101beceb9ce5884e0a92dc1f4275c4c362f632d461d47dc4fdcc01a26ce413a0

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

969b60d72dcaffae7e02c171439bf670N.exe
Size

468KB
MD5

969b60d72dcaffae7e02c171439bf670
SHA1

443725b88303b320f6b77fbbf08507e057b9c865
SHA256

101beceb9ce5884e0a92dc1f4275c4c362f632d461d47dc4fdcc01a26ce413a0
SHA512

53d5c5a08823af99b435da1ac2e81ae664be28fdf59b8073afa045540c7da6084db5ba1a310d40a3bc0244d83b82609f2043a1682a3d4ae4c9ff0c8d99718019
SSDEEP

3072:t1opowLejy8U6bYOfz5j7f57tbjYYrFBmHegVpdop8nvnHNHHla:t12ojLU6Bf1j7fsC5IopCPHNH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3276	Unicorn-50199.exe
4548	Unicorn-61932.exe
4140	Unicorn-29814.exe
8	Unicorn-44776.exe
3308	Unicorn-11034.exe
4344	Unicorn-4904.exe
2204	Unicorn-36285.exe
4308	Unicorn-2695.exe
1676	Unicorn-2695.exe
4600	Unicorn-43728.exe
116	Unicorn-43728.exe
4552	Unicorn-35295.exe
4324	Unicorn-29429.exe
4780	Unicorn-15694.exe
1888	Unicorn-10244.exe
4484	Unicorn-5959.exe
2804	Unicorn-3552.exe
3124	Unicorn-58668.exe
3860	Unicorn-5383.exe
2468	Unicorn-5061.exe
2792	Unicorn-17313.exe
1896	Unicorn-6544.exe
4020	Unicorn-12674.exe
2108	Unicorn-12674.exe
3356	Unicorn-59415.exe
3520	Unicorn-13478.exe
2212	Unicorn-1730.exe
1080	Unicorn-14786.exe
1372	Unicorn-11413.exe
2880	Unicorn-11413.exe
2580	Unicorn-29424.exe
2036	Unicorn-39639.exe
2368	Unicorn-39639.exe
1512	Unicorn-23109.exe
4332	Unicorn-17526.exe
396	Unicorn-5186.exe
1168	Unicorn-6255.exe
1644	Unicorn-63624.exe
3168	Unicorn-43204.exe
736	Unicorn-23338.exe
1872	Unicorn-11086.exe
1816	Unicorn-30629.exe
3316	Unicorn-38243.exe
4304	Unicorn-32112.exe
2360	Unicorn-34465.exe
4288	Unicorn-30376.exe
2976	Unicorn-62171.exe
652	Unicorn-62171.exe
3380	Unicorn-37859.exe
2552	Unicorn-63167.exe
2188	Unicorn-63432.exe
724	Unicorn-57302.exe
4260	Unicorn-57302.exe
5180	Unicorn-31205.exe
5228	Unicorn-58669.exe
5268	Unicorn-51263.exe
5320	Unicorn-30821.exe
5328	Unicorn-50687.exe
5400	Unicorn-65169.exe
5424	Unicorn-50879.exe
5444	Unicorn-39431.exe
5472	Unicorn-32296.exe
5496	Unicorn-39696.exe
5512	Unicorn-64091.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
13752	6708	WerFault.exe	317
10180	2512	WerFault.exe	772

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44847.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4421.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41775.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32296.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49077.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6864.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62491.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65376.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48656.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15771.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26671.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26945.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4421.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36140.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26316.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48819.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26725.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13131.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61367.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37034.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14514.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-965.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63244.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15694.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38626.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42241.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58160.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19174.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11034.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35009.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4961.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49351.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41967.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12683.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61796.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30830.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13938.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52247.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25475.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28453.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29314.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	18016	dwm.exe
Token: SeChangeNotifyPrivilege	18016	dwm.exe
Token: 33	18016	dwm.exe
Token: SeIncBasePriorityPrivilege	18016	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1832	969b60d72dcaffae7e02c171439bf670N.exe
3276	Unicorn-50199.exe
4140	Unicorn-29814.exe
4548	Unicorn-61932.exe
8	Unicorn-44776.exe
3308	Unicorn-11034.exe
2204	Unicorn-36285.exe
4344	Unicorn-4904.exe
4308	Unicorn-2695.exe
1676	Unicorn-2695.exe
4552	Unicorn-35295.exe
4780	Unicorn-15694.exe
4600	Unicorn-43728.exe
116	Unicorn-43728.exe
4324	Unicorn-29429.exe
1888	Unicorn-10244.exe
4484	Unicorn-5959.exe
2804	Unicorn-3552.exe
3124	Unicorn-58668.exe
3860	Unicorn-5383.exe
2792	Unicorn-17313.exe
4020	Unicorn-12674.exe
2468	Unicorn-5061.exe
3520	Unicorn-13478.exe
2108	Unicorn-12674.exe
1896	Unicorn-6544.exe
3356	Unicorn-59415.exe
2212	Unicorn-1730.exe
1080	Unicorn-14786.exe
2880	Unicorn-11413.exe
1372	Unicorn-11413.exe
2036	Unicorn-39639.exe
2580	Unicorn-29424.exe
2368	Unicorn-39639.exe
1512	Unicorn-23109.exe
4332	Unicorn-17526.exe
396	Unicorn-5186.exe
1168	Unicorn-6255.exe
1644	Unicorn-63624.exe
1872	Unicorn-11086.exe
736	Unicorn-23338.exe
3168	Unicorn-43204.exe
652	Unicorn-62171.exe
4288	Unicorn-30376.exe
2976	Unicorn-62171.exe
2360	Unicorn-34465.exe
4304	Unicorn-32112.exe
3316	Unicorn-38243.exe
1816	Unicorn-30629.exe
2552	Unicorn-63167.exe
5180	Unicorn-31205.exe
2188	Unicorn-63432.exe
724	Unicorn-57302.exe
4260	Unicorn-57302.exe
3380	Unicorn-37859.exe
5228	Unicorn-58669.exe
5268	Unicorn-51263.exe
5328	Unicorn-50687.exe
5320	Unicorn-30821.exe
5444	Unicorn-39431.exe
5472	Unicorn-32296.exe
5400	Unicorn-65169.exe
5424	Unicorn-50879.exe
5496	Unicorn-39696.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 3276	1832	969b60d72dcaffae7e02c171439bf670N.exe	94
PID 1832 wrote to memory of 3276	1832	969b60d72dcaffae7e02c171439bf670N.exe	94
PID 1832 wrote to memory of 3276	1832	969b60d72dcaffae7e02c171439bf670N.exe	94
PID 3276 wrote to memory of 4548	3276	Unicorn-50199.exe	100
PID 3276 wrote to memory of 4548	3276	Unicorn-50199.exe	100
PID 3276 wrote to memory of 4548	3276	Unicorn-50199.exe	100
PID 1832 wrote to memory of 4140	1832	969b60d72dcaffae7e02c171439bf670N.exe	101
PID 1832 wrote to memory of 4140	1832	969b60d72dcaffae7e02c171439bf670N.exe	101
PID 1832 wrote to memory of 4140	1832	969b60d72dcaffae7e02c171439bf670N.exe	101
PID 4140 wrote to memory of 8	4140	Unicorn-29814.exe	103
PID 4140 wrote to memory of 8	4140	Unicorn-29814.exe	103
PID 4140 wrote to memory of 8	4140	Unicorn-29814.exe	103
PID 4548 wrote to memory of 3308	4548	Unicorn-61932.exe	104
PID 4548 wrote to memory of 3308	4548	Unicorn-61932.exe	104
PID 4548 wrote to memory of 3308	4548	Unicorn-61932.exe	104
PID 1832 wrote to memory of 4344	1832	969b60d72dcaffae7e02c171439bf670N.exe	105
PID 1832 wrote to memory of 4344	1832	969b60d72dcaffae7e02c171439bf670N.exe	105
PID 1832 wrote to memory of 4344	1832	969b60d72dcaffae7e02c171439bf670N.exe	105
PID 3276 wrote to memory of 2204	3276	Unicorn-50199.exe	106
PID 3276 wrote to memory of 2204	3276	Unicorn-50199.exe	106
PID 3276 wrote to memory of 2204	3276	Unicorn-50199.exe	106
PID 8 wrote to memory of 4308	8	Unicorn-44776.exe	109
PID 8 wrote to memory of 4308	8	Unicorn-44776.exe	109
PID 8 wrote to memory of 4308	8	Unicorn-44776.exe	109
PID 3308 wrote to memory of 1676	3308	Unicorn-11034.exe	110
PID 3308 wrote to memory of 1676	3308	Unicorn-11034.exe	110
PID 3308 wrote to memory of 1676	3308	Unicorn-11034.exe	110
PID 4344 wrote to memory of 4600	4344	Unicorn-4904.exe	111
PID 4344 wrote to memory of 4600	4344	Unicorn-4904.exe	111
PID 4344 wrote to memory of 4600	4344	Unicorn-4904.exe	111
PID 2204 wrote to memory of 116	2204	Unicorn-36285.exe	112
PID 2204 wrote to memory of 116	2204	Unicorn-36285.exe	112
PID 2204 wrote to memory of 116	2204	Unicorn-36285.exe	112
PID 1832 wrote to memory of 4552	1832	969b60d72dcaffae7e02c171439bf670N.exe	113
PID 1832 wrote to memory of 4552	1832	969b60d72dcaffae7e02c171439bf670N.exe	113
PID 1832 wrote to memory of 4552	1832	969b60d72dcaffae7e02c171439bf670N.exe	113
PID 3276 wrote to memory of 4324	3276	Unicorn-50199.exe	114
PID 3276 wrote to memory of 4324	3276	Unicorn-50199.exe	114
PID 3276 wrote to memory of 4324	3276	Unicorn-50199.exe	114
PID 4548 wrote to memory of 4780	4548	Unicorn-61932.exe	115
PID 4548 wrote to memory of 4780	4548	Unicorn-61932.exe	115
PID 4548 wrote to memory of 4780	4548	Unicorn-61932.exe	115
PID 4140 wrote to memory of 1888	4140	Unicorn-29814.exe	116
PID 4140 wrote to memory of 1888	4140	Unicorn-29814.exe	116
PID 4140 wrote to memory of 1888	4140	Unicorn-29814.exe	116
PID 4552 wrote to memory of 4484	4552	Unicorn-35295.exe	117
PID 4552 wrote to memory of 4484	4552	Unicorn-35295.exe	117
PID 4552 wrote to memory of 4484	4552	Unicorn-35295.exe	117
PID 1832 wrote to memory of 2804	1832	969b60d72dcaffae7e02c171439bf670N.exe	118
PID 1832 wrote to memory of 2804	1832	969b60d72dcaffae7e02c171439bf670N.exe	118
PID 1832 wrote to memory of 2804	1832	969b60d72dcaffae7e02c171439bf670N.exe	118
PID 4308 wrote to memory of 3124	4308	Unicorn-2695.exe	119
PID 4308 wrote to memory of 3124	4308	Unicorn-2695.exe	119
PID 4308 wrote to memory of 3124	4308	Unicorn-2695.exe	119
PID 1676 wrote to memory of 3860	1676	Unicorn-2695.exe	120
PID 1676 wrote to memory of 3860	1676	Unicorn-2695.exe	120
PID 1676 wrote to memory of 3860	1676	Unicorn-2695.exe	120
PID 4344 wrote to memory of 2468	4344	Unicorn-4904.exe	121
PID 4344 wrote to memory of 2468	4344	Unicorn-4904.exe	121
PID 4344 wrote to memory of 2468	4344	Unicorn-4904.exe	121
PID 3308 wrote to memory of 2792	3308	Unicorn-11034.exe	122
PID 3308 wrote to memory of 2792	3308	Unicorn-11034.exe	122
PID 3308 wrote to memory of 2792	3308	Unicorn-11034.exe	122
PID 4548 wrote to memory of 1896	4548	Unicorn-61932.exe	123

C:\Users\Admin\AppData\Local\Temp\969b60d72dcaffae7e02c171439bf670N.exe
"C:\Users\Admin\AppData\Local\Temp\969b60d72dcaffae7e02c171439bf670N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50199.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50199.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61932.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11034.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5383.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37859.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23547.exe
        8⤵
        
        PID:6424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25252.exe
        9⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57867.exe
        9⤵
        
        PID:12568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55023.exe
        9⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe
        8⤵
        
        PID:1208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1090.exe
        9⤵
        
        PID:10688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6843.exe
        9⤵
        
        PID:17524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52963.exe
        8⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12150.exe
        8⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13820.exe
        7⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41967.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
        8⤵
        
        PID:14364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
        8⤵
        
        PID:16648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2833.exe
        7⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58133.exe
        7⤵
        
        PID:13472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61736.exe
        7⤵
        
        PID:18316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31205.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43308.exe
        7⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58352.exe
        8⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27468.exe
        9⤵
        
        PID:10424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26149.exe
        9⤵
        
        PID:14444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34550.exe
        9⤵
        
        PID:17068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        8⤵
        
        PID:9484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38266.exe
        8⤵
        
        PID:13784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44500.exe
        8⤵
        
        PID:16896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43806.exe
        7⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42817.exe
        8⤵
        
        PID:12260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28753.exe
        8⤵
        
        PID:13632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53244.exe
        8⤵
        
        PID:17716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55702.exe
        7⤵
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
        7⤵
        
        PID:14624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57215.exe
        7⤵
        
        PID:17468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37453.exe
        6⤵
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57475.exe
        7⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47940.exe
        8⤵
        
        PID:8736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26205.exe
        8⤵
        
        PID:14292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24080.exe
        8⤵
        
        PID:17164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9242.exe
        7⤵
        
        PID:11356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26560.exe
        7⤵
        
        PID:15024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35635.exe
        7⤵
        
        PID:16688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59514.exe
        6⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10275.exe
        7⤵
        
        PID:12264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41287.exe
        7⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27328.exe
        6⤵
        
        PID:11080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42614.exe
        6⤵
        
        PID:14644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32281.exe
        6⤵
        
        PID:17088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17313.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63624.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43863.exe
        7⤵
        
        PID:5764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58352.exe
        8⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27468.exe
        9⤵
        
        PID:10244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
        9⤵
        
        PID:2928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27342.exe
        9⤵
        
        PID:17552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        8⤵
        
        PID:9532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26781.exe
        8⤵
        
        PID:14196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64920.exe
        8⤵
        
        PID:17300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57541.exe
        7⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62491.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30830.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31618.exe
        8⤵
        
        PID:17500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47431.exe
        7⤵
        
        PID:10612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe
        7⤵
        
        PID:15548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15944.exe
        7⤵
        
        PID:17236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34049.exe
        6⤵
        
        PID:4592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58352.exe
        7⤵
        
        PID:7044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18444.exe
        8⤵
        
        PID:11996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53243.exe
        8⤵
        
        PID:7232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38266.exe
        7⤵
        
        PID:13744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52668.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20653.exe
        6⤵
        
        PID:7904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21199.exe
        7⤵
        
        PID:16484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39389.exe
        6⤵
        
        PID:10364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42697.exe
        6⤵
        
        PID:14792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52701.exe
        6⤵
        
        PID:17324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32112.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1507.exe
        6⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61367.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7623.exe
        8⤵
        
        PID:11120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26725.exe
        8⤵
        
        PID:13964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12218.exe
        8⤵
        
        PID:19212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9242.exe
        7⤵
        
        PID:11372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26560.exe
        7⤵
        
        PID:15048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11323.exe
        7⤵
        
        PID:16404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43806.exe
        6⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-882.exe
        7⤵
        
        PID:12352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1930.exe
        7⤵
        
        PID:2512
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2512 -s 464
        8⤵
        Program crash
        
        PID:10180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55702.exe
        6⤵
        
        PID:11052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
        6⤵
        
        PID:14680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31750.exe
        6⤵
        
        PID:17044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24351.exe
        5⤵
        
        PID:1100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51619.exe
        6⤵
        
        PID:7524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47098.exe
        6⤵
        
        PID:12604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60312.exe
        6⤵
        
        PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38028.exe
        5⤵
        
        PID:8080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3585.exe
        5⤵
        
        PID:11468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27091.exe
        5⤵
        
        PID:14976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10750.exe
        5⤵
        
        PID:17256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15694.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15694.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11413.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32296.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13131.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3207.exe
        8⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1842.exe
        8⤵
        
        PID:12488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27786.exe
        8⤵
        
        PID:18232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe
        7⤵
        
        PID:7804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44794.exe
        7⤵
        
        PID:9880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7987.exe
        7⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63318.exe
        6⤵
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8033.exe
        7⤵
        
        PID:10556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        7⤵
        
        PID:14908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61796.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41426.exe
        6⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41863.exe
        6⤵
        
        PID:12960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49675.exe
        6⤵
        
        PID:7468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-784.exe
        5⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13131.exe
        6⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8033.exe
        7⤵
        
        PID:10576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        7⤵
        
        PID:14868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18083.exe
        7⤵
        
        PID:19156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31945.exe
        6⤵
        
        PID:448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52963.exe
        6⤵
        
        PID:12796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45975.exe
        6⤵
        
        PID:15512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17381.exe
        5⤵
        
        PID:5716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        6⤵
        
        PID:9240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
        6⤵
        
        PID:13728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38635.exe
        6⤵
        
        PID:16884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49077.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24899.exe
        6⤵
        
        PID:16908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10549.exe
        5⤵
        
        PID:12196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8020.exe
        5⤵
        
        PID:3852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6544.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62171.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53723.exe
        6⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49115.exe
        7⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52740.exe
        8⤵
        
        PID:11104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48215.exe
        8⤵
        
        PID:14608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30284.exe
        8⤵
        
        PID:8920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        7⤵
        
        PID:9508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37773.exe
        7⤵
        
        PID:14040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53628.exe
        7⤵
        
        PID:17540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43806.exe
        6⤵
        
        PID:8020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61339.exe
        7⤵
        
        PID:11740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48983.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54971.exe
        7⤵
        
        PID:16700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55702.exe
        6⤵
        
        PID:11036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
        6⤵
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9418.exe
        6⤵
        
        PID:19220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36545.exe
        5⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18472.exe
        6⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16201.exe
        7⤵
        
        PID:10380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55557.exe
        7⤵
        
        PID:15520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36524.exe
        7⤵
        
        PID:7768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9242.exe
        6⤵
        
        PID:11364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26560.exe
        6⤵
        
        PID:15040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11131.exe
        6⤵
        
        PID:17192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51921.exe
        5⤵
        
        PID:7292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27468.exe
        6⤵
        
        PID:10252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
        6⤵
        
        PID:14088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34550.exe
        6⤵
        
        PID:16696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50254.exe
        5⤵
        
        PID:8416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15896.exe
        5⤵
        
        PID:3216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11131.exe
        5⤵
        
        PID:17152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63167.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26671.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-555.exe
        6⤵
        
        PID:8816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43778.exe
        6⤵
        
        PID:12040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14514.exe
        6⤵
        
        PID:17628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35562.exe
        5⤵
        
        PID:7924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63678.exe
        5⤵
        
        PID:10344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2361.exe
        5⤵
        
        PID:14780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57215.exe
        5⤵
        
        PID:17484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26868.exe
      4⤵
      PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53783.exe
        5⤵
        
        PID:6708
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6708 -s 716
        6⤵
        Program crash
        
        PID:13752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28453.exe
        5⤵
        
        PID:11068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29360.exe
        5⤵
        
        PID:14984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40416.exe
        5⤵
        
        PID:17244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50658.exe
      4⤵
      PID:1068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54551.exe
        5⤵
        
        PID:13168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13606.exe
        5⤵
        
        PID:5880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53707.exe
      4⤵
      PID:11156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52026.exe
      4⤵
      PID:5588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36285.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36285.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43728.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12674.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43204.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9099.exe
        7⤵
        
        PID:6072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57179.exe
        8⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10311.exe
        9⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4287.exe
        10⤵
        
        PID:16712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28453.exe
        9⤵
        
        PID:10452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        9⤵
        
        PID:14852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15719.exe
        9⤵
        
        PID:16456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe
        8⤵
        
        PID:1204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52963.exe
        8⤵
        
        PID:12624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15658.exe
        8⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48819.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50711.exe
        8⤵
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26149.exe
        8⤵
        
        PID:14408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54971.exe
        8⤵
        
        PID:17388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3600.exe
        7⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41863.exe
        7⤵
        
        PID:12936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14890.exe
        7⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35009.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61559.exe
        7⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42817.exe
        8⤵
        
        PID:11928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63538.exe
        8⤵
        
        PID:14120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60836.exe
        8⤵
        
        PID:16732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40.exe
        7⤵
        
        PID:10404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45750.exe
        7⤵
        
        PID:14416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48087.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20784.exe
        6⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37027.exe
        7⤵
        
        PID:10904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28946.exe
        7⤵
        
        PID:15008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59055.exe
        7⤵
        
        PID:16996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47431.exe
        6⤵
        
        PID:10592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe
        6⤵
        
        PID:15532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32665.exe
        6⤵
        
        PID:16520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30629.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63235.exe
        6⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49115.exe
        7⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42979.exe
        8⤵
        
        PID:9004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-965.exe
        8⤵
        
        PID:12644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40231.exe
        8⤵
        
        PID:17268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        7⤵
        
        PID:9516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50518.exe
        7⤵
        
        PID:13760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40416.exe
        7⤵
        
        PID:16936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43806.exe
        6⤵
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61339.exe
        7⤵
        
        PID:11764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27493.exe
        7⤵
        
        PID:15108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55547.exe
        7⤵
        
        PID:17640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41566.exe
        6⤵
        
        PID:10604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9979.exe
        6⤵
        
        PID:7308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27805.exe
        5⤵
        
        PID:6544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-638.exe
        6⤵
        
        PID:9008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25053.exe
        6⤵
        
        PID:13448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41820.exe
        6⤵
        
        PID:18204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11006.exe
        5⤵
        
        PID:7756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27762.exe
        5⤵
        
        PID:12596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1196.exe
        5⤵
        
        PID:7124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29424.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50879.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38766.exe
        6⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2330.exe
        7⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26045.exe
        7⤵
        
        PID:11684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49159.exe
        7⤵
        
        PID:7156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5608.exe
        6⤵
        
        PID:8700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64447.exe
        6⤵
        
        PID:12140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39971.exe
        6⤵
        
        PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51403.exe
        5⤵
        
        PID:6600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41774.exe
        6⤵
        
        PID:10484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        6⤵
        
        PID:14916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60836.exe
        6⤵
        
        PID:17356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4264.exe
        5⤵
        
        PID:7884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44479.exe
        6⤵
        
        PID:14224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58724.exe
        6⤵
        
        PID:16752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61842.exe
        5⤵
        
        PID:1680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48523.exe
        5⤵
        
        PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39431.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25275.exe
        5⤵
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52771.exe
        6⤵
        
        PID:8900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56990.exe
        6⤵
        
        PID:1736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54447.exe
        6⤵
        
        PID:6132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65386.exe
        5⤵
        
        PID:8216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25475.exe
        6⤵
        
        PID:17696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-830.exe
        5⤵
        
        PID:12912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26514.exe
        5⤵
        
        PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58493.exe
      4⤵
      PID:6864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43363.exe
        5⤵
        
        PID:8620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-965.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30658.exe
        5⤵
        
        PID:16392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53886.exe
      4⤵
      PID:1624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3878.exe
      4⤵
      PID:12844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37034.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37034.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29429.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29429.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12674.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6255.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59902.exe
        6⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-555.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52823.exe
        7⤵
        
        PID:11624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2122.exe
        7⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11006.exe
        6⤵
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47276.exe
        7⤵
        
        PID:13432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15011.exe
        7⤵
        
        PID:17184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27762.exe
        6⤵
        
        PID:12616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26085.exe
        6⤵
        
        PID:7276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35118.exe
        5⤵
        
        PID:5576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40598.exe
        6⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63067.exe
        7⤵
        
        PID:11588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18703.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32053.exe
        6⤵
        
        PID:9860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29793.exe
        6⤵
        
        PID:14032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11131.exe
        6⤵
        
        PID:17128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52113.exe
        5⤵
        
        PID:7328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32677.exe
        6⤵
        
        PID:12400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31870.exe
        6⤵
        
        PID:18244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12345.exe
        5⤵
        
        PID:9832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35657.exe
        5⤵
        
        PID:14248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64416.exe
        5⤵
        
        PID:17036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11086.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41196.exe
        5⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52986.exe
        6⤵
        
        PID:6180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17079.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17079.exe
        7⤵
        
        PID:9448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
        7⤵
        
        PID:13628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50887.exe
        7⤵
        
        PID:16812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
        6⤵
        
        PID:8956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1406.exe
        6⤵
        
        PID:13244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34490.exe
        6⤵
        
        PID:556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59810.exe
        5⤵
        
        PID:6952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3207.exe
        6⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55489.exe
        7⤵
        
        PID:18536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47343.exe
        6⤵
        
        PID:13264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3466.exe
        6⤵
        
        PID:6336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48717.exe
        5⤵
        
        PID:8504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20373.exe
        5⤵
        
        PID:12976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49675.exe
        5⤵
        
        PID:7624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2969.exe
      4⤵
      PID:6060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4683.exe
        5⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3207.exe
        6⤵
        
        PID:7928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-965.exe
        6⤵
        
        PID:12664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14514.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24374.exe
        5⤵
        
        PID:8968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61078.exe
        5⤵
        
        PID:4668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55024.exe
        5⤵
        
        PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31035.exe
      4⤵
      PID:7596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4826.exe
        5⤵
        
        PID:9336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13938.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49757.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49757.exe
      4⤵
      PID:7520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64898.exe
      4⤵
      PID:13896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52701.exe
      4⤵
      PID:16840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13478.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13478.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38243.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38243.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-630.exe
        5⤵
        
        PID:5432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63588.exe
        6⤵
        
        PID:7240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38895.exe
        7⤵
        
        PID:9256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53917.exe
        7⤵
        
        PID:12820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33208.exe
        7⤵
        
        PID:17444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57322.exe
        6⤵
        
        PID:9724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51286.exe
        6⤵
        
        PID:14164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60836.exe
        6⤵
        
        PID:17316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47954.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47954.exe
        5⤵
        
        PID:7748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51775.exe
        6⤵
        
        PID:10896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30379.exe
        6⤵
        
        PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60690.exe
        5⤵
        
        PID:11236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37660.exe
        5⤵
        
        PID:14652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65376.exe
        5⤵
        
        PID:17276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43946.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43946.exe
      4⤵
      PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57475.exe
        5⤵
        
        PID:7224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4655.exe
        6⤵
        
        PID:9868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36140.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9242.exe
        5⤵
        
        PID:11332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39882.exe
        5⤵
        
        PID:15016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15215.exe
        5⤵
        
        PID:17288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33036.exe
      4⤵
      PID:8084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9123.exe
        5⤵
        
        PID:11832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41821.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5971.exe
        5⤵
        
        PID:9748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47431.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47431.exe
      4⤵
      PID:10628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37084.exe
      4⤵
      PID:14456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11131.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11131.exe
      4⤵
      PID:17136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34465.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34465.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42047.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42047.exe
      4⤵
      PID:4420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26967.exe
        5⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2330.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47343.exe
        6⤵
        
        PID:11096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49351.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27690.exe
        5⤵
        
        PID:8008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14316.exe
        5⤵
        
        PID:12812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23556.exe
        5⤵
        
        PID:5360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9405.exe
      4⤵
      PID:1756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60763.exe
        5⤵
        
        PID:11208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26725.exe
        5⤵
        
        PID:13948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5971.exe
        5⤵
        
        PID:17464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6781.exe
      4⤵
      PID:9452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43062.exe
      4⤵
      PID:13704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16374.exe
      4⤵
      PID:17588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18117.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18117.exe
    3⤵
    PID:1176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58160.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7623.exe
        5⤵
        
        PID:11000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26725.exe
        5⤵
        
        PID:14716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54971.exe
        5⤵
        
        PID:16764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61323.exe
      4⤵
      PID:9036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61078.exe
      4⤵
      PID:13292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35180.exe
      4⤵
      PID:7568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63164.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63164.exe
    3⤵
    PID:7344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7623.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7623.exe
      4⤵
      PID:11012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51857.exe
      4⤵
      PID:14892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62843.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62843.exe
      4⤵
      PID:9296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48216.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48216.exe
    3⤵
    PID:9772
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9322.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9322.exe
    3⤵
    PID:14228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58816.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58816.exe
    3⤵
    PID:17224
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29814.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29814.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4140
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44776.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44776.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:8
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58668.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5186.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61424.exe
        7⤵
        
        PID:5908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65347.exe
        8⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32351.exe
        9⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26088.exe
        10⤵
        
        PID:14132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7611.exe
        10⤵
        
        PID:19392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60886.exe
        9⤵
        
        PID:13320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60644.exe
        9⤵
        
        PID:16552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44115.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7670.exe
        9⤵
        
        PID:11244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40416.exe
        9⤵
        
        PID:17076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32349.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61614.exe
        8⤵
        
        PID:15908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9418.exe
        8⤵
        
        PID:19164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40355.exe
        7⤵
        
        PID:7796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62491.exe
        8⤵
        
        PID:12080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53243.exe
        8⤵
        
        PID:1032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38766.exe
        7⤵
        
        PID:10580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20549.exe
        7⤵
        
        PID:15236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25073.exe
        7⤵
        
        PID:17432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41558.exe
        6⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57288.exe
        7⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16201.exe
        8⤵
        
        PID:10392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22069.exe
        8⤵
        
        PID:14828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60836.exe
        8⤵
        
        PID:17348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56258.exe
        7⤵
        
        PID:784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32349.exe
        7⤵
        
        PID:12236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61272.exe
        7⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39565.exe
        6⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50768.exe
        7⤵
        
        PID:6252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42241.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54447.exe
        7⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23451.exe
        6⤵
        
        PID:7972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53177.exe
        6⤵
        
        PID:10680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35111.exe
        6⤵
        
        PID:1424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23338.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22312.exe
        6⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36951.exe
        7⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38568.exe
        8⤵
        
        PID:8884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
        8⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47763.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32905.exe
        7⤵
        
        PID:8776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26088.exe
        8⤵
        
        PID:14148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64020.exe
        8⤵
        
        PID:19192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1021.exe
        7⤵
        
        PID:11784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23556.exe
        7⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26945.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
        7⤵
        
        PID:8028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28453.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        7⤵
        
        PID:14876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48008.exe
        7⤵
        
        PID:7136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50533.exe
        6⤵
        
        PID:8360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10778.exe
        6⤵
        
        PID:11724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27666.exe
        6⤵
        
        PID:17116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58942.exe
        5⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58160.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14390.exe
        7⤵
        
        PID:8720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25853.exe
        7⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29314.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28650.exe
        6⤵
        
        PID:8488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61078.exe
        6⤵
        
        PID:13340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40800.exe
        6⤵
        
        PID:16448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18014.exe
        5⤵
        
        PID:7368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29160.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6497.exe
        6⤵
        
        PID:14744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34550.exe
        6⤵
        
        PID:17200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3680.exe
        5⤵
        
        PID:9812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19122.exe
        5⤵
        
        PID:14276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59415.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62171.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9182.exe
        6⤵
        
        PID:3392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58352.exe
        7⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60763.exe
        8⤵
        
        PID:11220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65178.exe
        8⤵
        
        PID:15052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62816.exe
        8⤵
        
        PID:18416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        7⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34183.exe
        7⤵
        
        PID:14108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18546.exe
        7⤵
        
        PID:19424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43806.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61339.exe
        7⤵
        
        PID:11732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43082.exe
        7⤵
        
        PID:15932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1887.exe
        7⤵
        
        PID:8380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55702.exe
        6⤵
        
        PID:11028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
        6⤵
        
        PID:15352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9418.exe
        6⤵
        
        PID:19228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23717.exe
        5⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49115.exe
        6⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47203.exe
        7⤵
        
        PID:10444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26149.exe
        7⤵
        
        PID:14380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63139.exe
        7⤵
        
        PID:16984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51286.exe
        6⤵
        
        PID:14188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60836.exe
        6⤵
        
        PID:17340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57541.exe
        5⤵
        
        PID:8036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46788.exe
        6⤵
        
        PID:3700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31915.exe
        6⤵
        
        PID:7572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47431.exe
        5⤵
        
        PID:10620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe
        5⤵
        
        PID:15540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52701.exe
        5⤵
        
        PID:17396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57302.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36292.exe
        5⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61367.exe
        6⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52247.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3850.exe
        7⤵
        
        PID:1804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4421.exe
        6⤵
        
        PID:9492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24944.exe
        6⤵
        
        PID:13720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40416.exe
        6⤵
        
        PID:16920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43806.exe
        5⤵
        
        PID:8068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61531.exe
        6⤵
        
        PID:10884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53451.exe
        6⤵
        
        PID:14944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64099.exe
        6⤵
        
        PID:17528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15957.exe
        5⤵
        
        PID:11592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54328.exe
        5⤵
        
        PID:7164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58751.exe
      4⤵
      PID:6624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
        5⤵
        
        PID:8160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41065.exe
        6⤵
        
        PID:16788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28453.exe
        5⤵
        
        PID:10388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        5⤵
        
        PID:14860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36524.exe
        5⤵
        
        PID:16412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14785.exe
      4⤵
      PID:7952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49980.exe
        5⤵
        
        PID:17664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36641.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36641.exe
      4⤵
      PID:10920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39925.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39925.exe
      4⤵
      PID:5292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10244.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10244.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1730.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51263.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11595.exe
        6⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18472.exe
        7⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48656.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48215.exe
        8⤵
        
        PID:14600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34550.exe
        8⤵
        
        PID:17020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37285.exe
        7⤵
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34183.exe
        7⤵
        
        PID:14104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18546.exe
        7⤵
        
        PID:19404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11434.exe
        6⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11183.exe
        7⤵
        
        PID:8936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-965.exe
        7⤵
        
        PID:12672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12410.exe
        7⤵
        
        PID:7664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6864.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24562.exe
        6⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52171.exe
        6⤵
        
        PID:16848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17002.exe
        5⤵
        
        PID:6344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20099.exe
        6⤵
        
        PID:8856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25053.exe
        6⤵
        
        PID:13440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18275.exe
        6⤵
        
        PID:16728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57850.exe
        5⤵
        
        PID:7212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12683.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33835.exe
        6⤵
        
        PID:18304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38215.exe
        5⤵
        
        PID:12248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56691.exe
        5⤵
        
        PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30821.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5155.exe
        5⤵
        
        PID:6804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26316.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
        6⤵
        
        PID:14024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54971.exe
        6⤵
        
        PID:17332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46227.exe
        5⤵
        
        PID:8792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1021.exe
        5⤵
        
        PID:11636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34220.exe
        5⤵
        
        PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62554.exe
      4⤵
      PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15459.exe
        5⤵
        
        PID:8760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47343.exe
        5⤵
        
        PID:13280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3466.exe
        5⤵
        
        PID:7564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57742.exe
      4⤵
      PID:9064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27084.exe
      4⤵
      PID:11808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29631.exe
      4⤵
      PID:5884
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14786.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63432.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24040.exe
        5⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17512.exe
        6⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44100.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18703.exe
        7⤵
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9242.exe
        6⤵
        
        PID:11340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26560.exe
        6⤵
        
        PID:15032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19299.exe
        6⤵
        
        PID:16956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43806.exe
        5⤵
        
        PID:8044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61339.exe
        6⤵
        
        PID:11756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27493.exe
        6⤵
        
        PID:15092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43487.exe
        6⤵
        
        PID:18368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35169.exe
        5⤵
        
        PID:9736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-275.exe
        5⤵
        
        PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12809.exe
      4⤵
      PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49834.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49834.exe
        5⤵
        
        PID:10772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53865.exe
        5⤵
        
        PID:14928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61220.exe
        5⤵
        
        PID:16424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50642.exe
      4⤵
      PID:7784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34027.exe
        5⤵
        
        PID:17456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44298.exe
      4⤵
      PID:12712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4359.exe
      4⤵
      PID:7092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58669.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35223.exe
      4⤵
      PID:3296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17320.exe
        5⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5018.exe
        6⤵
        
        PID:10044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
        6⤵
        
        PID:14340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30274.exe
        6⤵
        
        PID:16772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25910.exe
        5⤵
        
        PID:9468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51286.exe
        5⤵
        
        PID:14172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60836.exe
        5⤵
        
        PID:16588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43806.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43806.exe
      4⤵
      PID:4704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5122.exe
        5⤵
        
        PID:11968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45651.exe
        5⤵
        
        PID:7268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55702.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55702.exe
      4⤵
      PID:11060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
      4⤵
      PID:14672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52171.exe
      4⤵
      PID:16824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8470.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8470.exe
    3⤵
    PID:6552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52771.exe
      4⤵
      PID:8944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44738.exe
      4⤵
      PID:11676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28354.exe
      4⤵
      PID:7436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11314.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11314.exe
    3⤵
    PID:8224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46649.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46649.exe
    3⤵
    PID:11776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42607.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42607.exe
    3⤵
    PID:5976
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4904.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4904.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4344
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43728.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43728.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11413.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11413.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50687.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45036.exe
        6⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16835.exe
        7⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61339.exe
        8⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27493.exe
        8⤵
        
        PID:15100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30274.exe
        8⤵
        
        PID:16676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28453.exe
        7⤵
        
        PID:10456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        7⤵
        
        PID:14900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60836.exe
        7⤵
        
        PID:16572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30793.exe
        6⤵
        
        PID:4844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12086.exe
        7⤵
        
        PID:12740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14051.exe
        7⤵
        
        PID:18164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32349.exe
        6⤵
        
        PID:12228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60312.exe
        6⤵
        
        PID:888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40355.exe
        5⤵
        
        PID:7788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9206.exe
        6⤵
        
        PID:12048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53819.exe
        6⤵
        
        PID:15544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-748.exe
        5⤵
        
        PID:10472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20549.exe
        5⤵
        
        PID:14388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-568.exe
        5⤵
        
        PID:17368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65169.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4086.exe
        5⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65023.exe
        6⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17115.exe
        7⤵
        
        PID:16460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44847.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40231.exe
        6⤵
        
        PID:16904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13170.exe
        5⤵
        
        PID:8244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15771.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4913.exe
        5⤵
        
        PID:11792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23556.exe
        5⤵
        
        PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56167.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56167.exe
      4⤵
      PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2330.exe
        5⤵
        
        PID:9020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47343.exe
        5⤵
        
        PID:13304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17690.exe
        5⤵
        
        PID:5616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25304.exe
      4⤵
      PID:7020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16662.exe
      4⤵
      PID:13012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36417.exe
      4⤵
      PID:5776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5061.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5061.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30376.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-739.exe
        5⤵
        
        PID:6028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4963.exe
        6⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41775.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
        7⤵
        
        PID:10036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34550.exe
        7⤵
        
        PID:17096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11333.exe
        6⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4131.exe
        7⤵
        
        PID:14096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25475.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55977.exe
        6⤵
        
        PID:10880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60312.exe
        6⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36566.exe
        5⤵
        
        PID:6368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52963.exe
        6⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64027.exe
        7⤵
        
        PID:11172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63244.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16149.exe
        6⤵
        
        PID:12324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48775.exe
        6⤵
        
        PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7829.exe
        5⤵
        
        PID:9028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35750.exe
        5⤵
        
        PID:12304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41315.exe
        5⤵
        
        PID:6388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35009.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35009.exe
      4⤵
      PID:5656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15675.exe
        5⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1946.exe
        6⤵
        
        PID:8844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13217.exe
        6⤵
        
        PID:12684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63523.exe
        6⤵
        
        PID:16500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19029.exe
        5⤵
        
        PID:9092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14700.exe
        5⤵
        
        PID:12908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52860.exe
        5⤵
        
        PID:7032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45097.exe
      4⤵
      PID:7528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37691.exe
        5⤵
        
        PID:10184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
        5⤵
        
        PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54971.exe
        5⤵
        
        PID:16516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37919.exe
      4⤵
      PID:9872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34780.exe
      4⤵
      PID:4352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35635.exe
      4⤵
      PID:16620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57302.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57302.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22120.exe
      4⤵
      PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51855.exe
        5⤵
        
        PID:6480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2330.exe
        6⤵
        
        PID:8412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1842.exe
        6⤵
        
        PID:12476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27786.exe
        6⤵
        
        PID:18140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24374.exe
        5⤵
        
        PID:8908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61078.exe
        5⤵
        
        PID:13288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22352.exe
        5⤵
        
        PID:4060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63951.exe
      4⤵
      PID:7400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3586.exe
        5⤵
        
        PID:10400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48298.exe
        5⤵
        
        PID:14812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
        5⤵
        
        PID:16400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10565.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe
      4⤵
      PID:15508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52701.exe
      4⤵
      PID:16744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43318.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43318.exe
    3⤵
    PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15976.exe
      4⤵
      PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51012.exe
        5⤵
        
        PID:10008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
        5⤵
        
        PID:14092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30284.exe
        5⤵
        
        PID:8932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24374.exe
      4⤵
      PID:8984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61078.exe
      4⤵
      PID:13272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9907.exe
      4⤵
      PID:6496
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9349.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9349.exe
    3⤵
    PID:7380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42948.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42948.exe
      4⤵
      PID:11948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43082.exe
      4⤵
      PID:15800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1887.exe
      4⤵
      PID:9716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52682.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52682.exe
    3⤵
    PID:9824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36188.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36188.exe
    3⤵
    PID:14264
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59950.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59950.exe
    3⤵
    PID:17176
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35295.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35295.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5959.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5959.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39639.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39696.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43583.exe
        6⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3422.exe
        7⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41774.exe
        8⤵
        
        PID:10492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        8⤵
        
        PID:14892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48968.exe
        8⤵
        
        PID:16472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3570.exe
        7⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60694.exe
        7⤵
        
        PID:12580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33652.exe
        7⤵
        
        PID:18116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63951.exe
        6⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25439.exe
        7⤵
        
        PID:7740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
        7⤵
        
        PID:14076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34550.exe
        7⤵
        
        PID:17052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6480.exe
        6⤵
        
        PID:9796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44323.exe
        6⤵
        
        PID:14308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27666.exe
        6⤵
        
        PID:17108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6805.exe
        5⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14514.exe
        6⤵
        
        PID:8972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39729.exe
        7⤵
        
        PID:19416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33968.exe
        6⤵
        
        PID:12148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5055.exe
        6⤵
        
        PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49298.exe
        5⤵
        
        PID:7932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7286.exe
        6⤵
        
        PID:10636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48298.exe
        6⤵
        
        PID:14804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19174.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48054.exe
        5⤵
        
        PID:10336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59233.exe
        5⤵
        
        PID:14768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65376.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16373.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16373.exe
      4⤵
      PID:5176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58679.exe
        5⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42979.exe
        6⤵
        
        PID:9276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53917.exe
        6⤵
        
        PID:13132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44500.exe
        6⤵
        
        PID:16944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38058.exe
        5⤵
        
        PID:8836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18828.exe
        6⤵
        
        PID:11992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15579.exe
        6⤵
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33008.exe
        5⤵
        
        PID:12188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34612.exe
        5⤵
        
        PID:16972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27579.exe
      4⤵
      PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58111.exe
        5⤵
        
        PID:9732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
        5⤵
        
        PID:13480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54971.exe
        5⤵
        
        PID:16496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38626.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16662.exe
      4⤵
      PID:13020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16188.exe
      4⤵
      PID:1412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17526.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35695.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35695.exe
      4⤵
      PID:5668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35223.exe
        5⤵
        
        PID:3340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50376.exe
        6⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41412.exe
        7⤵
        
        PID:11132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26725.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38635.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9242.exe
        6⤵
        
        PID:11348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26560.exe
        6⤵
        
        PID:14968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11131.exe
        6⤵
        
        PID:17144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32622.exe
        5⤵
        
        PID:8132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48272.exe
        6⤵
        
        PID:10536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26149.exe
        6⤵
        
        PID:14504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54971.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30128.exe
        5⤵
        
        PID:11072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2278.exe
        5⤵
        
        PID:14660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31750.exe
        5⤵
        
        PID:17012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20753.exe
      4⤵
      PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8033.exe
        5⤵
        
        PID:10568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
        5⤵
        
        PID:14844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40416.exe
        5⤵
        
        PID:17060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39093.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39093.exe
      4⤵
      PID:9324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62895.exe
      4⤵
      PID:13384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28005.exe
      4⤵
      PID:16664
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13228.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13228.exe
    3⤵
    PID:5704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-879.exe
      4⤵
      PID:6412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46928.exe
        5⤵
        
        PID:10236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
        5⤵
        
        PID:2012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30284.exe
        5⤵
        
        PID:3904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe
      4⤵
      PID:7820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52963.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52963.exe
      4⤵
      PID:12584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19742.exe
      4⤵
      PID:6632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2882.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2882.exe
    3⤵
    PID:5636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4826.exe
      4⤵
      PID:9252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4961.exe
      4⤵
      PID:12612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55931.exe
      4⤵
      PID:17620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38626.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38626.exe
    3⤵
    PID:7808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21615.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21615.exe
      4⤵
      PID:15892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61559.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61559.exe
      4⤵
      PID:9700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16662.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16662.exe
    3⤵
    PID:12984
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46697.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46697.exe
    3⤵
    PID:5436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3552.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3552.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39639.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39639.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64091.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64091.exe
      4⤵
      Executes dropped EXE
      PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33744.exe
        5⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25252.exe
        6⤵
        
        PID:8924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20233.exe
        6⤵
        
        PID:12036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23694.exe
        6⤵
        
        PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36906.exe
        5⤵
        
        PID:7812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4287.exe
        6⤵
        
        PID:16704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52963.exe
        5⤵
        
        PID:12632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4558.exe
        5⤵
        
        PID:5796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3894.exe
      4⤵
      PID:6536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49943.exe
        5⤵
        
        PID:9052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
        5⤵
        
        PID:14348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
        5⤵
        
        PID:1844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47758.exe
      4⤵
      PID:9308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13893.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13893.exe
      4⤵
      PID:13376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35635.exe
      4⤵
      PID:16508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12622.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12622.exe
    3⤵
    PID:5592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11870.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11870.exe
      4⤵
      PID:6836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3207.exe
        5⤵
        
        PID:9060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46959.exe
        5⤵
        
        PID:12656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12410.exe
        5⤵
        
        PID:7668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13170.exe
      4⤵
      PID:8236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-830.exe
      4⤵
      PID:12920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1050.exe
      4⤵
      PID:4528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61293.exe
    3⤵
    PID:6972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16201.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16201.exe
      4⤵
      PID:10644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-580.exe
      4⤵
      PID:14880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16155.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16155.exe
      4⤵
      PID:5888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47291.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47291.exe
    3⤵
    PID:7660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33197.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33197.exe
    3⤵
    PID:12968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33139.exe
    3⤵
    PID:7712
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23109.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23109.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7983.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7983.exe
    3⤵
    PID:5628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45036.exe
      4⤵
      PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52771.exe
        5⤵
        
        PID:8752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44738.exe
        5⤵
        
        PID:12340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40031.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3082.exe
      4⤵
      PID:8176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21615.exe
        5⤵
        
        PID:15920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-106.exe
        5⤵
        
        PID:8456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32349.exe
      4⤵
      PID:12212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48060.exe
      4⤵
      PID:5260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46982.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46982.exe
    3⤵
    PID:6204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5895.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5895.exe
      4⤵
      PID:10204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
      4⤵
      PID:14356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34550.exe
      4⤵
      PID:17308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51877.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51877.exe
    3⤵
    PID:9076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25268.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25268.exe
    3⤵
    PID:13424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14263.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14263.exe
    3⤵
    PID:8184
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27295.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27295.exe
  2⤵
  PID:5660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7869.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7869.exe
    3⤵
    PID:5676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15459.exe
      4⤵
      PID:8644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33637.exe
      4⤵
      PID:12864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24662.exe
      4⤵
      PID:17420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38110.exe
    3⤵
    PID:8784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22912.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22912.exe
    3⤵
    PID:14068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28427.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28427.exe
    3⤵
    PID:17564
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37492.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37492.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:7128
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14146.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14146.exe
    3⤵
    PID:9220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59891.exe
    3⤵
    PID:12384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9854.exe
    3⤵
    PID:16672
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19581.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19581.exe
  2⤵
  PID:3720
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1825.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1825.exe
  2⤵
  PID:13000
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61832.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61832.exe
  2⤵
  PID:3596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4104,i,13995403245988825027,7033610968827661507,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:8
1⤵
PID:4280

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6708 -ip 6708
1⤵
PID:13892

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:18016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10244.exe

Filesize
468KB

MD5
3faa4b0eb223024861d05044a0978ed3

SHA1
a503e3c27ad8591b7efbaa355ffccaa4e45a1e44

SHA256
efbeac8b9c4cc0e39afb1245261378ffa07ee032e7ffad9e21f358c232bf90df

SHA512
01360b063903e375ce7b8049f61fe85ca7ccf7e44e66bc38635b0fc5ff2156687d83f215c48f9c860ccc79872253541b9e52463675c3b9feefeccad7fda26b08

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11034.exe

Filesize
468KB

MD5
fb7ede3718a2da5ece67b3dce7a81d5d

SHA1
78ff831943d24e856ab7502b0d813bfcd7448707

SHA256
51fa8031771dd2a1197846aed3f6d926c155aa5e762dfbc05dc9364eeabcd5e2

SHA512
46a5bea7ad3d953f04a4957544754f44caa081a41c10a51a561c65dd43788b8c5f1af35e825f5d4a6690fa8fedf48e8a853ccb56b3c4bc141c4272f06543cebd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11413.exe

Filesize
468KB

MD5
3d174625e44aea5c01ebe09280461140

SHA1
e33c45a8e55f8d34077cc970d3f119382f252234

SHA256
dce69f5dd8dacd33c222d48160703a603361084b27223fbf8eed5c9d929b6e84

SHA512
f9e783eaf65efddf3672b6f1feac4c36e76ceb64556e142e7029e970287f102b3899accfe7f9ef6889a5f4221f6a6e82d7335321939851b1eb115dc5936ed3e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12674.exe

Filesize
468KB

MD5
2d53efab15e448a5b3ad7efec56c2fc5

SHA1
42ff7ba5056396f2d1a48c32cd8192a79ea40e67

SHA256
072b33f217ea8c800ed418500877108e87f444049cd347221db8c35dc7d1f8a7

SHA512
5e38a1c3af91d1a38376c85ae005076ecef0170b68140e7a4d26b3fe5503de662e4543bd8e3560db25e0694e1dbe443ed9ea6d22448c13b0d2eca59322a1919a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13478.exe

Filesize
468KB

MD5
876d679a6735877beecb1ea401c4d007

SHA1
aa1fc6a6a4dfa57ed0ee4cd6940433d9b3f7519e

SHA256
44ab34d5a63bd4b72906baa18b2c52c70cd0de2d408aef3feff8753004b32d00

SHA512
dec0e2e97c3ee531c7564e7ac9a8399892d0aa1b6e7bf5f5d10d47b7569df7a5c975794d596eb0589f552351c54a1d656f50ba11bb19447cc989a06a7c0d5399

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14786.exe

Filesize
468KB

MD5
64b5ed6ab5bb83480e3321bb91dd709d

SHA1
c5699ec075b36144455010cd9b2ff078660e79d9

SHA256
3e2f0a43bfcfd328720097f4c8f4568b5fc8d15f7ce881d12ee0dcdf73803047

SHA512
b9c2e79df2724fda9ad9560aa8074b58ea380d3c3cfc9d701c54a7d5585575c493dd18ff494d79e2c0caef9b2bb2e0272a01649da5b4b15908650e1f7fbe502f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15694.exe

Filesize
468KB

MD5
16c7698cec2bf80bead4656c9a8f7866

SHA1
74c74f35d34bacf02314d3faa556bbed1b805857

SHA256
d93947e1a77aee3224baaf423a64a38705ae508409ee3dd6329394c4a405f844

SHA512
9152ae9f6d5d36ca6cd08cc50665c8c669060c8594086ad547761043696e68e0d3b66d48b8b7f9b590f306d2c7dd256858bc76dd2fd621f4dc002653c21b7a3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1730.exe

Filesize
468KB

MD5
7a7ae031c6f399ac4b9be7cf36b1a4a8

SHA1
35f54d6050f64c1b4986bc29922d62097ae29888

SHA256
4dc373527ed2219a211fbfbe911957b7a79d756a71861ac29ca75e56f1c80a96

SHA512
e63bc59abc0f499eab74b4565cacd14abf12ccc5cce899723eb97cf9cd3e1121d86010c8e7ed5b9da6ff58b20b582d31e7af4f28a466da95a06a64ef6c8c18bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17313.exe

Filesize
468KB

MD5
bf21ed6c6aaa0db911ee0c7920844ea0

SHA1
3ca10ba8497659d03a0c5acfd0711ce44d0acf1e

SHA256
f0d1e21e7b64288c5a36c456d2673590829fd061bfaf03d75cbd040064d57dc8

SHA512
99a550134dfa26863e31c0a1bc728fcf571f28dca50cd009ff91c8389919ba652f08ca33f41c5dff7e78eb8e8da4221d1a04746245cf65bf6e4920a91be9cf55

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe

Filesize
468KB

MD5
f9f067b50af67fd0a0559758ad3f3639

SHA1
356e481f6ad68a99c11115a2c1dfe09119a60cfb

SHA256
a5452dfc0ff57262cf579a5522b0635f0bd611b73244c8b0463639d5dd52211f

SHA512
d061ff50700f604015ee668767c5a74b4f5eec5c2475f72e51935e6099afc300a92a33b4a9f6151b11608c34f37bd7065b56a4d8de2c1fb5465ec7292ccb1984

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29424.exe

Filesize
468KB

MD5
fc0744316d0e38f31807ebbd20e36e76

SHA1
bf952ae475dc845533e8eca21db9ff576c3ec6c1

SHA256
57fec82a7648849b46b772970d06f176522ed5606b4b80d84a56483518712c62

SHA512
2cb41d20c6435b5e963a4ab7b68b5581c203e903f08dbbae0631761b7afb249df25ba80f588cbb71966c7c7b971dd8538906ee55eccece7c484f8dc656480928

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29429.exe

Filesize
468KB

MD5
887c66cf9cf141f69c6561443837791e

SHA1
966bf7e0ea32716b2b4ed91d1ee1e157d3882d87

SHA256
af0b65e2b4c9340496b5a01e00b8be96613e3a7ced6f14ba277874e27afc8257

SHA512
9bf6259273ac836ef9080c5094ddfc37cce4aa58bac3033cdc65665728bdb53b2d3c7e6257229cfd9a36a8da58fc31db124dd8c9879d3effe059f106cc32e749

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29814.exe

Filesize
468KB

MD5
089aeabf61ffc0d6a04f92759c3f9c43

SHA1
42101e0ad445001ef0c6ddc946df1c5a4885a014

SHA256
bbde57c4f57d7eadf6888cd7c97547e8a7752b6dddd19aef493997120bee2c7d

SHA512
073c887c44469f520a76841b7b340bc7c02e5b7d45a8dffbc9ae13c7483b42e17be785834870d8993a4db781d854fb038399f1fc21673a9f9ae321632ec157d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35295.exe

Filesize
468KB

MD5
dce547f17205f40ecb377a5b8e1cc752

SHA1
6f1d87982464b3bc912a1f2e5b2147af578fd6c7

SHA256
fb4198dd02930217349deb289860f7d458bdc47dbd795e0e44fc5d8a5e72c609

SHA512
10e6ea01acc8be68ef1e2d33c965ed49c88974a0fb7ba8387ef9a20c101064430ece4529c86dd2ab8874e64c0838f493ba5f48ee4681e2039c44b1ce1175ae2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3552.exe

Filesize
468KB

MD5
cec24072b8babc6efb4b08dcaebc54d1

SHA1
c8be7ac58457f0dfdf38900055c11928e9b80dae

SHA256
b726a29f96ff8011337ff5f08702dca3913be361ee0327473be4d966d22fdc96

SHA512
35adef41d41b8beaebaa209e3e4c87e0d433aa844f590b4240af4c56d5916ba8cc541e66fecc1dc904e3612bb62894a6e5aa5966c018fe70e3a6889a4eb700c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-36285.exe

Filesize
468KB

MD5
2b9164f9c7b8305f1b3f831e5d665f8a

SHA1
dd0d52d28fa14f97bae4af36eee03c45f1d87fc0

SHA256
8be1e4e35e1eeeb18d7e256f5ff88756726b93d2a60584f1aa5a9dd6b6951e5e

SHA512
9eb49ef247d1bd7b3f783e0f16c5266bfb59533170dcc2a048bd8362838b62bc2e7a62f39258a0d516cec360a969175e69a70ac9bb459ec1b9f644f6b196ff10

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39639.exe

Filesize
468KB

MD5
fa78c87e8cf46dfee38263d51e876681

SHA1
d76c29c33714c6df9344393f0f5cbb82b7a1f62c

SHA256
e22bde1973cf2b69ac4899c6c93396e7b92a76f889b9898fd183ac62968da34c

SHA512
545e878fe482bd0f175ae39dfc579674de66fcf42d744769ff1ccc179893a92f42579ad3ef96a33a4604a74191a718e25d7f748234ff16e3469a18f401d9b422

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43728.exe

Filesize
468KB

MD5
55a6ce178529a96332264050bddc711d

SHA1
9777b9ef922659651b74f965e93a7e3ec47e57e2

SHA256
ad5f15bc1d55288c5b9c70af7aa3227cbe7e11ffe73a78899f74f0dbfad17bbe

SHA512
5dc80bcc88a2d97834fe2c28be78ecf611da06fc53e986c139e966c2cb888079130909f6eb6d85510f698b7d0f7d185110bb2b66166cf876197ffd4227448890

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-44776.exe

Filesize
468KB

MD5
ae91d10750762c5cc0dd0aa09c348856

SHA1
0194878fb841d9eae698ba927334a480a47dcd6e

SHA256
3d09b704cc1f441c6465735118fb1689fb7406398f6ba978eee54e5ac1f84f64

SHA512
184dfc28814c458997e3fb0d61e2209cb683319b53d9d5f38dd22b14bbdfbff0e203f44c9a02f8b31f28134f7cd218cec97d4b697ea8b2e64378d6ca80891cd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4904.exe

Filesize
468KB

MD5
5e2964ee0b9cefc7ad131cc813df9064

SHA1
e63aa47f64d90fec5cdf0ff05ee0c7733b730eee

SHA256
69b18a84e6c40a18ff8153676f5b1936824d7ab93313a1d2b73d324d517ea03c

SHA512
4488460ad3a4854d7bb41e7adb534aa68a6fa0f10d2ae2140493dc0a510e23e94d9295dcb71b22fc4e52bc01acab31a920d518e4e2a94d5f7a08f97c2cb41d89

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50199.exe

Filesize
468KB

MD5
99ed951cd988cb53e676e579c72020ef

SHA1
9c7f94f0c4d680cc1fabd823154e0e5be4b9aa71

SHA256
6968a3b647ebc40900751057eaf8a76520dc88c1696411354d269ab54da81a25

SHA512
2bb6a2b4a029f7f5526560cb2cd76ce4e669bd3eba3bc743d508a912bc23e37a4980f39f69f3592631d0f369c789565f4e68141624640381b53a8dccb2c2de90

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5061.exe

Filesize
468KB

MD5
6d3e61c32bad926aa93cd2e725ad0b73

SHA1
93796cb466d409039821f7e9de3a4cdce43c0948

SHA256
e98e85850dfae6690f786387023502e7dd7cf939b7e56a693dd28358df04d854

SHA512
8fcbb6e5a96f48e83e2712538d391102dd49b68f3e5a65220678817e1fb5ed7cd12d7213ae0c79834fc566e9b613e9a229741910be3123f6588ff3c5745e4889

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5383.exe

Filesize
468KB

MD5
029fbfdc0cf8e79b3aa7d3e306652e08

SHA1
839fbff75328b13e7bac65796ef6a104745b6a01

SHA256
87c8e5ebebdeeaae0cb841ebc168c753c332bb547af35a61d8a5e5a8fe8d4f22

SHA512
fb4478f9909616760d08e3160ffff10710a8f591250e02b12928b126f874fec3348252e7de4573cd98f848ec3fc8a29b9c49e5dcc80a5605d1139596601aadf2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58668.exe

Filesize
468KB

MD5
bdf09e1049333b0208722b0e6db7cfc8

SHA1
20fe4d763b3e15d0c4cb20d76fcc07f3e01afaa6

SHA256
30f62cc6fdc3ee76b8168554bca6561e17e3e5f596d1e3c178600bb8ac90db4e

SHA512
e39b8cb67599dd84c5b7d635e00dde46db7e3aa0d07b917bf3a5b1bfdcd4ca93c4f5fd7eed6727969ea19de097288364e467d2419ce0ddd72119c9d598c497f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59415.exe

Filesize
468KB

MD5
21df12a1c9aaa01f52da709eed146227

SHA1
d330c2d3ebe5af46249a79073426f7756af0a39d

SHA256
c323606268a3ee071a7fda498ae205095a590b84cdadb68d7b385050093c6d87

SHA512
d1aa1c374d82c924a30ef5c82fa318f06cb1badc139065083c0e34cfba63df161d58f633f2442718d525920472b186dc5c4485601623b3a2f8660d308124f93a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5959.exe

Filesize
468KB

MD5
95443b72451f4b3935a8169a1fd193f0

SHA1
eb2fa6d8b85eda2ea2764a62c59b67b0b4f5ba24

SHA256
cf50dbbb1ba6152a6a7f47763e27e13590364efdb0bbc164465af5627c7fb0b0

SHA512
9db7c0685dfe18a7bfb4a1e251d8ec580a7080aaed9c9a9038c28928b07b53427f3d1ad4ef421804d40412238bf8887b322caa5cc3ba97302a1c3f27ebe3d802

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61932.exe

Filesize
468KB

MD5
4b49a5234d8e152b5c820af801010b53

SHA1
3c11e33c51b42c88e55863f3b2176fe78ef3d7be

SHA256
6c98b78cc5cc48f449688fb78018aade3c7472b1a95b668e9adadf7af2d7e39e

SHA512
27b101a929f4d7483ea80e300587e1c980db1e820e507a1998dfd6997d6109067d2dcefab070a3f442476bc0e54d6fe3a66a73f24aefaab1e6150ebe88083fa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6544.exe

Filesize
468KB

MD5
1844e69f782212afefb1b3d68879667a

SHA1
602e1b2dada2423689dfd9d52ce4d5de908e7c35

SHA256
901363664b8d7a42fc7cf9ae57a80d49f67891ba4e16e70b4e5e6628dcc342b2

SHA512
1cfe4d987ddbea6b1f3152d5e8d5f8ecfc85b884bff9fbcfd0c44e38341eccdacb676b9088fb392607bd80fc1f168b93796230f3f12d559a4207fde76dba7684

Download Submit
memory/8-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/396-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/652-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/724-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/736-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1080-196-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1168-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1176-540-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1372-203-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1512-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1644-255-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1816-298-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1832-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1872-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1888-103-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1896-159-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2036-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2188-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2204-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2212-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2360-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2468-157-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2552-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2580-217-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-158-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2804-118-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2976-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3124-137-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3168-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3276-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3296-553-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3308-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3316-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3356-167-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3380-310-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3392-458-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3520-168-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3860-142-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4020-160-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4140-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4260-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4304-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4308-58-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4324-88-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4332-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4344-39-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4420-473-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4484-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4548-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4552-87-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4592-476-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4600-67-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4780-89-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5140-538-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5168-474-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5176-466-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5180-368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5228-371-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5268-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5320-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5328-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5340-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5392-539-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5396-477-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5400-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5424-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5432-475-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5440-550-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5444-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5452-568-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5472-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5492-499-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5496-388-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5512-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5568-389-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5576-482-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5584-552-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5592-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5628-394-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5648-489-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5660-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5668-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5680-551-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5704-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5764-500-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5812-557-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5816-501-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5908-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5916-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5980-419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6028-446-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6052-514-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6060-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6072-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6096-525-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6100-457-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15100-2359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads