe
        6⤵
        
        PID:13592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25303.exe
        6⤵
        
        PID:14184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32568.exe
        6⤵
        
        PID:10184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38924.exe
        5⤵
        
        PID:5128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54888.exe
        6⤵
        
        PID:7556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38308.exe
        7⤵
        
        PID:9848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18136.exe
        7⤵
        
        PID:12840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-930.exe
        7⤵
        
        PID:6772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7306.exe
        6⤵
        
        PID:10460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22141.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33438.exe
        6⤵
        
        PID:14892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22842.exe
        6⤵
        
        PID:10956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33217.exe
        5⤵
        
        PID:7420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20161.exe
        5⤵
        
        PID:11680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30551.exe
        5⤵
        
        PID:15440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7430.exe
        5⤵
        
        PID:4368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4026.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39242.exe
        5⤵
        
        PID:5164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58821.exe
        6⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32906.exe
        7⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12079.exe
        7⤵
        
        PID:11456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20365.exe
        7⤵
        
        PID:14168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33324.exe
        7⤵
        
        PID:16976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23459.exe
        6⤵
        
        PID:7184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41350.exe
        6⤵
        
        PID:10316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36019.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6906.exe
        5⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62428.exe
        6⤵
        
        PID:9244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19314.exe
        6⤵
        
        PID:12768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6384.exe
        6⤵
        
        PID:1236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19255.exe
        6⤵
        
        PID:10020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45032.exe
        5⤵
        
        PID:8548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23949.exe
        5⤵
        
        PID:11920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21186.exe
        5⤵
        
        PID:16324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14459.exe
        5⤵
        
        PID:1804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23372.exe
        5⤵
        
        PID:10744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6853.exe
      4⤵
      PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33570.exe
        5⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1388.exe
        6⤵
        
        PID:15292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52758.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21558.exe
        6⤵
        
        PID:8008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14087.exe
        5⤵
        
        PID:9616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47659.exe
        5⤵
        
        PID:13848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24772.exe
        5⤵
        
        PID:6440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6307.exe
        5⤵
        
        PID:10128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27021.exe
      4⤵
      PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46938.exe
        5⤵
        
        PID:13704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1585.exe
        5⤵
        
        PID:6752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25642.exe
        5⤵
        
        PID:7464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48236.exe
      4⤵
      PID:9268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22458.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22458.exe
      4⤵
      PID:13740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37363.exe
      4⤵
      PID:16296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55126.exe
      4⤵
      PID:9124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46875.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46875.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4841.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22906.exe
        5⤵
        
        PID:3224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26964.exe
        6⤵
        
        PID:1492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62236.exe
        7⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40040.exe
        7⤵
        
        PID:11900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33438.exe
        7⤵
        
        PID:8876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10590.exe
        7⤵
        
        PID:9048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22552.exe
        6⤵
        
        PID:8228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61062.exe
        6⤵
        
        PID:11656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53361.exe
        6⤵
        
        PID:1352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6307.exe
        6⤵
        
        PID:9936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6906.exe
        5⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1385.exe
        6⤵
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19671.exe
        7⤵
        
        PID:14704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13837.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27370.exe
        7⤵
        
        PID:6972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37326.exe
        6⤵
        
        PID:12896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
        6⤵
        
        PID:16592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50486.exe
        5⤵
        
        PID:8408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24603.exe
        5⤵
        
        PID:13208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2806.exe
        5⤵
        
        PID:14484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41447.exe
        5⤵
        
        PID:16624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54763.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39346.exe
        5⤵
        
        PID:7152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39870.exe
        6⤵
        
        PID:9344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50538.exe
        6⤵
        
        PID:14132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31876.exe
        6⤵
        
        PID:16844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4244.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15535.exe
        5⤵
        
        PID:13144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33438.exe
        5⤵
        
        PID:13988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53569.exe
        5⤵
        
        PID:10972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34367.exe
      4⤵
      PID:7648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38173.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38173.exe
      4⤵
      PID:11288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11700.exe
      4⤵
      PID:2540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55326.exe
      4⤵
      PID:15632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17761.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25188.exe
      4⤵
      PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22216.exe
        5⤵
        
        PID:7468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20898.exe
        6⤵
        
        PID:13108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16743.exe
        6⤵
        
        PID:17076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-595.exe
        5⤵
        
        PID:12168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29302.exe
        5⤵
        
        PID:15792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63693.exe
        5⤵
        
        PID:4724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27351.exe
      4⤵
      PID:5208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32335.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32335.exe
      4⤵
      PID:11556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8192.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8192.exe
      4⤵
      PID:15420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55326.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55326.exe
      4⤵
      PID:15444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62267.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62267.exe
      4⤵
      PID:8360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17186.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17186.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52428.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52428.exe
      4⤵
      PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56206.exe
        5⤵
        
        PID:9396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21260.exe
        5⤵
        
        PID:12844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43717.exe
        5⤵
        
        PID:16608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40808.exe
      4⤵
      PID:10060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5229.exe
      4⤵
      PID:10680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49582.exe
      4⤵
      PID:16504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57442.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57442.exe
    3⤵
    PID:4584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17533.exe
      4⤵
      PID:14900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51746.exe
      4⤵
      PID:8144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19796.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19796.exe
    3⤵
    PID:9572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13265.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13265.exe
    3⤵
    PID:13044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54918.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54918.exe
    3⤵
    PID:15672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35401.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35401.exe
    3⤵
    PID:10608
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9708.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9708.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58572.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58572.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23892.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17068.exe
        5⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46953.exe
        6⤵
        
        PID:3692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45646.exe
        7⤵
        
        PID:10436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8406.exe
        7⤵
        
        PID:14504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43717.exe
        7⤵
        
        PID:16548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54544.exe
        6⤵
        
        PID:10052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29569.exe
        6⤵
        
        PID:11784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10190.exe
        6⤵
        
        PID:16800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35878.exe
        5⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60866.exe
        6⤵
        
        PID:9748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16089.exe
        6⤵
        
        PID:15352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12529.exe
        6⤵
        
        PID:9840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-683.exe
        5⤵
        
        PID:8780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8459.exe
        5⤵
        
        PID:13536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43047.exe
        5⤵
        
        PID:5544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1006.exe
        5⤵
        
        PID:9452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22858.exe
      4⤵
      PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56616.exe
        5⤵
        
        PID:8844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41410.exe
        5⤵
        
        PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33438.exe
        5⤵
        
        PID:15912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10590.exe
        5⤵
        
        PID:220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36288.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36288.exe
      4⤵
      PID:3720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52199.exe
      4⤵
      PID:13488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41447.exe
      4⤵
      PID:16516
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63341.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63341.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37632.exe
      4⤵
      PID:5336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13829.exe
        5⤵
        
        PID:7380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32936.exe
        5⤵
        
        PID:11992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6795.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4560.exe
        5⤵
        
        PID:9032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42894.exe
      4⤵
      PID:8752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17534.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17534.exe
      4⤵
      PID:3944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63693.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63693.exe
      4⤵
      PID:15756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62498.exe
      4⤵
      PID:8948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28617.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28617.exe
    3⤵
    PID:5156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48858.exe
      4⤵
      PID:7708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44224.exe
        5⤵
        
        PID:13548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8575.exe
        5⤵
        
        PID:17036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56699.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56699.exe
      4⤵
      PID:10988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51092.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51092.exe
      4⤵
      PID:13788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53937.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53937.exe
      4⤵
      PID:16868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59859.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59859.exe
    3⤵
    PID:7784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11609.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11609.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30167.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30167.exe
    3⤵
    PID:15124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56029.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56029.exe
    3⤵
    PID:15736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28484.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28484.exe
    3⤵
    PID:10136
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57810.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57810.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58702.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58702.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40076.exe
      4⤵
      PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62428.exe
        5⤵
        
        PID:9292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62293.exe
        5⤵
        
        PID:12812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47225.exe
        5⤵
        
        PID:884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36891.exe
      4⤵
      PID:9096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51848.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51848.exe
      4⤵
      PID:9376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64070.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64070.exe
      4⤵
      PID:2356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4680.exe
      4⤵
      PID:10736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58655.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58655.exe
    3⤵
    PID:5404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19948.exe
      4⤵
      PID:6056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54094.exe
        5⤵
        
        PID:7872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44150.exe
        5⤵
        
        PID:10556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17433.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39957.exe
        5⤵
        
        PID:2144
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4654.exe
      4⤵
      PID:8600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42396.exe
      4⤵
      PID:11200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6821.exe
      4⤵
      PID:15700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21155.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21155.exe
    3⤵
    PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7135.exe
      4⤵
      PID:10768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49006.exe
      4⤵
      PID:14612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39633.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39633.exe
      4⤵
      PID:6376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39676.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39676.exe
      4⤵
      PID:10480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48733.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48733.exe
    3⤵
    PID:9416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21287.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21287.exe
    3⤵
    PID:13692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55300.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55300.exe
    3⤵
    PID:16316
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31098.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31098.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58484.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58484.exe
    3⤵
    PID:5568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21126.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48448.exe
        5⤵
        
        PID:8724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28660.exe
        5⤵
        
        PID:12320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37713.exe
        5⤵
        
        PID:15424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44720.exe
        5⤵
        
        PID:11644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59885.exe
      4⤵
      PID:8784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42396.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42396.exe
      4⤵
      PID:11164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23734.exe
      4⤵
      PID:4352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49283.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49283.exe
    3⤵
    PID:7084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58178.exe
      4⤵
      PID:7352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44150.exe
      4⤵
      PID:10344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62550.exe
      4⤵
      PID:15900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29842.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29842.exe
      4⤵
      PID:2076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18389.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18389.exe
    3⤵
    PID:8648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52199.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52199.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:13628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41447.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41447.exe
    3⤵
    PID:16700
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48714.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48714.exe
  2⤵
  PID:5388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36606.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36606.exe
    3⤵
    PID:7424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46393.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46393.exe
    3⤵
    PID:11000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62549.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62549.exe
    3⤵
    PID:14820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14963.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14963.exe
    3⤵
    PID:2124
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3551.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3551.exe
  2⤵
  PID:7488
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16000.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16000.exe
  2⤵
  PID:10324
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24567.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24567.exe
  2⤵
  PID:15064
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63188.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63188.exe
  2⤵
  PID:16920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3896 -ip 3896
1⤵
PID:5532

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5644 -ip 5644
1⤵
PID:6856

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1203.exe

Filesize
468KB

MD5
0459800d8b6576b753eebc76195f8d7e

SHA1
92cbba9b94c3549c2e4e99be087192722c17bb79

SHA256
bd72064a6b15888ab1d405efe50f7ee537bb6c280496a45adab6f793d01e1a56

SHA512
2aa196a20a6824eae0c9be728ad4a321a601306407a82751ead773aeaaedab06b11b7abc069f51541fab1418c2c26959f949c01c8b08906dadb95da56dd74931

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15593.exe

Filesize
468KB

MD5
362c3590bdb1011713435775fabcae57

SHA1
f42925b15b961368803b53764e6684d7dfc9b527

SHA256
308995db8dce8861fc53c734b4f52ac5573256ec20ce555469001bd66090b0ae

SHA512
a8bf290cfa1a7bf8e364f5b3cd741c0c5eafc223428deeba11e26fca7b0320db32d6b1d65bc4e13872dd73433ad7368eb8e1fb0af70b8755ba4af0d8bab30ce2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19594.exe

Filesize
468KB

MD5
d2e6e5543455aab412f5b68580cafec1

SHA1
3da3d0183fdae8daabd5b485e7a45fd91847f9cc

SHA256
23d4b341ef732a4f616c5fac0d7e3e629ff10f015847562fb4999ca7a5717bda

SHA512
aa4799dff574fcb75cd2df8a0b8eca4d985b22679efc4e31a612ed38b9684ca7c65f0b5a0810dd875e5b26108fa5da76dc4f5b2f85ef84ec04edc6edbc65d961

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19678.exe

Filesize
468KB

MD5
0132d04bdd9386e25cfda1eefaae0fc9

SHA1
8d6240231492aa822452d027c8e1c1fa69c62c50

SHA256
e21bb4df27d79e3b136ddaf48b51896427939d6b9326086ff6866237b985aa04

SHA512
a185ccf3fc59d39788ca73bd8aaa7d6c679a230b05708872a3d7250532aa438c86fd859300e87b50a766665520a4ce9a96317e530a2690026372ce72d7aa4c52

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20280.exe

Filesize
468KB

MD5
f90b08355816078dd8a76d63dd19ef03

SHA1
b0651513b7792e008a57c0a6edeb1412e9f4ec09

SHA256
12676ef00549fc15f64e05a1401c0df4aa40fea5d3b5078571203d1004a03a0e

SHA512
fc0d2f8e405878a75d64ce257949f5dce43d26f8b04ccfcfb23f37f2f9d9f061075a26ddf632d08f66e6b100e55f9d3da7f34d1583de9ff9760061acece9a64a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24364.exe

Filesize
468KB

MD5
1273b5e18da7ab2bbe7eb15fc3d4f851

SHA1
a15f00935e9ea3733547e9571ca9f2deccd770b5

SHA256
ef8b1fbce46231580a7db0867223d2251a37b7be06a729bafda61f77d38831a8

SHA512
b7c8f2b76f0277ca2899f1684d192e355ba27d51d108fccf90779f24a3ef1ea1d314bd839ad9346f4970bfef64359241d1f7a0ccd4d1e8186495edd285a62648

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24774.exe

Filesize
468KB

MD5
94a881450bbbba6bd63c0e03ce2ae940

SHA1
2ce4fd12acb4513eb6975111c4fb271ffb869040

SHA256
7ed2935434a60b13be20ce088231c98ca388c4ef028dd533a716d3fc445b1db9

SHA512
28eebc2bd81a82cfbcc63f778032770f9df685e2a49f91b7ae088167647dc5775590f0fc4b27420eeea816d5fc9fb6beb4ebdaa1721bc3cd7a78ced354e1939c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34264.exe

Filesize
468KB

MD5
f51f3f6bebbf7e73ca4a0e9b2519f6b4

SHA1
3dd825ba9b05f44b5c482807b3970ef3314454b1

SHA256
cafa6ac4a080002078e0707edb4e83f88af178c69cdac6dff6f9ffe33e01406f

SHA512
4d04f6ea613cfe72717ce673033dd2aa369d38ae7f0d56a152ba0157ca24b354f40f904d2a46e8301be4ef78f187d216c5db5f171ed684cf4cc2e1f5b507afe3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36014.exe

Filesize
468KB

MD5
3762cf49eff45cc5a34c8aa53f7efef3

SHA1
b44dd3c7e29b723251dc082b06b74efb52948343

SHA256
876e24c153d0d49789c4d3822b4c4602de5af17d2629d8aa021e569e6aee1a27

SHA512
22d363b07c4df9ad49af5dce7d6c4259d82d7d034247d5ed06d71d78e98011e08d8843255e22e4d7d944509f7ca895b9a039e2913f9ac418a4040ef6e22f58c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36620.exe

Filesize
468KB

MD5
0662a28d63802ec918a1396935d196f4

SHA1
7260995527f8b0e95b9d41ff8d1b4e9a12b33c75

SHA256
dd1e4b8a9921dd5b91f6af62b7c895812caea51a5b9a488a026bff1917ab8657

SHA512
bcc6231e4e4b35dd8caa0c3eafb409cd6d767aa38c5799d1b8ddce6f3e512cde6e300f3acdc342b31f9997c9c1b0ac73fc749beae29cd3c81988192a5154d6fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3843.exe

Filesize
468KB

MD5
939a3e41a5909550937e945ad92b609c

SHA1
534d125b37342be3f5041939d16314f52828042a

SHA256
b35d57393b8d62c9b91fc66b40c0036ab2383c6be809409f9fe1f7453f565538

SHA512
19f556a88ed0c48fd0b01cc29eb8b676594dae4c42de189a55a108e0d58e3f13426c5a6ccdc40e2ffeaae905dadea8a03504d143ee36d33fefc3ebaf86a27c1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43082.exe

Filesize
468KB

MD5
40de45ea2085672c923e3924f39a19fe

SHA1
b2bb8ec236cd7cab0c29cd02b70b87f6855430a1

SHA256
8f9faf1e3a74c39f0e4b1ade793c1620c7933b7d3b2a1d2f0e5d3755b42843f5

SHA512
11f8f59f67f8fca36b63ffb6c0a2e71be0f701b679e26464faecb439ea2cb705fb91a50449a5918c1ee1c0a7767016105060b7e8018f260138b8eb18d36788be

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43544.exe

Filesize
468KB

MD5
c9936cc7ad784d319652c0770053cdf3

SHA1
10fa19aa86fb40ec20e99d86e1815ac813a635ee

SHA256
bcf6bcd1fc9183439eb46dc79894094bef3aa96cb73a8ebec48ad2e540e38b89

SHA512
3e8bb77e8c4bbf3682fbe141cb769d8eb673a3e5ceb17444aa1f1c32ab54d7b4a3e0838917f2aa26226a2dcb9ee117d27103b76f16330fe88b4cc74b9494238c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46875.exe

Filesize
468KB

MD5
17b45876905539c034d681d4927f2228

SHA1
812ab0fd26f1056feb9e2cff1caffc21159452b4

SHA256
4ca94f33720ca1f5c005db0288b86bded9441cb556a28c7943cf5ba0a5ca7ed7

SHA512
f303aca2a29758aa7e7ac40115abfc1cef48fbb5c8a387fac5055edb3d178bf909857ae67d890e880965bd97f9963cfc489e360df299a637329a181541c70da3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47067.exe

Filesize
468KB

MD5
4ba75f592e73647b2acd4a739493c637

SHA1
9201fa558d3cb6e1c17471db54b4d4d4ceaafa22

SHA256
ecdbb01c2691ef30f66b5fbe075427c669b724079b98f805bd51c5ec06c3c49b

SHA512
67018e564d80b57d7236209561d307581c7cc581c92fa837fd8b0069a3843e2e867d34dfe7612a50eecb2ccc1944563a3a819800c5d4f7b7f8dc25f41443d8e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54130.exe

Filesize
468KB

MD5
afbf11b81639943a4d26aa64a2e74576

SHA1
712e08e8a35437a3794f68399a710bdec2feabd8

SHA256
b0ba8c46fe996033939068662b6cd5c9e8976e235d3c3a08dcdd07a0e5be10d5

SHA512
e3c25cc1618a5e7127daa628d54da330ff8f05d37c2ca28fe668cd8567219a1a100a4e6b472ed3266faaac96c190a554833cf5ffba023975accf5579bdec69e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55645.exe

Filesize
468KB

MD5
865fc90af92b61bb295a7c1b8470d894

SHA1
3c51fa53a9564be49d265988426b71fc78aa27b8

SHA256
f28985c1fdacfeb08982a5183b16df8feedca74743c352450ec0315194f8b580

SHA512
5077abd2ab450265d9ca78bfe70b91f60a7aa13e5afea173fed82dfe403bb0d07641157203c6d9f69dd804a79282bcf0cc1c4deb8bdf4c5d86e0208975c5f4a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55811.exe

Filesize
468KB

MD5
5ab121f23a6365be72ae29471554a88b

SHA1
886b67b7abc187df3cc787b1c24370437d4ae9e4

SHA256
e8befd9d173650ed80ab6f3f6edb69a4ac1c6b130a32f6c08cc1f8fb44c60751

SHA512
8d47a8d05f0698cebf987a77995eed06dc85bc911a454218cc4ae05c9362c91484d0a6ca3de5ddbb9016b7ed7b9cd992491439eb52c0eab5a7e00b6089dcdcae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56486.exe

Filesize
468KB

MD5
fb72e59d4d116ab76301fdfe0b087136

SHA1
5668eb58f4c727b7b647812e0af1ffa9834c5946

SHA256
1935c6dd656f3e89c3d135e51bf434aa3345d9b2bf5ea33535c9e967e5b3afcb

SHA512
ae0a466f2c33f969621fb8bb60ce24b7ff4b1ec21375c77316dfd6eecd60ceddda6425fdc9704e1f5c1fd2b790082bd0048c38e649a56cbcc5242402d9d1d25e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57810.exe

Filesize
468KB

MD5
3b289cc62481abca68edc234122a707d

SHA1
0e15e99ad54c00f7326fc939a62836c618cb5ffa

SHA256
6ceac18a28fca646b08429ef695b3c2a9efa1cef1d742b2f358d3f904e31088f

SHA512
a6e4c86519713ac0f0c807d48ab55ffe0e002a3a16ceb8d2d2c6d85fd2157198992b842ca8cb637d5573a3ceea66fc4874897af5783722f280282ad0fdb0f41f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58572.exe

Filesize
468KB

MD5
047e380b3380208764bdeec1cd1a7af8

SHA1
937e2d1b0e9efec3ee4d77538a4379a0d926fcab

SHA256
8eaa2bd209b3242489faf4532d9843fc58a0c3a60347787010b87aeb0e19105d

SHA512
7c1bab2b6a6773bb0a319eaadcdc137e021eaaeb83bc216895b9525b85dcdcf99db65dc96eed71987ebe81fb229ba5ed0f10787359e10116fc59c351279bea47

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60802.exe

Filesize
468KB

MD5
344689d29428279e16d2eb8a790cb53f

SHA1
56344ace70287aeb37bfb33696f83e77095bb442

SHA256
71ca2fb03598d9d33b49f8ff53790675edc9eb80efe5e1125969614b66220d61

SHA512
ced975d9bd6bcf41f2dd08de4640fc708e395a80e5fc713724f0a92052e26d0ea9d73221aaa648522dd3f932d1ee2c31e9b126052ca4311561142fca4742d329

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61622.exe

Filesize
468KB

MD5
3aa166452a02f98f191d03cf1959bf65

SHA1
2201771748c2026f89c7c9c8957bdf1e190c1464

SHA256
4b5fa5c223ad30da1238d3a922f37b563da0dc483bc852592340bf0164991a97

SHA512
2c8cb2c0006ad97de8d8e9083802a3de9ab5d5b7732ec3e97ed81bdb9ffd74c37a206df4153b4b406d060b14fdde64a0794287c4b9e1c179416fe18634f41967

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62656.exe

Filesize
468KB

MD5
b2755c004df53f499ea292a3f1b3b328

SHA1
4c8797c674f9c19ac3c253e0b312152230846b0f

SHA256
43037ceda92705e29aa0a141dd6f1821221a2186b21eebac24e4f0f1bcfe047e

SHA512
d7e9475b3be828b7a702c6fc13692032785a8acd2a5a23f6730f2ebee6720d08cdcb7333e82f728e6ca88ac8d665972713f5c456912af580bff8e7630faa261e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65349.exe

Filesize
468KB

MD5
daa25d0a77ebcd8a3fb5bba281864a0b

SHA1
f29f5a6dbbe4e0398f501d2cc3dd0eb713d78f21

SHA256
64242727dc4adb45631c649c8fd6a1b19ff6796b836a518d6d36d6400e1ad108

SHA512
a61e3cbd6c651cb00ff5f1cce4bd369f9790e2e6baff41a1e911cf0b4434cd61e6e0a7425d1db444b4da2bf2fb8207d9578236db05618d8e00dcf21f8c23ed26

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8093.exe

Filesize
468KB

MD5
a872492cc957ef6b1be56a9c5e6bd0a8

SHA1
47e0531a0d401310226bedba5cdc4dca1ddba497

SHA256
c08b0269e5bd93094cf66edd718dd55605c6c8e2221eb2670bb03d2334604507

SHA512
3e23b5c7d7c293545f829ee81f573afff6cff42d98c2dac1154e320e2be2b9a01b293e763b6023f9e8f03a59347f7174ec66844c252f9d2f880515c2617e214c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-819.exe

Filesize
468KB

MD5
746c1b530f7538dcb03bea7947a73e7b

SHA1
7e8bd1667e958cceda6ee438d93cbc0c1a39444f

SHA256
c3b1da02e37ae1375070916acc5384e67927f5540491626f040a041a2ccd2034

SHA512
e9e0597fb5773e300c4a0f47b5127f69ba529f0cf7aad7a4be7d2b0577f21a5f5094a730b5b717e9590d550fff6a0335c8e222b58a33d82c5cd9a92ebecf4529

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8582.exe

Filesize
468KB

MD5
f3ab4223a390ab2ac34f703b47f11735

SHA1
0dcc42282b8628f4d9a30cf80fea0d0778a3acdc

SHA256
728c179929abe8c6269daed80edaabbcccfb95043f3ae80d0aa4377d1589f7ab

SHA512
8d2954e92295b7549057a42fb593d7bf0c6f471b9cd3abfa4eca26775543862fb6159e3e838d479d6c026c8fa0a3831e740dd7b3c65f4eb3e572dcfae651e772

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe

Filesize
468KB

MD5
19a14abfd10b043b8e3020e32786a48a

SHA1
b9955e022cfafd43bc829676b40b046cd3cbbc92

SHA256
26d588695e1bc39cb1b12bc52a3d758cc2058468e4d209f312be5a0460780216

SHA512
36f2e28774fffed3a46703e166670fa3f4cd2ad4389d7b39e8f2775cf54c61ccbaf88f8d400f4ed509f7a68e6cf1944b836263ea41c3c13aff213d3b1bae4de1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9708.exe

Filesize
468KB

MD5
79bf0863ca1d6656978fa6ddb53b6f64

SHA1
c24b9c41a12780c3f8fb4c7dd6748ed00a84ffef

SHA256
7a3621b2d94ab378009185f568a85da1b4144a440233449cc7fbbe6ab3722429

SHA512
d1b2f648fd44228144af80982b1563de6e50a3e0bad826e51813788c08d63cbb13d7643319c833598ddcd97514449d6248f1c20d0f33da49a64127b4c1c9d20f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9973.exe

Filesize
468KB

MD5
7741238717bfe4937bf8fc84f0051da9

SHA1
d171b3a9f62033eba378127a775461a83023796e

SHA256
537b032a1ccd5d17f7453d32265b188a90b6461ba1c5864779eb2be2f61d41af

SHA512
867ede2094779952b6f60176b6038c6598c9e47b85f8cdabbc369c058139b61bcc4ec35fd38d595661b5c92d4834b988da346cca26cec9dc4deef70f3d3b1785

Download Submit
memory/228-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/376-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/424-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/460-87-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/936-68-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1064-193-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1140-90-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1312-159-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1316-121-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1348-416-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1384-44-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1472-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1560-230-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1644-281-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1652-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1684-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1712-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1748-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1980-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2152-203-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2240-189-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2264-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2288-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2300-141-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2336-197-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2392-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2500-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2532-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2688-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2796-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2828-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2932-33-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2984-143-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3116-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3124-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3212-329-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3224-442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3228-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3244-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3252-436-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3276-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3356-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3436-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3456-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3532-289-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3560-202-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3584-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3628-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3660-437-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3784-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3896-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3900-192-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3960-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4016-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4032-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4316-155-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4320-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4332-130-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4336-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4360-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4424-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4460-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4628-221-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4676-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4692-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4784-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4820-28-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4872-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4880-61-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4992-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5016-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5164-439-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5264-711-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5276-713-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5284-722-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5296-723-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5308-725-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5396-744-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5404-745-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5416-738-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5444-743-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5568-746-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5588-748-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5600-760-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5620-761-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5636-762-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5644-763-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5680-764-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5688-765-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5700-750-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5708-768-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5716-775-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5724-787-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5732-786-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5740-767-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5760-766-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/8356-3274-0x00007FFDD9AD0000-0x00007FFDD9B29000-memory.dmp

Filesize
356KB

Download
memory/8360-3303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/8704-3308-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/10480-3306-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/10580-3283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/11644-3341-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15440-2494-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15868-2543-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15880-2544-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads