69500886c4f2af831164d69a782f8174fc7c4f74f71f324ba7728ccb3d2c9ef5

Analysis

max time kernel
119s
max time network
110s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/09/2024, 21:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5fb9020ceb6fb747fd3a20570e8970d0N.exe
Size

468KB
MD5

5fb9020ceb6fb747fd3a20570e8970d0
SHA1

4860f80c3a9465d743e8b3a735576b8b6492d692
SHA256

69500886c4f2af831164d69a782f8174fc7c4f74f71f324ba7728ccb3d2c9ef5
SHA512

7415b96498969f33fc10f005a776a9e9a49c7ce94b110bb4f624bcf74b65b3e45000c61c82cbfe7c83a96e75bee7eb126f773537a494cfeb243544549f97a0ad
SSDEEP

3072:tqonoiLNjy8U6bYPez5jYf5EChAoIpBvmHePVsOzs7GXchN+GlE:tqEoWLU6ke1jYfR0/ZzsKMhN+

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
408	Unicorn-65053.exe
3308	Unicorn-45785.exe
4956	Unicorn-25919.exe
2480	Unicorn-62168.exe
3224	Unicorn-27358.exe
4972	Unicorn-7492.exe
4008	Unicorn-1383.exe
3140	Unicorn-47368.exe
2180	Unicorn-40004.exe
3752	Unicorn-34138.exe
2288	Unicorn-20403.exe
2104	Unicorn-28654.exe
3844	Unicorn-31206.exe
2308	Unicorn-59703.exe
3252	Unicorn-50144.exe
4828	Unicorn-49096.exe
428	Unicorn-38882.exe
1204	Unicorn-59402.exe
1656	Unicorn-28982.exe
1376	Unicorn-37648.exe
4544	Unicorn-14285.exe
2876	Unicorn-43542.exe
4520	Unicorn-43542.exe
4448	Unicorn-21961.exe
4164	Unicorn-10677.exe
4212	Unicorn-59485.exe
1548	Unicorn-45899.exe
1064	Unicorn-29828.exe
4864	Unicorn-4154.exe
1036	Unicorn-30190.exe
3448	Unicorn-13107.exe
3508	Unicorn-6008.exe
1200	Unicorn-5743.exe
4664	Unicorn-18261.exe
4716	Unicorn-18261.exe
464	Unicorn-11716.exe
3980	Unicorn-6116.exe
1604	Unicorn-46855.exe
1644	Unicorn-55785.exe
1876	Unicorn-55785.exe
1152	Unicorn-30766.exe
2284	Unicorn-30766.exe
3716	Unicorn-48686.exe
2784	Unicorn-28266.exe
1584	Unicorn-65489.exe
4396	Unicorn-34763.exe
2500	Unicorn-22776.exe
812	Unicorn-33636.exe
232	Unicorn-16554.exe
4356	Unicorn-40735.exe
2296	Unicorn-43808.exe
1772	Unicorn-44073.exe
212	Unicorn-4109.exe
1392	Unicorn-44380.exe
4732	Unicorn-12832.exe
932	Unicorn-11208.exe
2656	Unicorn-49838.exe
2268	Unicorn-50103.exe
4032	Unicorn-36782.exe
3236	Unicorn-44628.exe
1192	Unicorn-27636.exe
872	Unicorn-44649.exe
3296	Unicorn-25852.exe
3108	Unicorn-53886.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
6576	4268	WerFault.exe	160
5424	5744	WerFault.exe	187
9028	2344	WerFault.exe	199
11132	7100	WerFault.exe	263

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-876.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15027.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20336.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65422.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39081.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60785.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6008.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30726.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50736.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60055.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30420.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45899.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62630.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37585.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56543.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25381.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54372.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45412.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32973.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25981.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61706.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3855.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54649.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28509.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20336.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-180.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11845.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11981.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42623.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20014.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13792.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22148.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9568.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56821.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54848.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41783.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64794.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21961.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14015.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15784	dwm.exe
Token: SeChangeNotifyPrivilege	15784	dwm.exe
Token: 33	15784	dwm.exe
Token: SeIncBasePriorityPrivilege	15784	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
448	5fb9020ceb6fb747fd3a20570e8970d0N.exe
408	Unicorn-65053.exe
3308	Unicorn-45785.exe
4956	Unicorn-25919.exe
3224	Unicorn-27358.exe
2480	Unicorn-62168.exe
4008	Unicorn-1383.exe
4972	Unicorn-7492.exe
3140	Unicorn-47368.exe
3752	Unicorn-34138.exe
2180	Unicorn-40004.exe
2288	Unicorn-20403.exe
2104	Unicorn-28654.exe
3844	Unicorn-31206.exe
2308	Unicorn-59703.exe
3252	Unicorn-50144.exe
4828	Unicorn-49096.exe
428	Unicorn-38882.exe
1376	Unicorn-37648.exe
4544	Unicorn-14285.exe
1656	Unicorn-28982.exe
1204	Unicorn-59402.exe
2876	Unicorn-43542.exe
4520	Unicorn-43542.exe
4448	Unicorn-21961.exe
4164	Unicorn-10677.exe
4212	Unicorn-59485.exe
1548	Unicorn-45899.exe
1064	Unicorn-29828.exe
4864	Unicorn-4154.exe
1036	Unicorn-30190.exe
3448	Unicorn-13107.exe
3508	Unicorn-6008.exe
4664	Unicorn-18261.exe
1200	Unicorn-5743.exe
1604	Unicorn-46855.exe
1644	Unicorn-55785.exe
1876	Unicorn-55785.exe
1152	Unicorn-30766.exe
2284	Unicorn-30766.exe
3980	Unicorn-6116.exe
4716	Unicorn-18261.exe
464	Unicorn-11716.exe
3716	Unicorn-48686.exe
2784	Unicorn-28266.exe
1584	Unicorn-65489.exe
2500	Unicorn-22776.exe
812	Unicorn-33636.exe
4356	Unicorn-40735.exe
232	Unicorn-16554.exe
2296	Unicorn-43808.exe
1772	Unicorn-44073.exe
212	Unicorn-4109.exe
4732	Unicorn-12832.exe
1392	Unicorn-44380.exe
2268	Unicorn-50103.exe
2656	Unicorn-49838.exe
932	Unicorn-11208.exe
3236	Unicorn-44628.exe
1192	Unicorn-27636.exe
4032	Unicorn-36782.exe
872	Unicorn-44649.exe
3108	Unicorn-53886.exe
3296	Unicorn-25852.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 448 wrote to memory of 408	448	5fb9020ceb6fb747fd3a20570e8970d0N.exe	88
PID 448 wrote to memory of 408	448	5fb9020ceb6fb747fd3a20570e8970d0N.exe	88
PID 448 wrote to memory of 408	448	5fb9020ceb6fb747fd3a20570e8970d0N.exe	88
PID 408 wrote to memory of 3308	408	Unicorn-65053.exe	93
PID 408 wrote to memory of 3308	408	Unicorn-65053.exe	93
PID 408 wrote to memory of 3308	408	Unicorn-65053.exe	93
PID 448 wrote to memory of 4956	448	5fb9020ceb6fb747fd3a20570e8970d0N.exe	94
PID 448 wrote to memory of 4956	448	5fb9020ceb6fb747fd3a20570e8970d0N.exe	94
PID 448 wrote to memory of 4956	448	5fb9020ceb6fb747fd3a20570e8970d0N.exe	94
PID 3308 wrote to memory of 2480	3308	Unicorn-45785.exe	96
PID 3308 wrote to memory of 2480	3308	Unicorn-45785.exe	96
PID 3308 wrote to memory of 2480	3308	Unicorn-45785.exe	96
PID 4956 wrote to memory of 3224	4956	Unicorn-25919.exe	97
PID 4956 wrote to memory of 3224	4956	Unicorn-25919.exe	97
PID 4956 wrote to memory of 3224	4956	Unicorn-25919.exe	97
PID 408 wrote to memory of 4972	408	Unicorn-65053.exe	98
PID 408 wrote to memory of 4972	408	Unicorn-65053.exe	98
PID 408 wrote to memory of 4972	408	Unicorn-65053.exe	98
PID 448 wrote to memory of 4008	448	5fb9020ceb6fb747fd3a20570e8970d0N.exe	99
PID 448 wrote to memory of 4008	448	5fb9020ceb6fb747fd3a20570e8970d0N.exe	99
PID 448 wrote to memory of 4008	448	5fb9020ceb6fb747fd3a20570e8970d0N.exe	99
PID 3224 wrote to memory of 3140	3224	Unicorn-27358.exe	102
PID 3224 wrote to memory of 3140	3224	Unicorn-27358.exe	102
PID 3224 wrote to memory of 3140	3224	Unicorn-27358.exe	102
PID 448 wrote to memory of 2180	448	5fb9020ceb6fb747fd3a20570e8970d0N.exe	103
PID 448 wrote to memory of 2180	448	5fb9020ceb6fb747fd3a20570e8970d0N.exe	103
PID 448 wrote to memory of 2180	448	5fb9020ceb6fb747fd3a20570e8970d0N.exe	103
PID 408 wrote to memory of 3752	408	Unicorn-65053.exe	104
PID 408 wrote to memory of 3752	408	Unicorn-65053.exe	104
PID 408 wrote to memory of 3752	408	Unicorn-65053.exe	104
PID 3308 wrote to memory of 2288	3308	Unicorn-45785.exe	105
PID 3308 wrote to memory of 2288	3308	Unicorn-45785.exe	105
PID 3308 wrote to memory of 2288	3308	Unicorn-45785.exe	105
PID 4008 wrote to memory of 2104	4008	Unicorn-1383.exe	106
PID 4008 wrote to memory of 2104	4008	Unicorn-1383.exe	106
PID 4008 wrote to memory of 2104	4008	Unicorn-1383.exe	106
PID 4956 wrote to memory of 3844	4956	Unicorn-25919.exe	107
PID 4956 wrote to memory of 3844	4956	Unicorn-25919.exe	107
PID 4956 wrote to memory of 3844	4956	Unicorn-25919.exe	107
PID 3140 wrote to memory of 2308	3140	Unicorn-47368.exe	108
PID 3140 wrote to memory of 2308	3140	Unicorn-47368.exe	108
PID 3140 wrote to memory of 2308	3140	Unicorn-47368.exe	108
PID 3224 wrote to memory of 3252	3224	Unicorn-27358.exe	109
PID 3224 wrote to memory of 3252	3224	Unicorn-27358.exe	109
PID 3224 wrote to memory of 3252	3224	Unicorn-27358.exe	109
PID 2288 wrote to memory of 4828	2288	Unicorn-20403.exe	110
PID 2288 wrote to memory of 4828	2288	Unicorn-20403.exe	110
PID 2288 wrote to memory of 4828	2288	Unicorn-20403.exe	110
PID 3308 wrote to memory of 428	3308	Unicorn-45785.exe	111
PID 3308 wrote to memory of 428	3308	Unicorn-45785.exe	111
PID 3308 wrote to memory of 428	3308	Unicorn-45785.exe	111
PID 3752 wrote to memory of 4544	3752	Unicorn-34138.exe	112
PID 3752 wrote to memory of 4544	3752	Unicorn-34138.exe	112
PID 3752 wrote to memory of 4544	3752	Unicorn-34138.exe	112
PID 2180 wrote to memory of 1204	2180	Unicorn-40004.exe	113
PID 2180 wrote to memory of 1204	2180	Unicorn-40004.exe	113
PID 2180 wrote to memory of 1204	2180	Unicorn-40004.exe	113
PID 448 wrote to memory of 1656	448	5fb9020ceb6fb747fd3a20570e8970d0N.exe	114
PID 448 wrote to memory of 1656	448	5fb9020ceb6fb747fd3a20570e8970d0N.exe	114
PID 448 wrote to memory of 1656	448	5fb9020ceb6fb747fd3a20570e8970d0N.exe	114
PID 408 wrote to memory of 1376	408	Unicorn-65053.exe	115
PID 408 wrote to memory of 1376	408	Unicorn-65053.exe	115
PID 408 wrote to memory of 1376	408	Unicorn-65053.exe	115
PID 2480 wrote to memory of 2876	2480	Unicorn-62168.exe	116

C:\Users\Admin\AppData\Local\Temp\5fb9020ceb6fb747fd3a20570e8970d0N.exe
"C:\Users\Admin\AppData\Local\Temp\5fb9020ceb6fb747fd3a20570e8970d0N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:448
- C:\Users\Admin\AppData\Local\Temp\Unicorn-65053.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-65053.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45785.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45785.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62168.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43542.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48686.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49501.exe
        7⤵
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51421.exe
        8⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54649.exe
        9⤵
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38547.exe
        10⤵
        
        PID:16340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4932.exe
        10⤵
        
        PID:17480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        9⤵
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56437.exe
        9⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57425.exe
        8⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5317.exe
        8⤵
        
        PID:13440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28047.exe
        7⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55033.exe
        8⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51390.exe
        8⤵
        
        PID:12408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9923.exe
        8⤵
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39749.exe
        7⤵
        
        PID:9944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39086.exe
        7⤵
        
        PID:11816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56259.exe
        7⤵
        
        PID:17032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2993.exe
        6⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64358.exe
        7⤵
        
        PID:5124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54649.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16025.exe
        9⤵
        
        PID:12516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53941.exe
        9⤵
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        8⤵
        
        PID:12144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51083.exe
        8⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28617.exe
        8⤵
        
        PID:17708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58306.exe
        7⤵
        
        PID:11208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51229.exe
        7⤵
        
        PID:14896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40372.exe
        7⤵
        
        PID:7776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8150.exe
        6⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-295.exe
        7⤵
        
        PID:8104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45853.exe
        7⤵
        
        PID:12104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37653.exe
        7⤵
        
        PID:17356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62635.exe
        6⤵
        
        PID:9104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16715.exe
        6⤵
        
        PID:13400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14835.exe
        6⤵
        
        PID:5768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61130.exe
        6⤵
        
        PID:10232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34763.exe
        5⤵
        Executes dropped EXE
        
        PID:4396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49309.exe
        6⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53860.exe
        7⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6517.exe
        8⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28049.exe
        9⤵
        
        PID:15684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7646.exe
        9⤵
        
        PID:17988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        8⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65473.exe
        8⤵
        
        PID:16752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35935.exe
        7⤵
        
        PID:9228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19515.exe
        7⤵
        
        PID:13364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41855.exe
        7⤵
        
        PID:7512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64612.exe
        6⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54649.exe
        7⤵
        
        PID:6576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        7⤵
        
        PID:11388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56729.exe
        7⤵
        
        PID:4280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22587.exe
        7⤵
        
        PID:17696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5623.exe
        6⤵
        
        PID:8028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
        6⤵
        
        PID:13464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18991.exe
        6⤵
        
        PID:16620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31525.exe
        5⤵
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54135.exe
        6⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27706.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
        7⤵
        
        PID:12652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24313.exe
        7⤵
        
        PID:7044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20559.exe
        6⤵
        
        PID:10040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50736.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21321.exe
        6⤵
        
        PID:8956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34974.exe
        5⤵
        
        PID:7636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33710.exe
        6⤵
        
        PID:9208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31135.exe
        6⤵
        
        PID:14412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57305.exe
        6⤵
        
        PID:16188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6058.exe
        6⤵
        
        PID:9356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39975.exe
        5⤵
        
        PID:11120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38766.exe
        5⤵
        
        PID:15912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24534.exe
        5⤵
        
        PID:17632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20403.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49096.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6008.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53886.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13320.exe
        8⤵
        
        PID:5228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21162.exe
        9⤵
        
        PID:7464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27213.exe
        10⤵
        
        PID:7964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57119.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:12768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9376.exe
        9⤵
        
        PID:10584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17268.exe
        9⤵
        
        PID:14508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35952.exe
        9⤵
        
        PID:16040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11783.exe
        9⤵
        
        PID:17592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50580.exe
        8⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25607.exe
        8⤵
        
        PID:10344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7044.exe
        8⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42847.exe
        7⤵
        
        PID:3312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8800.exe
        8⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5317.exe
        8⤵
        
        PID:13092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40036.exe
        8⤵
        
        PID:6092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7315.exe
        8⤵
        
        PID:17744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58908.exe
        7⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
        7⤵
        
        PID:12696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63486.exe
        6⤵
        
        PID:4268
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 640
        7⤵
        Program crash
        
        PID:6576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32573.exe
        6⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47031.exe
        7⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42339.exe
        7⤵
        
        PID:16264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47283.exe
        7⤵
        
        PID:9060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60934.exe
        6⤵
        
        PID:10916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16973.exe
        6⤵
        
        PID:1452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53346.exe
        6⤵
        
        PID:17772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11716.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5069.exe
        6⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25464.exe
        7⤵
        
        PID:5348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26637.exe
        8⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34473.exe
        9⤵
        
        PID:12808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        9⤵
        
        PID:8244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        8⤵
        
        PID:11416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57305.exe
        8⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63427.exe
        8⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57425.exe
        7⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5317.exe
        7⤵
        
        PID:12160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26707.exe
        6⤵
        
        PID:5168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33430.exe
        7⤵
        
        PID:12524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45555.exe
        7⤵
        
        PID:19284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41504.exe
        6⤵
        
        PID:10536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27286.exe
        6⤵
        
        PID:13764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62923.exe
        6⤵
        
        PID:7812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48140.exe
        5⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34701.exe
        6⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54649.exe
        7⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57305.exe
        7⤵
        
        PID:16028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57425.exe
        6⤵
        
        PID:9236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5317.exe
        6⤵
        
        PID:2712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42174.exe
        6⤵
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32203.exe
        6⤵
        
        PID:10032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14015.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49496.exe
        6⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43544.exe
        7⤵
        
        PID:12756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64631.exe
        7⤵
        
        PID:10812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        6⤵
        
        PID:11376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20548.exe
        6⤵
        
        PID:17276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31987.exe
        5⤵
        
        PID:9704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40719.exe
        5⤵
        
        PID:13820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41029.exe
        5⤵
        
        PID:17244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38882.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13107.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44649.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-876.exe
        7⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39444.exe
        8⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39159.exe
        9⤵
        
        PID:12452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28509.exe
        8⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64279.exe
        8⤵
        
        PID:10992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18821.exe
        8⤵
        
        PID:2964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20730.exe
        7⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21479.exe
        8⤵
        
        PID:12372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39485.exe
        8⤵
        
        PID:15884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41418.exe
        8⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29499.exe
        7⤵
        
        PID:10464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11447.exe
        7⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19951.exe
        7⤵
        
        PID:17720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9302.exe
        6⤵
        
        PID:6868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18910.exe
        7⤵
        
        PID:2604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53492.exe
        7⤵
        
        PID:16320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41418.exe
        7⤵
        
        PID:17796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16506.exe
        6⤵
        
        PID:10960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-836.exe
        6⤵
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45024.exe
        6⤵
        
        PID:17488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25852.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57176.exe
        6⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21162.exe
        7⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64794.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-591.exe
        8⤵
        
        PID:15940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41418.exe
        8⤵
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49999.exe
        7⤵
        
        PID:9348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31840.exe
        7⤵
        
        PID:16052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20640.exe
        7⤵
        
        PID:6388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63901.exe
        6⤵
        
        PID:6812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20336.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54378.exe
        6⤵
        
        PID:10628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28762.exe
        5⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31598.exe
        6⤵
        
        PID:8296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        6⤵
        
        PID:11340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28973.exe
        6⤵
        
        PID:17564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40653.exe
        5⤵
        
        PID:9712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9123.exe
        5⤵
        
        PID:13864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29801.exe
        5⤵
        
        PID:6104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-637.exe
        5⤵
        
        PID:17908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5743.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44457.exe
        5⤵
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25080.exe
        6⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21162.exe
        7⤵
        
        PID:7432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28509.exe
        7⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46537.exe
        7⤵
        
        PID:1616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4496.exe
        7⤵
        
        PID:18240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63901.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38152.exe
        7⤵
        
        PID:11664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8056.exe
        7⤵
        
        PID:16928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25607.exe
        6⤵
        
        PID:10356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49421.exe
        6⤵
        
        PID:17372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16100.exe
        5⤵
        
        PID:6912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-77.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-77.exe
        6⤵
        
        PID:9428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57119.exe
        6⤵
        
        PID:13472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59059.exe
        6⤵
        
        PID:17020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25877.exe
        6⤵
        
        PID:19152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9132.exe
        5⤵
        
        PID:10948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42756.exe
        5⤵
        
        PID:14548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60336.exe
        5⤵
        
        PID:16952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36595.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36595.exe
      4⤵
      PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57176.exe
        5⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe
        6⤵
        
        PID:4404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24198.exe
        7⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50020.exe
        7⤵
        
        PID:11720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48463.exe
        6⤵
        
        PID:10304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60165.exe
        6⤵
        
        PID:14992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42829.exe
        6⤵
        
        PID:16896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5572.exe
        5⤵
        
        PID:7852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47197.exe
        6⤵
        
        PID:10452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29959.exe
        6⤵
        
        PID:16712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28731.exe
        5⤵
        
        PID:11240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55988.exe
        5⤵
        
        PID:16064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32395.exe
        5⤵
        
        PID:9176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39276.exe
      4⤵
      PID:6416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41664.exe
        5⤵
        
        PID:9312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5317.exe
        5⤵
        
        PID:13452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35952.exe
        5⤵
        
        PID:5784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3231.exe
        5⤵
        
        PID:9584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15112.exe
      4⤵
      PID:9772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57908.exe
        5⤵
        
        PID:14600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43569.exe
        5⤵
        
        PID:16116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16721.exe
        5⤵
        
        PID:7788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
      4⤵
      PID:13808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53441.exe
      4⤵
      PID:15616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7492.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43542.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28266.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5453.exe
        6⤵
        
        PID:5580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64742.exe
        7⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39766.exe
        8⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7830.exe
        9⤵
        
        PID:13604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12332.exe
        9⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4628.exe
        8⤵
        
        PID:11732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60686.exe
        8⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21052.exe
        7⤵
        
        PID:9812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40430.exe
        7⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5561.exe
        7⤵
        
        PID:7672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60340.exe
        6⤵
        
        PID:7708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50596.exe
        7⤵
        
        PID:11684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59587.exe
        7⤵
        
        PID:9052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18452.exe
        6⤵
        
        PID:10580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50421.exe
        6⤵
        
        PID:16160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21890.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4062.exe
        5⤵
        
        PID:5632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20695.exe
        6⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6517.exe
        7⤵
        
        PID:8148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45848.exe
        8⤵
        
        PID:14312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25544.exe
        8⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33408.exe
        7⤵
        
        PID:12188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12956.exe
        7⤵
        
        PID:4888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20668.exe
        6⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44212.exe
        6⤵
        
        PID:13492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52161.exe
        6⤵
        
        PID:6044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3957.exe
        5⤵
        
        PID:7080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-679.exe
        6⤵
        
        PID:8468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4628.exe
        6⤵
        
        PID:11796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48434.exe
        6⤵
        
        PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6719.exe
        5⤵
        
        PID:9876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30420.exe
        5⤵
        
        PID:13396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35512.exe
        5⤵
        
        PID:8272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65489.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65489.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7399.exe
        5⤵
        
        PID:5652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14280.exe
        6⤵
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49496.exe
        7⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        7⤵
        
        PID:4124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3647.exe
        6⤵
        
        PID:9756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27109.exe
        6⤵
        
        PID:13848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6547.exe
        6⤵
        
        PID:8544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28047.exe
        5⤵
        
        PID:1840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5832.exe
        6⤵
        
        PID:8408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34477.exe
        6⤵
        
        PID:9496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50123.exe
        6⤵
        
        PID:15972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10334.exe
        6⤵
        
        PID:4004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33445.exe
        5⤵
        
        PID:9476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61915.exe
        5⤵
        
        PID:15020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-637.exe
        5⤵
        
        PID:3300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16589.exe
        5⤵
        
        PID:17896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24042.exe
      4⤵
      PID:5744
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5744 -s 720
        5⤵
        Program crash
        
        PID:5424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22447.exe
      4⤵
      PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        5⤵
        
        PID:8788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16007.exe
        5⤵
        
        PID:13800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26479.exe
        5⤵
        
        PID:9540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59544.exe
      4⤵
      PID:10180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9420.exe
      4⤵
      PID:12304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24085.exe
      4⤵
      PID:4564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57323.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57323.exe
      4⤵
      PID:7616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34138.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34138.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14285.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55785.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64877.exe
        6⤵
        
        PID:412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8359.exe
        7⤵
        
        PID:6136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26398.exe
        8⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15764.exe
        8⤵
        
        PID:10712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23480.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4304.exe
        8⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56164.exe
        7⤵
        
        PID:8760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32753.exe
        7⤵
        
        PID:12252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11447.exe
        7⤵
        
        PID:2864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13921.exe
        7⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15027.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61255.exe
        7⤵
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41022.exe
        8⤵
        
        PID:11396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37220.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        7⤵
        
        PID:11344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30086.exe
        7⤵
        
        PID:16024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47283.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56277.exe
        6⤵
        
        PID:9788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17788.exe
        6⤵
        
        PID:13852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46337.exe
        6⤵
        
        PID:15900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23644.exe
        6⤵
        
        PID:10316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20014.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8359.exe
        6⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45412.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44212.exe
        7⤵
        
        PID:13520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8224.exe
        6⤵
        
        PID:4112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19515.exe
        6⤵
        
        PID:13356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27657.exe
        6⤵
        
        PID:5604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56855.exe
        5⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31053.exe
        6⤵
        
        PID:11908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8056.exe
        6⤵
        
        PID:15864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61119.exe
        5⤵
        
        PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34039.exe
        5⤵
        
        PID:548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56319.exe
        5⤵
        
        PID:17520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30766.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39880.exe
        5⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34701.exe
        6⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45412.exe
        7⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        7⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48945.exe
        7⤵
        
        PID:16740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48104.exe
        7⤵
        
        PID:19428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3647.exe
        6⤵
        
        PID:9764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60055.exe
        6⤵
        
        PID:13932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18821.exe
        6⤵
        
        PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52853.exe
        5⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26637.exe
        6⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34068.exe
        7⤵
        
        PID:11636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35593.exe
        7⤵
        
        PID:17256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
        6⤵
        
        PID:11428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54848.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5623.exe
        5⤵
        
        PID:8160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
        5⤵
        
        PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34852.exe
        5⤵
        
        PID:17364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13329.exe
      4⤵
      PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56190.exe
        5⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45412.exe
        6⤵
        
        PID:8224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34477.exe
        6⤵
        
        PID:10296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60813.exe
        6⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24725.exe
        6⤵
        
        PID:17528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3647.exe
        5⤵
        
        PID:9740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27109.exe
        5⤵
        
        PID:13872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33508.exe
        5⤵
        
        PID:1400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60785.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36081.exe
      4⤵
      PID:6072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45412.exe
        5⤵
        
        PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        5⤵
        
        PID:12236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6158.exe
        5⤵
        
        PID:16388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20448.exe
        5⤵
        
        PID:17644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31987.exe
      4⤵
      PID:9696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-180.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57046.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57046.exe
      4⤵
      PID:10612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37648.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37648.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18261.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18261.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19460.exe
        5⤵
        
        PID:5216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51914.exe
        6⤵
        
        PID:6048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-679.exe
        7⤵
        
        PID:8476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4628.exe
        7⤵
        
        PID:12096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60813.exe
        7⤵
        
        PID:5680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10334.exe
        7⤵
        
        PID:8048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47503.exe
        6⤵
        
        PID:9920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2604.exe
        6⤵
        
        PID:14168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2782.exe
        6⤵
        
        PID:1720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64612.exe
        5⤵
        
        PID:5136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54649.exe
        6⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40695.exe
        7⤵
        
        PID:3552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43569.exe
        7⤵
        
        PID:16196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61646.exe
        7⤵
        
        PID:17924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        6⤵
        
        PID:12276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47383.exe
        6⤵
        
        PID:17216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39744.exe
        6⤵
        
        PID:19328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exe
        5⤵
        
        PID:1208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25381.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13792.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64742.exe
        5⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44727.exe
        6⤵
        
        PID:8424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        6⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42339.exe
        6⤵
        
        PID:16288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43418.exe
        5⤵
        
        PID:9972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2604.exe
        5⤵
        
        PID:13768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2463.exe
        5⤵
        
        PID:7548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41783.exe
      4⤵
      PID:4488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55033.exe
        5⤵
        
        PID:8616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10871.exe
        6⤵
        
        PID:12532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41047.exe
        6⤵
        
        PID:1648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24889.exe
        6⤵
        
        PID:10400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19018.exe
        5⤵
        
        PID:11392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20164.exe
        5⤵
        
        PID:17052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20230.exe
        5⤵
        
        PID:19240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45614.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45614.exe
      4⤵
      PID:9952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30420.exe
      4⤵
      PID:13584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14835.exe
      4⤵
      PID:6068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61706.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46855.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46855.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55640.exe
      4⤵
      PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52983.exe
        5⤵
        
        PID:2200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10108.exe
        6⤵
        
        PID:8312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        6⤵
        
        PID:10524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63527.exe
        6⤵
        
        PID:2032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61481.exe
        6⤵
        
        PID:17756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58306.exe
        5⤵
        
        PID:11200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51229.exe
        5⤵
        
        PID:14888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62289.exe
        5⤵
        
        PID:1100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22082.exe
        5⤵
        
        PID:8824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55759.exe
      4⤵
      PID:7088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34120.exe
        5⤵
        
        PID:8640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16007.exe
        5⤵
        
        PID:13792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56821.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29141.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29141.exe
      4⤵
      PID:10088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39086.exe
      4⤵
      PID:14656
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49116.exe
      4⤵
      PID:10116
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3231.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3231.exe
    3⤵
    PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41800.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41800.exe
      4⤵
      PID:4380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52848.exe
        5⤵
        
        PID:9468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5317.exe
        5⤵
        
        PID:12488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60521.exe
        5⤵
        
        PID:5944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3647.exe
      4⤵
      PID:9664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27109.exe
      4⤵
      PID:13900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25981.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6072.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6072.exe
    3⤵
    PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29076.exe
      4⤵
      PID:7936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35006.exe
      4⤵
      PID:11936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25618.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25618.exe
      4⤵
      PID:15856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26863.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35107.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35107.exe
    3⤵
    PID:4268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41718.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41718.exe
    3⤵
    PID:13344
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25919.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25919.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27358.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27358.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47368.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59703.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33636.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32973.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58136.exe
        8⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-679.exe
        9⤵
        
        PID:8492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4628.exe
        9⤵
        
        PID:1816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
        9⤵
        
        PID:16000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47283.exe
        9⤵
        
        PID:8944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37964.exe
        8⤵
        
        PID:10056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33412.exe
        8⤵
        
        PID:13992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63170.exe
        8⤵
        
        PID:15848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48732.exe
        8⤵
        
        PID:9492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53429.exe
        7⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36703.exe
        8⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49064.exe
        8⤵
        
        PID:14428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15212.exe
        8⤵
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55592.exe
        7⤵
        
        PID:4836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18172.exe
        7⤵
        
        PID:14072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32395.exe
        7⤵
        
        PID:9676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34325.exe
        6⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62173.exe
        7⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9397.exe
        8⤵
        
        PID:10976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31820.exe
        8⤵
        
        PID:14556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20164.exe
        8⤵
        
        PID:17044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42656.exe
        7⤵
        
        PID:9828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10950.exe
        7⤵
        
        PID:4644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47648.exe
        6⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-77.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-77.exe
        7⤵
        
        PID:9436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30476.exe
        7⤵
        
        PID:13504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-275.exe
        6⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62785.exe
        6⤵
        
        PID:15008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37996.exe
        6⤵
        
        PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30190.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36782.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46569.exe
        7⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21162.exe
        8⤵
        
        PID:7424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11981.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57305.exe
        9⤵
        
        PID:15964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6058.exe
        9⤵
        
        PID:9516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28509.exe
        8⤵
        
        PID:10900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23480.exe
        8⤵
        
        PID:16096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41061.exe
        8⤵
        
        PID:10744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53403.exe
        7⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38244.exe
        7⤵
        
        PID:11580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62594.exe
        7⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26173.exe
        7⤵
        
        PID:17608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27855.exe
        6⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        7⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16007.exe
        7⤵
        
        PID:13888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38347.exe
        7⤵
        
        PID:8692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56277.exe
        6⤵
        
        PID:9796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17788.exe
        6⤵
        
        PID:13876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2847.exe
        6⤵
        
        PID:7016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27636.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2137.exe
        6⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21162.exe
        7⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10300.exe
        8⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16796.exe
        9⤵
        
        PID:18780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
        8⤵
        
        PID:12616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39280.exe
        8⤵
        
        PID:10852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12692.exe
        7⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45391.exe
        7⤵
        
        PID:15052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52624.exe
        7⤵
        
        PID:7800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63901.exe
        6⤵
        
        PID:6696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20336.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58205.exe
        6⤵
        
        PID:544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45024.exe
        6⤵
        
        PID:17836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3709.exe
        5⤵
        
        PID:5416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49496.exe
        6⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59833.exe
        7⤵
        
        PID:11472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-399.exe
        7⤵
        
        PID:16940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1921.exe
        7⤵
        
        PID:19296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        6⤵
        
        PID:12136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47064.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14582.exe
        5⤵
        
        PID:9612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
        5⤵
        
        PID:14052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40710.exe
        5⤵
        
        PID:10660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50144.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50144.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29828.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50103.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21742.exe
        7⤵
        
        PID:4116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26637.exe
        8⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        8⤵
        
        PID:11272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59059.exe
        8⤵
        
        PID:17060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56603.exe
        8⤵
        
        PID:19108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5623.exe
        7⤵
        
        PID:632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
        7⤵
        
        PID:12392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9004.exe
        7⤵
        
        PID:3784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36280.exe
        7⤵
        
        PID:17552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54031.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16824.exe
        7⤵
        
        PID:8032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21479.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21479.exe
        8⤵
        
        PID:12416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51110.exe
        8⤵
        
        PID:4808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32531.exe
        7⤵
        
        PID:12076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65089.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63427.exe
        7⤵
        
        PID:7808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54824.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
        6⤵
        
        PID:13232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44628.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6029.exe
        6⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65209.exe
        7⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64436.exe
        8⤵
        
        PID:9276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25982.exe
        8⤵
        
        PID:14192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13750.exe
        8⤵
        
        PID:5280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47091.exe
        8⤵
        
        PID:17680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28509.exe
        7⤵
        
        PID:11128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63143.exe
        7⤵
        
        PID:16236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16556.exe
        7⤵
        
        PID:8896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35997.exe
        6⤵
        
        PID:7560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16902.exe
        7⤵
        
        PID:12592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49473.exe
        7⤵
        
        PID:8804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38244.exe
        6⤵
        
        PID:11608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18821.exe
        6⤵
        
        PID:5936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32573.exe
        5⤵
        
        PID:6588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29460.exe
        6⤵
        
        PID:8352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34477.exe
        6⤵
        
        PID:11276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12956.exe
        6⤵
        
        PID:15680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14582.exe
        5⤵
        
        PID:9632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62209.exe
        5⤵
        
        PID:13784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27817.exe
        5⤵
        
        PID:15968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41929.exe
        5⤵
        
        PID:9300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4154.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4154.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11208.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63014.exe
        6⤵
        
        PID:5960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21162.exe
        7⤵
        
        PID:7448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43549.exe
        8⤵
        
        PID:7828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17141.exe
        9⤵
        
        PID:17388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57119.exe
        8⤵
        
        PID:13512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36950.exe
        8⤵
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24835.exe
        7⤵
        
        PID:10440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61316.exe
        7⤵
        
        PID:14488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18310.exe
        7⤵
        
        PID:9512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63901.exe
        6⤵
        
        PID:4688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7820.exe
        7⤵
        
        PID:16268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23982.exe
        7⤵
        
        PID:17828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4118.exe
        6⤵
        
        PID:10844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45874.exe
        6⤵
        
        PID:16016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10029.exe
        6⤵
        
        PID:10824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5598.exe
        5⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27514.exe
        6⤵
        
        PID:8288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        6⤵
        
        PID:11712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60813.exe
        6⤵
        
        PID:15920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47283.exe
        6⤵
        
        PID:16404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17382.exe
        5⤵
        
        PID:9648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59860.exe
        5⤵
        
        PID:14788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56893.exe
        5⤵
        
        PID:5560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49838.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4083.exe
        5⤵
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39444.exe
        6⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16902.exe
        7⤵
        
        PID:12684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6878.exe
        7⤵
        
        PID:7772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28509.exe
        6⤵
        
        PID:11228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56921.exe
        6⤵
        
        PID:16296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46707.exe
        6⤵
        
        PID:6900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35997.exe
        5⤵
        
        PID:7556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38244.exe
        5⤵
        
        PID:11600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58767.exe
        5⤵
        
        PID:8808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22947.exe
      4⤵
      PID:6644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59693.exe
        5⤵
        
        PID:8064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51.exe
        5⤵
        
        PID:12728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47767.exe
        5⤵
        
        PID:15948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42478.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42478.exe
      4⤵
      PID:10172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30951.exe
      4⤵
      PID:13328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12189.exe
      4⤵
      PID:4388
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31206.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31206.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59485.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44073.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20228.exe
        6⤵
        
        PID:5912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42760.exe
        7⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15069.exe
        8⤵
        
        PID:8584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47227.exe
        8⤵
        
        PID:13424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35633.exe
        8⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52656.exe
        7⤵
        
        PID:9864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33220.exe
        7⤵
        
        PID:13332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21818.exe
        7⤵
        
        PID:7176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40574.exe
        6⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59833.exe
        7⤵
        
        PID:11464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43442.exe
        7⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42245.exe
        6⤵
        
        PID:11108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62786.exe
        6⤵
        
        PID:16140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61176.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61176.exe
        6⤵
        
        PID:7592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42847.exe
        5⤵
        
        PID:2976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-295.exe
        6⤵
        
        PID:8072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16692.exe
        6⤵
        
        PID:12404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53121.exe
        6⤵
        
        PID:10104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58908.exe
        5⤵
        
        PID:7580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
        5⤵
        
        PID:10312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58013.exe
        5⤵
        
        PID:16852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12832.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49693.exe
        5⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62173.exe
        6⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18910.exe
        7⤵
        
        PID:10188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8183.exe
        7⤵
        
        PID:15704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62222.exe
        7⤵
        
        PID:18040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35639.exe
        6⤵
        
        PID:10556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5417.exe
        6⤵
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11399.exe
        6⤵
        
        PID:17240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28047.exe
        5⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-679.exe
        6⤵
        
        PID:8456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32339.exe
        6⤵
        
        PID:11752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11228.exe
        6⤵
        
        PID:15984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16556.exe
        6⤵
        
        PID:8656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-854.exe
        5⤵
        
        PID:9884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39086.exe
        5⤵
        
        PID:10160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20937.exe
        5⤵
        
        PID:7280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2229.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2229.exe
      4⤵
      PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45412.exe
        5⤵
        
        PID:7532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        5⤵
        
        PID:12128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20613.exe
        5⤵
        
        PID:10236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64773.exe
      4⤵
      PID:7872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41412.exe
      4⤵
      PID:12672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45899.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45899.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4109.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20228.exe
        5⤵
        
        PID:5920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8717.exe
        6⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20109.exe
        7⤵
        
        PID:12468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46759.exe
        7⤵
        
        PID:6424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49999.exe
        6⤵
        
        PID:11144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50123.exe
        6⤵
        
        PID:16044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47283.exe
        6⤵
        
        PID:10800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17715.exe
        5⤵
        
        PID:7500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38090.exe
        6⤵
        
        PID:12800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6237.exe
        6⤵
        
        PID:736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57562.exe
        6⤵
        
        PID:17104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41451.exe
        5⤵
        
        PID:11280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58702.exe
        5⤵
        
        PID:16168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7891.exe
        5⤵
        
        PID:9684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12919.exe
      4⤵
      PID:6360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13507.exe
        5⤵
        
        PID:8024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
        5⤵
        
        PID:12660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53029.exe
        5⤵
        
        PID:16884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2142.exe
      4⤵
      PID:10164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30420.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18317.exe
      4⤵
      PID:17376
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44380.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40456.exe
      4⤵
      PID:6000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39444.exe
        5⤵
        
        PID:7392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25454.exe
        6⤵
        
        PID:13236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28509.exe
        5⤵
        
        PID:11076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29678.exe
        5⤵
        
        PID:16448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3325.exe
      4⤵
      PID:6864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34068.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6621.exe
        5⤵
        
        PID:16452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29499.exe
      4⤵
      PID:10940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54810.exe
      4⤵
      PID:16704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39386.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39386.exe
      4⤵
      PID:19008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16334.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16334.exe
    3⤵
    PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26637.exe
      4⤵
      PID:8128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45848.exe
        5⤵
        
        PID:14204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25095.exe
        5⤵
        
        PID:16728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10089.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:19408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
      4⤵
      PID:12176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3317.exe
      4⤵
      PID:3924
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15112.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15112.exe
    3⤵
    PID:9688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36254.exe
    3⤵
    PID:13836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53916.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53916.exe
    3⤵
    PID:2276
- C:\Users\Admin\AppData\Local\Temp\Unicorn-1383.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-1383.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28654.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28654.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21961.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22776.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62630.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35146.exe
        7⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13289.exe
        8⤵
        
        PID:10140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2848.exe
        8⤵
        
        PID:15032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58548.exe
        8⤵
        
        PID:17252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4035.exe
        7⤵
        
        PID:10384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2895.exe
        7⤵
        
        PID:15932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15867.exe
        7⤵
        
        PID:17500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16100.exe
        6⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10492.exe
        7⤵
        
        PID:8776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59833.exe
        8⤵
        
        PID:11440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3855.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61696.exe
        7⤵
        
        PID:12396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44542.exe
        7⤵
        
        PID:9484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32293.exe
        6⤵
        
        PID:9992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30420.exe
        6⤵
        
        PID:13216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65188.exe
        6⤵
        
        PID:15792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16698.exe
        5⤵
        
        PID:5876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15349.exe
        6⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54649.exe
        7⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39718.exe
        8⤵
        
        PID:13056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3279.exe
        8⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27927.exe
        8⤵
        
        PID:10144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        7⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42339.exe
        7⤵
        
        PID:16180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63427.exe
        7⤵
        
        PID:16616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43034.exe
        6⤵
        
        PID:9128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6323.exe
        7⤵
        
        PID:17540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19515.exe
        6⤵
        
        PID:13372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54299.exe
        6⤵
        
        PID:5736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41783.exe
        5⤵
        
        PID:6936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64654.exe
        6⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3066.exe
        6⤵
        
        PID:12712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55616.exe
        6⤵
        
        PID:17804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46190.exe
        5⤵
        
        PID:10208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30420.exe
        5⤵
        
        PID:12484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40735.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30726.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40814.exe
        6⤵
        
        PID:6804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23622.exe
        7⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59833.exe
        8⤵
        
        PID:11456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39293.exe
        8⤵
        
        PID:16872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26043.exe
        8⤵
        
        PID:12036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19594.exe
        7⤵
        
        PID:12612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54975.exe
        7⤵
        
        PID:17092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47887.exe
        6⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4139.exe
        6⤵
        
        PID:14396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44696.exe
        6⤵
        
        PID:16764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40574.exe
        5⤵
        
        PID:7644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38391.exe
        6⤵
        
        PID:12676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10077.exe
        6⤵
        
        PID:5820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12587.exe
        5⤵
        
        PID:11068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54618.exe
        5⤵
        
        PID:16276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23651.exe
        5⤵
        
        PID:16128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25747.exe
      4⤵
      PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-679.exe
        5⤵
        
        PID:8560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4628.exe
        5⤵
        
        PID:11724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1690.exe
        5⤵
        
        PID:16308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50791.exe
        5⤵
        
        PID:15852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55506.exe
      4⤵
      PID:11232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13776.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13776.exe
      4⤵
      PID:14908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10677.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10677.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16554.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36564.exe
        5⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39444.exe
        6⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53850.exe
        7⤵
        
        PID:12496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45197.exe
        7⤵
        
        PID:8988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28509.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3636.exe
        6⤵
        
        PID:15644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29193.exe
        6⤵
        
        PID:18252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35997.exe
        5⤵
        
        PID:7364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43569.exe
        6⤵
        
        PID:16396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64360.exe
        6⤵
        
        PID:17848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42328.exe
        5⤵
        
        PID:11548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23573.exe
        5⤵
        
        PID:6600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63569.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63569.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47721.exe
        5⤵
        
        PID:7100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26637.exe
        6⤵
        
        PID:8196
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 7100 -s 632
        6⤵
        Program crash
        
        PID:11132
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2344 -s 720
        5⤵
        Program crash
        
        PID:9028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41783.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59838.exe
        5⤵
        
        PID:9564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60165.exe
        5⤵
        
        PID:14284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2398.exe
        5⤵
        
        PID:15956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38418.exe
        5⤵
        
        PID:4532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61457.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61457.exe
      4⤵
      PID:3976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9507.exe
      4⤵
      PID:14040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1662.exe
      4⤵
      PID:6732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43808.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43808.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29465.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29465.exe
      4⤵
      PID:5892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52765.exe
        5⤵
        
        PID:7412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65422.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62276.exe
        6⤵
        
        PID:11432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23957.exe
        6⤵
        
        PID:8968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9568.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60165.exe
        5⤵
        
        PID:15004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10156.exe
        5⤵
        
        PID:16060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34051.exe
      4⤵
      PID:6716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29704.exe
        5⤵
        
        PID:14356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16351.exe
        5⤵
        
        PID:16184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24889.exe
        5⤵
        
        PID:10768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59349.exe
      4⤵
      PID:10364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1333.exe
      4⤵
      PID:4104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13921.exe
      4⤵
      PID:9568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8967.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8967.exe
    3⤵
    PID:512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22148.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22148.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42781.exe
        5⤵
        
        PID:8304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        5⤵
        
        PID:10512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34170.exe
        5⤵
        
        PID:3268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42623.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3647.exe
      4⤵
      PID:9748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60055.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55451.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55451.exe
      4⤵
      PID:17584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22447.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22447.exe
    3⤵
    PID:7076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43165.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43165.exe
      4⤵
      PID:9076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7830.exe
        5⤵
        
        PID:14540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12716.exe
        5⤵
        
        PID:10760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56543.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30086.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30086.exe
      4⤵
      PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20640.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20640.exe
      4⤵
      PID:9064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35917.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35917.exe
    3⤵
    PID:1004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62212.exe
    3⤵
    PID:13736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53506.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53506.exe
    3⤵
    PID:11024
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40004.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40004.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59402.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59402.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55785.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55785.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45526.exe
        5⤵
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64166.exe
        6⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45412.exe
        7⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        7⤵
        
        PID:12112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38320.exe
        7⤵
        
        PID:8232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44108.exe
        6⤵
        
        PID:11180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10388.exe
        6⤵
        
        PID:14792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31370.exe
        6⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23644.exe
        6⤵
        
        PID:10576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45453.exe
        5⤵
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61748.exe
        6⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        6⤵
        
        PID:12120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-193.exe
        6⤵
        
        PID:9264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11845.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
        5⤵
        
        PID:10696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21321.exe
        5⤵
        
        PID:8888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30621.exe
      4⤵
      PID:1456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8359.exe
        5⤵
        
        PID:2252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18038.exe
        6⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38884.exe
        7⤵
        
        PID:12636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3855.exe
        7⤵
        
        PID:16908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24508.exe
        6⤵
        
        PID:11588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38831.exe
        6⤵
        
        PID:16716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19407.exe
        5⤵
        
        PID:8600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15348.exe
        5⤵
        
        PID:12212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18821.exe
        5⤵
        
        PID:2100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53185.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53185.exe
      4⤵
      PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26868.exe
        5⤵
        
        PID:11756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18310.exe
        5⤵
        
        PID:9268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54328.exe
      4⤵
      PID:10504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37585.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55292.exe
      4⤵
      PID:9980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30766.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30766.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39880.exe
      4⤵
      PID:2392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8359.exe
        5⤵
        
        PID:5688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26637.exe
        6⤵
        
        PID:6856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        6⤵
        
        PID:4684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47767.exe
        6⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19599.exe
        5⤵
        
        PID:8340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5317.exe
        5⤵
        
        PID:13032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42174.exe
        5⤵
        
        PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30641.exe
        5⤵
        
        PID:18268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18042.exe
      4⤵
      PID:6740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21977.exe
        5⤵
        
        PID:7992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39133.exe
        6⤵
        
        PID:15076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22573.exe
        6⤵
        
        PID:3480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10499.exe
        6⤵
        
        PID:17656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4820.exe
        5⤵
        
        PID:12064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46296.exe
        5⤵
        
        PID:8652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34403.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34403.exe
      4⤵
      PID:9084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11182.exe
      4⤵
      PID:13484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45634.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45634.exe
      4⤵
      PID:17040
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17413.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17413.exe
    3⤵
    PID:5176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25464.exe
      4⤵
      PID:5440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49496.exe
        5⤵
        
        PID:7952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
        5⤵
        
        PID:11320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58932.exe
        5⤵
        
        PID:8932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3647.exe
      4⤵
      PID:9732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60055.exe
      4⤵
      PID:13924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58383.exe
      4⤵
      PID:6008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6502.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6502.exe
    3⤵
    PID:6556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7861.exe
      4⤵
      PID:9212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57119.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57119.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34170.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63043.exe
      4⤵
      PID:9308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20989.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20989.exe
    3⤵
    PID:10216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15725.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15725.exe
    3⤵
    PID:14640
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27785.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27785.exe
    3⤵
    PID:16120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57323.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57323.exe
    3⤵
    PID:11216
- C:\Users\Admin\AppData\Local\Temp\Unicorn-28982.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-28982.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18261.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18261.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20830.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20830.exe
      4⤵
      PID:3920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-876.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21162.exe
        6⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59833.exe
        7⤵
        
        PID:11480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10077.exe
        7⤵
        
        PID:16724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49999.exe
        6⤵
        
        PID:11100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28332.exe
        6⤵
        
        PID:16248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15980.exe
        6⤵
        
        PID:17352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63901.exe
        5⤵
        
        PID:7120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30612.exe
        6⤵
        
        PID:9556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36205.exe
        6⤵
        
        PID:13960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-320.exe
        6⤵
        
        PID:17192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19219.exe
        5⤵
        
        PID:10280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10004.exe
        5⤵
        
        PID:14376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17556.exe
        5⤵
        
        PID:16464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56701.exe
        5⤵
        
        PID:17620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47320.exe
      4⤵
      PID:7040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39081.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50596.exe
        6⤵
        
        PID:11788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16992.exe
        6⤵
        
        PID:9144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16387.exe
        5⤵
        
        PID:12644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41418.exe
        5⤵
        
        PID:11028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6881.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6881.exe
      4⤵
      PID:9640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45763.exe
      4⤵
      PID:14348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54459.exe
      4⤵
      PID:15620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41929.exe
      4⤵
      PID:8596
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3678.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3678.exe
    3⤵
    PID:5184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34701.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34701.exe
      4⤵
      PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49496.exe
        5⤵
        
        PID:7240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28447.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12956.exe
        5⤵
        
        PID:3352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3647.exe
      4⤵
      PID:9720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19515.exe
      4⤵
      PID:13380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24852.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24852.exe
      4⤵
      PID:5260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8342.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8342.exe
    3⤵
    PID:6720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-679.exe
      4⤵
      PID:8484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27922.exe
        5⤵
        
        PID:7836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19018.exe
      4⤵
      PID:12196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48626.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48626.exe
      4⤵
      PID:9420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1566.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1566.exe
    3⤵
    PID:9912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37082.exe
      4⤵
      PID:14024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52837.exe
      4⤵
      PID:16332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45145.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30420.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30420.exe
    3⤵
    PID:13436
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30377.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30377.exe
    3⤵
    PID:1252
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6116.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6116.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5069.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5069.exe
    3⤵
    PID:4272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8359.exe
      4⤵
      PID:5616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26061.exe
        5⤵
        
        PID:7956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54372.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35006.exe
        5⤵
        
        PID:11928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61005.exe
        5⤵
        
        PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22587.exe
        5⤵
        
        PID:17788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3263.exe
      4⤵
      PID:8784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44212.exe
      4⤵
      PID:12708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53632.exe
      4⤵
      PID:16868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59952.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59952.exe
    3⤵
    PID:6972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64270.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33191.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
      4⤵
      PID:836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55424.exe
      4⤵
      PID:7656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34787.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34787.exe
    3⤵
    PID:9656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39278.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39278.exe
    3⤵
    PID:14000
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34852.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34852.exe
    3⤵
    PID:17336
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3768.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3768.exe
  2⤵
  PID:5288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17597.exe
    3⤵
    PID:5996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54649.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54649.exe
      4⤵
      PID:7888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12988.exe
      4⤵
      PID:6548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61005.exe
      4⤵
      PID:384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10142.exe
      4⤵
      PID:7696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45173.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45173.exe
    3⤵
    PID:8416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44212.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:13096
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18283.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18283.exe
  2⤵
  PID:6816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26637.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26637.exe
    3⤵
    PID:7720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21069.exe
      4⤵
      PID:14260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16351.exe
      4⤵
      PID:15992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10691.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10691.exe
      4⤵
      PID:8536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44212.exe
    3⤵
    PID:12724
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42024.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42024.exe
  2⤵
  PID:9220
- C:\Users\Admin\AppData\Local\Temp\Unicorn-45918.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-45918.exe
  2⤵
  PID:13320
- C:\Users\Admin\AppData\Local\Temp\Unicorn-2303.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-2303.exe
  2⤵
  PID:17112
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53955.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53955.exe
  2⤵
  PID:19272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4268 -ip 4268
1⤵
PID:6460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 5744 -ip 5744
1⤵
PID:6848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2344 -ip 2344
1⤵
PID:8504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 7100 -ip 7100
1⤵
PID:10352

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10677.exe

Filesize
468KB

MD5
becc5528d97a69fb52e9eb5df4ccf666

SHA1
988e6abe2fc828d2fb969de911f3f221b3974e3b

SHA256
3627eefae7d5f35640d970d2dd783a43e3b2e0b7c93eb8bd6cf3fb8547ba4d0e

SHA512
eb9f7773f36bf258aaea3886c18884d4abed54268f6f07f41d48df7c346dfb5b40067071a26ede03103bd866babbc85585b7602bb631e307c48921910e6a6de1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1383.exe

Filesize
468KB

MD5
c934d0524c1474d3038524a013c5578c

SHA1
64212034fe64668810a9455a77c20ca2e7f2bacd

SHA256
f05cf8c0986e7b69cb8046dd0daf85f01c5a3ad03927aefa2e3a3c99e0ee4b10

SHA512
76669b8f5d43676f51870b979eff44c1ccd5509d58af56d1d1c3f35ba2e787426e0610509f41ca67e44136f5bb459b87bfe4ba1bbdfb647f35ffad75df673e84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14285.exe

Filesize
468KB

MD5
8899ae469c99d1196446cfd6d24a1b46

SHA1
94a207a6de562d1e2c75fdc164a7f813b3e13944

SHA256
2ade24b5e05041bbc0d2258c1b3665629adb7adb968aa2db8a326a0169b75c68

SHA512
4a337b813d77d24a08046c94a01d6fbe2e3458711b4fef91016eab5357f010ca8544ed1f617df4070150e9caa232cd37685b240ab14fa499c938722f688b5d71

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20403.exe

Filesize
468KB

MD5
5cfee3aedc958e91d26668c7166102a0

SHA1
4839c2aef0b53409dcb90ee70214cf6b77b18f4d

SHA256
0ce651d11b7af179399f26be6a68e833dc98881e7f76484d877fd33bff796da4

SHA512
dbe96bd2bdaa2cfeb3aba77d002aa37c24bb89f23f7267c529e6c89e6d1529af18c7dc0402b1c2fa88f30eada15d6c0ee8612767bf48982b3b7687209248a489

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21052.exe

Filesize
468KB

MD5
4102af78b70de6091429ae98a88db591

SHA1
6092d1d998dc4ecf7f5e3d92a84080e593fd3e8a

SHA256
b4cf1beb0bae1118fab8a41ee3a847910e11aee9614678ae1e89b6176127add3

SHA512
b35ae5261b4e4dd5007f7c3bfc549d91bfb8aac7dea0db50bf1947a8b8f8fe0409f4b06ec300894b7394fb06102cf459979290cf9ed12e55091d864b9a1999c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21961.exe

Filesize
468KB

MD5
2f597965cc6781b277dc875ef0a901f9

SHA1
5d15c88379b344d1824531c40118a73491cf0e24

SHA256
f8cd68424d3e2846dc830d476902b6f8ff0e664a6315b5322f8d0c8fe3c9002c

SHA512
0997b81961f50a5b56ae6225e77b5016b55085820dfaf2d095402e73d854c7f3f101045c4713105047adec5710c4d963f6d165fa1818fd6c73c6ffcb591e4c7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25919.exe

Filesize
468KB

MD5
8ab13102523e61baac305d7c599dd8c9

SHA1
ed16ec50e0cfe482aab054bb4793d6b298a0174f

SHA256
141de3836a444f92c0da6cd5167bdeeee49fa06560b1cba416c2d1daa81942b5

SHA512
d9807e9dbd2c65f8eb335f6c90eea61b382b3cc784865cf0381fc78187b0cc88051a9c749c1dbb108fba0b7059469969f370204b629df1aba20ff56a46862421

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27358.exe

Filesize
468KB

MD5
d36940083ae8902b38cf1a45a8c8a211

SHA1
476017b57add582fa53e0fbe6d9077545c35ec21

SHA256
a2c247c725e0df38580480b6506ed1c1c1d5530c346c536a6ad0c2cbba431792

SHA512
628dde7a124459873a3b17f319d21ba74b736bcd4a88e8cefe4e5e382a7f835482f21a9fa007cf1791aaf08ecab68e710a5b6f175ad9f6e6ae2e6df6540d721d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28654.exe

Filesize
468KB

MD5
2f31abfb09705200ab7a7a0c9ae56c85

SHA1
a74dc77fbba00bba582a8407530b2de78fad8c1d

SHA256
02b27445fddd2bf36bbdc672d356cef3bec4d12f3813df8dce16f8825931a6d7

SHA512
9cac0368debdc45cd1942781b21e93e1c51d5446856ff9b609baf51d15d365caab3e5baed78b6e25e65ca45e0d7830ddbbc5a9df3933284592d26192067d2d2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28982.exe

Filesize
468KB

MD5
b9ce47abbc412493faa58cb3f447e262

SHA1
496232103054811096d55afe09b65e30939710bd

SHA256
bfbb76a4caf9150c255e62a9893a0cc61b622a8ba41a8e266a93bf3c31c95466

SHA512
67427ad0c9761c654fb40c1ed43d690ebccccde66967ce876232d6307eadc8a9fee0134107e5ed07d8e77833ea8457eb94601abcaedc2712942f7d42063a525f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29828.exe

Filesize
468KB

MD5
b2531bfb116e9c714b5d2a7661df4639

SHA1
99f38f39879e9977f822b78cafc7dce70bb86231

SHA256
44b0a78ca0dcc188f8c5a39ed60d036e0750950b61a9eedd012fca5f20c5a739

SHA512
d8f31658de280590cc73ea4aa61b6826f40285baa1e6cec341b86911968d10f397f49e7f435bfe8a685e55648249c4dddd5db8531d493dfcd0405f6436704c38

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31206.exe

Filesize
468KB

MD5
aa07739088dde8708e5367256a86e459

SHA1
388baf25fb77c7826b179c7560587e865d6a3641

SHA256
80bc31252914de09aed9e73a96d7e60569300e18b8c6e9d19191ae11225b1a96

SHA512
a40ef65b7dfe5a99ba975f5e94f08297c95d1177d3b5f4c71ce44a889cc5a5bea6ea8144869490a64501f45c41f6046425149e458dc19a1f3242d8233fb053b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34138.exe

Filesize
468KB

MD5
18bd7990efe0959210f697cb14d559cd

SHA1
dab3a49841438ad7645e9bef8912b32e0bc2f5d9

SHA256
59e2947a64d16cfcac0bfe03dbcb40456d52c681cc580620adde69ccd945985f

SHA512
b3d753bd171028963170113b8700b08fd44479877372bffcdbf2f05a686181a332e4dfe0736c7742dbc8f712c55ed500efb4508dca487b1141c053a0a1cada28

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37648.exe

Filesize
468KB

MD5
bbc577171689772490a8d51d6acec7d9

SHA1
9fff7a14ef5a11eb055b974c408f1c4e0883acea

SHA256
34640552dbca85939fcce9afda254ce52e677987fcc06b00eb12f16512d4b84c

SHA512
666ca703b6e4981c27520cb544b4f492d2e63832da1e4eb766d85b47dc5c4d6e3d5d5b78ca83c04c5097d668dc4e88dcf8dda6e230e7fbf9476577e5674e933a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38882.exe

Filesize
468KB

MD5
c91b5c10cfcd3ec9d1d955e67a905fb2

SHA1
d15c74c60ed5320e55f0c8eff869ff36b3c5e3f8

SHA256
5e1e52ce9be85d4515ec8fa98188b678df1c1fdf6f869a47d181dbf1cd124870

SHA512
f92b226a0e0668aa536d8330cf3cd75fa822ea56bf033e1cd9c3dceed293f8feb7e10b498c53ebed060494667eb39ebb75c32f66d76a385b4ee7eb66ab9295a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40004.exe

Filesize
468KB

MD5
0bf641b04b2da663f739961bbb4e35dd

SHA1
290a783c43132ddb7fe02f2e397544cafb26e9b8

SHA256
e49a16da94da7e1b292a72def6bd13db80f088e8d6a9f48e818ab88e75208935

SHA512
940cc05fbf8d2daaee278af77af9f79df22d5ed446330a9d29267da2dde9e0bef4bafd30596093b4703f75dae1af2f728de38e2816432bc3ab0bdc1f02453351

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4154.exe

Filesize
468KB

MD5
b3f3bd9b457753afa9a263fe81d700df

SHA1
d30da7eee55684cfc0499ac31a8045d71483881e

SHA256
50973a9504cb4acca09c29e72351d4bf6027d91785d531fd682733650a43c798

SHA512
3eacc7338012f99e9849de8708a2474003ce1db1071f18ec007cb223b5f6fee91dee08917721356a26098bcde25d49b863f1801a4a03dffad34d3c835664b9e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43542.exe

Filesize
468KB

MD5
420516b26ac0a8f6652012761f859833

SHA1
d1bd4fc77ef0487a5230b3f2eac1199d6bd276d6

SHA256
e1a5230bdffea41afff5f664365589623cbe5634b8793a48762fe550a929acfb

SHA512
6b5bfcec5374a1c9c9562164be38afd36a38df7040f7485a4c8bb0b68ca3f0200e04f66cd5182a7f186187df973c07847b13dba8b560a891d753f4ed6a7ab1b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45785.exe

Filesize
468KB

MD5
3d0be748d4c044733cfe48e6d5b42554

SHA1
a8ef43e4c2660cf9a56942fc6a3e1a179a770f05

SHA256
dd17d39b33ecdd2a315aacc9a3a1e65d50586eaece3ee2d0623254350094b27d

SHA512
75fdbebe16435106721cf621577c6e29577fed9148333af2ea17a6501e712ca5d1787cdb12faa0dee3b4ec9f7735c8bbef32cbcd775b34d6be5a8c06eadcea61

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45899.exe

Filesize
468KB

MD5
66f719bdc8955d2655ba4aaba2d0db25

SHA1
8b2015d958f2f3402ea0d80d99a1205e35d03ca6

SHA256
21a68576d3ac428b12d7cfa9658b98e7f9501b251f1df105d7bf75c8ad7d1450

SHA512
238a621637f021c340f263dc6dc16bae85f11906b6a5d7a76342a92823465ca001639bbc9b5326b4b96621031172a4d47f4b300f582c5ad5f6b74407cd954611

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47368.exe

Filesize
468KB

MD5
398ed58f842a3961b46de7f2e8749ac8

SHA1
22bbc52e112f14b88ab70645ed99b59c0cbe2351

SHA256
67cee3bcc0a4b8e1ac590020a0dc18ee1489c561e62a3ed1af6143be5b6e3604

SHA512
4a0a65ac8e79ab93ec03a53a9b1d08d2777c0a1cdd434a247d491946145329f69a76b0efbda0ad98a6115d9fbf853c77c0c83a8e0eccca2ec4fb1fdde85933f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49096.exe

Filesize
468KB

MD5
970f7ad19e963ea8a01860689255c7a1

SHA1
da7544bf58e3b4d13a8cc9dedd62957c6c846bc0

SHA256
99fe4c51e9b24e22f0174fad58a4c3e51884319e05e87ff6bf72d5587dc25810

SHA512
c611ee81c63b67f2dc5d0935700b9ef75f86d10c6cb9bb03bfea31d0c37f6a5bde6f97d2a45b053812813fee3d253487fba47e859794b1b7ee5aa6089910db5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50144.exe

Filesize
468KB

MD5
e78c17ed4c5e8328669f29a203be3524

SHA1
7ee75cfb76f9c008c1e3adaeac55a8cbbce4da02

SHA256
f6724028387b9d4cccdc404a658f3dd41618c0e90b449f4027696123391bf416

SHA512
ead8ae21985a1a67e86cc8aa99a6f6fe76b6fe3e71d860d3534fd318b72bb76260ad9edb7bc180b15a59e9c5ead9f86950064a64ffbcff707990519a01d37ef5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59402.exe

Filesize
468KB

MD5
82c08cf0e753e2c62f25cc938582afe1

SHA1
cab510cc467292dba640d5c2a24372fcaa247ef0

SHA256
9dd94ba130f2964c656c82736fe13bccfbc70c2cbd54afe81409c19d84ea9978

SHA512
757b2a04bbfd22439cb5ed1de0b29d151db7347d307f15b8fd04c20c891c62f7c7e0857d1648612bc424e02d9ac91492c7a4e60d9a360922182a65efb8d05afa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59485.exe

Filesize
468KB

MD5
84043e53fa1d59c7fe4902927d108bc8

SHA1
17fca68250518c26c4c00997f3fbd01fd854475e

SHA256
ad555e87c4c6214746902d45ec94526218c4cb5fd84fe15999d68fb76232244d

SHA512
68b55252a97ed02040ff7363fae86c9e0aaf54bd601bfb0af8f32f364515c60477bc61476fe8fe5d38a6626d579df36ebd7c6d5febc88e4d232e0c6442c7eddf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59703.exe

Filesize
468KB

MD5
cd54c57dd4a8c7347202d573e8d8982e

SHA1
23de4eb2d0d79317584f8d8c53d8f3783d6db416

SHA256
53b7622baaaee712c30ce86e680b3aff8b906041025da4a16e26cce85e0f8d37

SHA512
9e2a86ef6290ed24a8eafc95fd8d5b5241488c19db7ed83d3f30db714ba9640308132dd07632a69e148560f24d28f3990b4002d38dc341c7db904075a9d30f20

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62168.exe

Filesize
468KB

MD5
266123cea4e52b3cdbe2929e22935903

SHA1
020f3e8b5293d7892ea9d7d62f63b1e29d69d388

SHA256
7629ed6a217094119a4e74376ec092c56b6b25a6805cdcb7af0d7a0d405fcfff

SHA512
eee2113ccd9fe3547e9f17cc1ff5ed8dbcb3d570d59875cae91646d34ad7673de2b5ae55093c78f79c5f55ffe5f74de888268a006bb0d7f94c80e4da751ae677

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65053.exe

Filesize
468KB

MD5
2924feae61875d27c3676a09abb841d6

SHA1
b7ceabf053cd984adbeb0d27a5d3a4a56b6175aa

SHA256
d6d084134db38c7e50bef0dba90d885e660f5a3499efa3c256a71f944fa4fcb7

SHA512
d324acb854867c14579d7897f8f57a67ffdb0f035f147490da2cb8a75790dbf011ae95eea8e6341e24cc0a547e6815d030467df7bb74b735d9b779f0d8a1f6a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7492.exe

Filesize
468KB

MD5
20772d75d239d17ab35a8ae9aa965eb8

SHA1
ac4987b4ae2081866bcbb7faf993ec47baa4eb4a

SHA256
8daeb5f92369ff1608929d1a8d1a4936bc7366c6821c34cabf22c99098bc99d8

SHA512
54e9a6681cc68654fc3a9759088a1ca527d39705660ed2192769316fb5eae889dccdcf0bdc94185ca7d8fc9ef8d573ca861ff4afb0486959c52dbf46a678c36d

Download Submit
memory/212-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/232-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/408-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/412-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/428-136-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/448-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/464-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/812-293-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/872-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/932-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1036-221-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1064-208-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1152-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1192-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1200-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1204-143-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1376-145-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1392-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1456-432-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1548-199-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1584-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1604-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1644-248-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1656-144-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1772-315-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2104-95-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2180-77-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2268-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2288-79-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2296-314-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2308-109-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2392-486-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2480-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2500-292-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2572-484-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2656-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2784-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2876-168-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3020-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3036-394-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3108-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3140-60-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3224-38-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3236-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3252-116-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3296-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3308-16-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3448-225-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3496-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3716-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3752-78-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3844-103-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3920-412-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3980-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4000-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4008-43-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4032-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4164-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4212-196-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4268-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4272-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4304-442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4356-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4396-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4448-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4520-169-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4544-148-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4664-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4732-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4828-135-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4864-216-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4956-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4972-39-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5084-443-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5128-452-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5176-453-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5184-467-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5200-474-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5216-475-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5240-476-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5272-487-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5288-483-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5500-488-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5536-485-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5580-495-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5632-496-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5652-535-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5692-536-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5708-537-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5744-509-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5756-516-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5864-538-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5876-539-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5892-540-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5960-548-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5972-549-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/7788-3243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/17104-3244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/17924-3220-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads