5e6a30ce0516d86929a1e510f60e678c6ac9f79cd072388b9dd3b5941273f664

Analysis

max time kernel
119s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/09/2024, 01:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

98953297235c7736445e255d5806cfb0N.exe
Size

468KB
MD5

98953297235c7736445e255d5806cfb0
SHA1

693245f105ba30490900a474f7fcbc99f9d0aadd
SHA256

5e6a30ce0516d86929a1e510f60e678c6ac9f79cd072388b9dd3b5941273f664
SHA512

aeb49cb67259ded6c647a121c8aa53d2ec13d7121247ada4838072b1d23fdc2514088485eca39e7ea21b5f12c30b30923a1aa189107fd721d39f1bb91c406cb3
SSDEEP

3072:dFCIogBRjq8U2bY9Pz3yqf8/oC4jyIplTmHxpTHfZsRlAzGNEFlg:dFZoiTU2+PDyqfg04JZsvSGNE

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2960	Unicorn-39396.exe
872	Unicorn-39713.exe
5084	Unicorn-19655.exe
5056	Unicorn-43873.exe
116	Unicorn-9316.exe
2312	Unicorn-6030.exe
4124	Unicorn-12160.exe
2284	Unicorn-11683.exe
2384	Unicorn-23150.exe
768	Unicorn-29281.exe
840	Unicorn-54859.exe
4640	Unicorn-27169.exe
2352	Unicorn-26977.exe
1760	Unicorn-7111.exe
2004	Unicorn-12020.exe
1536	Unicorn-15844.exe
2872	Unicorn-60747.exe
4508	Unicorn-12999.exe
4180	Unicorn-35361.exe
3476	Unicorn-35864.exe
3724	Unicorn-35937.exe
2084	Unicorn-12029.exe
736	Unicorn-7815.exe
512	Unicorn-40103.exe
2784	Unicorn-27489.exe
2484	Unicorn-43716.exe
4904	Unicorn-60737.exe
4452	Unicorn-19518.exe
4260	Unicorn-22318.exe
556	Unicorn-2225.exe
4128	Unicorn-16161.exe
2716	Unicorn-43877.exe
2504	Unicorn-2045.exe
5008	Unicorn-2045.exe
1812	Unicorn-24516.exe
4600	Unicorn-20135.exe
4844	Unicorn-17425.exe
4828	Unicorn-21265.exe
3916	Unicorn-34433.exe
3844	Unicorn-25694.exe
3084	Unicorn-56830.exe
4992	Unicorn-32330.exe
3504	Unicorn-19908.exe
2052	Unicorn-26980.exe
2952	Unicorn-29249.exe
2616	Unicorn-39346.exe
3808	Unicorn-45476.exe
4944	Unicorn-45284.exe
216	Unicorn-42980.exe
3928	Unicorn-54831.exe
412	Unicorn-60961.exe
2108	Unicorn-60961.exe
5100	Unicorn-60769.exe
2280	Unicorn-48283.exe
2728	Unicorn-13223.exe
2584	Unicorn-7623.exe
3216	Unicorn-56363.exe
8	Unicorn-60971.exe
4284	Unicorn-48548.exe
576	Unicorn-46280.exe
3664	Unicorn-30785.exe
4420	Unicorn-25230.exe
2796	Unicorn-22625.exe
2336	Unicorn-22625.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
3448	768	WerFault.exe	102
11016	9988	WerFault.exe	476
15476	12512	WerFault.exe	689

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30171.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18125.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31966.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42732.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47591.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10667.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62241.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8580.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19806.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37918.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8398.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56830.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50990.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2909.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3888.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1853.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12717.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56958.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49653.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62094.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56824.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44549.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63084.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3613.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46492.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15355.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26724.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26689.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10781.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44549.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10237.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53822.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44588.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65502.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40103.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15479.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9979.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22625.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62286.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1853.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8491.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9156.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	5900	dwm.exe
Token: SeChangeNotifyPrivilege	5900	dwm.exe
Token: 33	5900	dwm.exe
Token: SeIncBasePriorityPrivilege	5900	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4996	98953297235c7736445e255d5806cfb0N.exe
2960	Unicorn-39396.exe
872	Unicorn-39713.exe
5084	Unicorn-19655.exe
116	Unicorn-9316.exe
5056	Unicorn-43873.exe
2312	Unicorn-6030.exe
4124	Unicorn-12160.exe
2284	Unicorn-11683.exe
768	Unicorn-29281.exe
2384	Unicorn-23150.exe
4640	Unicorn-27169.exe
2352	Unicorn-26977.exe
2004	Unicorn-12020.exe
840	Unicorn-54859.exe
1760	Unicorn-7111.exe
1536	Unicorn-15844.exe
2872	Unicorn-60747.exe
4508	Unicorn-12999.exe
4180	Unicorn-35361.exe
2084	Unicorn-12029.exe
3476	Unicorn-35864.exe
3724	Unicorn-35937.exe
512	Unicorn-40103.exe
736	Unicorn-7815.exe
4452	Unicorn-19518.exe
2784	Unicorn-27489.exe
556	Unicorn-2225.exe
4260	Unicorn-22318.exe
2484	Unicorn-43716.exe
4904	Unicorn-60737.exe
4128	Unicorn-16161.exe
2716	Unicorn-43877.exe
5008	Unicorn-2045.exe
2504	Unicorn-2045.exe
1812	Unicorn-24516.exe
4600	Unicorn-20135.exe
4844	Unicorn-17425.exe
4828	Unicorn-21265.exe
3916	Unicorn-34433.exe
3844	Unicorn-25694.exe
3084	Unicorn-56830.exe
4992	Unicorn-32330.exe
3504	Unicorn-19908.exe
2952	Unicorn-29249.exe
2052	Unicorn-26980.exe
2616	Unicorn-39346.exe
4944	Unicorn-45284.exe
3808	Unicorn-45476.exe
216	Unicorn-42980.exe
2280	Unicorn-48283.exe
3928	Unicorn-54831.exe
2108	Unicorn-60961.exe
3216	Unicorn-56363.exe
8	Unicorn-60971.exe
4420	Unicorn-25230.exe
3664	Unicorn-30785.exe
4284	Unicorn-48548.exe
412	Unicorn-60961.exe
5100	Unicorn-60769.exe
2728	Unicorn-13223.exe
576	Unicorn-46280.exe
2584	Unicorn-7623.exe
2796	Unicorn-22625.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 2960	4996	98953297235c7736445e255d5806cfb0N.exe	88
PID 4996 wrote to memory of 2960	4996	98953297235c7736445e255d5806cfb0N.exe	88
PID 4996 wrote to memory of 2960	4996	98953297235c7736445e255d5806cfb0N.exe	88
PID 2960 wrote to memory of 872	2960	Unicorn-39396.exe	91
PID 2960 wrote to memory of 872	2960	Unicorn-39396.exe	91
PID 2960 wrote to memory of 872	2960	Unicorn-39396.exe	91
PID 4996 wrote to memory of 5084	4996	98953297235c7736445e255d5806cfb0N.exe	92
PID 4996 wrote to memory of 5084	4996	98953297235c7736445e255d5806cfb0N.exe	92
PID 4996 wrote to memory of 5084	4996	98953297235c7736445e255d5806cfb0N.exe	92
PID 872 wrote to memory of 5056	872	Unicorn-39713.exe	94
PID 872 wrote to memory of 5056	872	Unicorn-39713.exe	94
PID 872 wrote to memory of 5056	872	Unicorn-39713.exe	94
PID 2960 wrote to memory of 116	2960	Unicorn-39396.exe	95
PID 2960 wrote to memory of 116	2960	Unicorn-39396.exe	95
PID 2960 wrote to memory of 116	2960	Unicorn-39396.exe	95
PID 4996 wrote to memory of 2312	4996	98953297235c7736445e255d5806cfb0N.exe	97
PID 4996 wrote to memory of 2312	4996	98953297235c7736445e255d5806cfb0N.exe	97
PID 4996 wrote to memory of 2312	4996	98953297235c7736445e255d5806cfb0N.exe	97
PID 5084 wrote to memory of 4124	5084	Unicorn-19655.exe	96
PID 5084 wrote to memory of 4124	5084	Unicorn-19655.exe	96
PID 5084 wrote to memory of 4124	5084	Unicorn-19655.exe	96
PID 116 wrote to memory of 2284	116	Unicorn-9316.exe	100
PID 116 wrote to memory of 2284	116	Unicorn-9316.exe	100
PID 116 wrote to memory of 2284	116	Unicorn-9316.exe	100
PID 2960 wrote to memory of 2384	2960	Unicorn-39396.exe	101
PID 2960 wrote to memory of 2384	2960	Unicorn-39396.exe	101
PID 2960 wrote to memory of 2384	2960	Unicorn-39396.exe	101
PID 5056 wrote to memory of 768	5056	Unicorn-43873.exe	102
PID 5056 wrote to memory of 768	5056	Unicorn-43873.exe	102
PID 5056 wrote to memory of 768	5056	Unicorn-43873.exe	102
PID 872 wrote to memory of 840	872	Unicorn-39713.exe	103
PID 872 wrote to memory of 840	872	Unicorn-39713.exe	103
PID 872 wrote to memory of 840	872	Unicorn-39713.exe	103
PID 4124 wrote to memory of 4640	4124	Unicorn-12160.exe	104
PID 4124 wrote to memory of 4640	4124	Unicorn-12160.exe	104
PID 4124 wrote to memory of 4640	4124	Unicorn-12160.exe	104
PID 2312 wrote to memory of 2352	2312	Unicorn-6030.exe	106
PID 2312 wrote to memory of 2352	2312	Unicorn-6030.exe	106
PID 2312 wrote to memory of 2352	2312	Unicorn-6030.exe	106
PID 5084 wrote to memory of 1760	5084	Unicorn-19655.exe	105
PID 5084 wrote to memory of 1760	5084	Unicorn-19655.exe	105
PID 5084 wrote to memory of 1760	5084	Unicorn-19655.exe	105
PID 4996 wrote to memory of 2004	4996	98953297235c7736445e255d5806cfb0N.exe	107
PID 4996 wrote to memory of 2004	4996	98953297235c7736445e255d5806cfb0N.exe	107
PID 4996 wrote to memory of 2004	4996	98953297235c7736445e255d5806cfb0N.exe	107
PID 2284 wrote to memory of 1536	2284	Unicorn-11683.exe	108
PID 2284 wrote to memory of 1536	2284	Unicorn-11683.exe	108
PID 2284 wrote to memory of 1536	2284	Unicorn-11683.exe	108
PID 116 wrote to memory of 2872	116	Unicorn-9316.exe	110
PID 116 wrote to memory of 2872	116	Unicorn-9316.exe	110
PID 116 wrote to memory of 2872	116	Unicorn-9316.exe	110
PID 5056 wrote to memory of 4508	5056	Unicorn-43873.exe	112
PID 5056 wrote to memory of 4508	5056	Unicorn-43873.exe	112
PID 5056 wrote to memory of 4508	5056	Unicorn-43873.exe	112
PID 2384 wrote to memory of 4180	2384	Unicorn-23150.exe	114
PID 2384 wrote to memory of 4180	2384	Unicorn-23150.exe	114
PID 2384 wrote to memory of 4180	2384	Unicorn-23150.exe	114
PID 2960 wrote to memory of 3476	2960	Unicorn-39396.exe	115
PID 2960 wrote to memory of 3476	2960	Unicorn-39396.exe	115
PID 2960 wrote to memory of 3476	2960	Unicorn-39396.exe	115
PID 4640 wrote to memory of 3724	4640	Unicorn-27169.exe	116
PID 4640 wrote to memory of 3724	4640	Unicorn-27169.exe	116
PID 4640 wrote to memory of 3724	4640	Unicorn-27169.exe	116
PID 2352 wrote to memory of 2084	2352	Unicorn-26977.exe	117

C:\Users\Admin\AppData\Local\Temp\98953297235c7736445e255d5806cfb0N.exe
"C:\Users\Admin\AppData\Local\Temp\98953297235c7736445e255d5806cfb0N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39396.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39396.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39713.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39713.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43873.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29281.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:768
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 768 -s 724
        6⤵
        Program crash
        
        PID:3448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12999.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2045.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22625.exe
        7⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        
        PID:2336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11971.exe
        8⤵
        
        PID:4832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42951.exe
        9⤵
        
        PID:7004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1853.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
        10⤵
        
        PID:14292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57237.exe
        10⤵
        
        PID:12712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51173.exe
        9⤵
        
        PID:9852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27147.exe
        9⤵
        
        PID:12688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
        9⤵
        
        PID:16204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56965.exe
        8⤵
        
        PID:7568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37357.exe
        9⤵
        
        PID:15964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55573.exe
        8⤵
        
        PID:9920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47061.exe
        8⤵
        
        PID:14848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5598.exe
        8⤵
        
        PID:18500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27591.exe
        7⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61470.exe
        8⤵
        
        PID:8172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14891.exe
        8⤵
        
        PID:11684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46462.exe
        8⤵
        
        PID:16180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24705.exe
        8⤵
        
        PID:18456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36908.exe
        7⤵
        
        PID:8860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40382.exe
        8⤵
        
        PID:14280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2219.exe
        8⤵
        
        PID:15436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62142.exe
        7⤵
        
        PID:12180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2061.exe
        7⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53003.exe
        6⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28801.exe
        7⤵
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44350.exe
        8⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5533.exe
        9⤵
        
        PID:16340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44805.exe
        9⤵
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29364.exe
        8⤵
        
        PID:11112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2196.exe
        8⤵
        
        PID:16148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26331.exe
        8⤵
        
        PID:16952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46005.exe
        7⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35064.exe
        7⤵
        
        PID:12524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12717.exe
        7⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21355.exe
        6⤵
        
        PID:4864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12669.exe
        7⤵
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42541.exe
        7⤵
        
        PID:10952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1531.exe
        7⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64309.exe
        6⤵
        
        PID:9504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18116.exe
        6⤵
        
        PID:13092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29783.exe
        6⤵
        
        PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17425.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42692.exe
        6⤵
        
        PID:1872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26689.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63070.exe
        8⤵
        
        PID:6676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6013.exe
        9⤵
        
        PID:11968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29188.exe
        9⤵
        
        PID:15392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
        9⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62766.exe
        8⤵
        
        PID:9988
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 9988 -s 464
        9⤵
        Program crash
        
        PID:11016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37900.exe
        8⤵
        
        PID:13544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13495.exe
        8⤵
        
        PID:17564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37421.exe
        7⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47847.exe
        8⤵
        
        PID:10484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44549.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32052.exe
        8⤵
        
        PID:532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43404.exe
        7⤵
        
        PID:10264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34622.exe
        7⤵
        
        PID:15220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58812.exe
        7⤵
        
        PID:16880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61608.exe
        6⤵
        
        PID:5620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64350.exe
        7⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18375.exe
        8⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29188.exe
        8⤵
        
        PID:15372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23755.exe
        8⤵
        
        PID:17088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11819.exe
        7⤵
        
        PID:12736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29060.exe
        7⤵
        
        PID:14520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55823.exe
        6⤵
        
        PID:1672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62142.exe
        6⤵
        
        PID:12188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17846.exe
        6⤵
        
        PID:16888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9972.exe
        5⤵
        
        PID:708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62241.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7334.exe
        7⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23428.exe
        7⤵
        
        PID:11116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39660.exe
        7⤵
        
        PID:15020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50814.exe
        7⤵
        
        PID:16848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52238.exe
        6⤵
        
        PID:7368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50663.exe
        7⤵
        
        PID:11700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28996.exe
        7⤵
        
        PID:15468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29131.exe
        7⤵
        
        PID:16912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62540.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48597.exe
        6⤵
        
        PID:15444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36123.exe
        6⤵
        
        PID:16596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29188.exe
        5⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15590.exe
        6⤵
        
        PID:7796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62341.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56437.exe
        6⤵
        
        PID:15968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47512.exe
        6⤵
        
        PID:16744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57349.exe
        5⤵
        
        PID:8268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60270.exe
        5⤵
        
        PID:11904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19123.exe
        5⤵
        
        PID:14412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23493.exe
        5⤵
        
        PID:16688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54859.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60737.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42980.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4960.exe
        7⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19806.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10692.exe
        9⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49365.exe
        9⤵
        
        PID:13024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16628.exe
        9⤵
        
        PID:15784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61541.exe
        9⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29773.exe
        8⤵
        
        PID:3412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22452.exe
        8⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11869.exe
        8⤵
        
        PID:16144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5153.exe
        8⤵
        
        PID:3624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62286.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49694.exe
        8⤵
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57960.exe
        8⤵
        
        PID:13404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10196.exe
        8⤵
        
        PID:916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29461.exe
        7⤵
        
        PID:10732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7492.exe
        7⤵
        
        PID:14416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4330.exe
        7⤵
        
        PID:18512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13543.exe
        6⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62494.exe
        7⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47591.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62245.exe
        8⤵
        
        PID:15708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19764.exe
        8⤵
        
        PID:16768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34667.exe
        7⤵
        
        PID:10864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33662.exe
        7⤵
        
        PID:14992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8993.exe
        7⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5163.exe
        6⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62469.exe
        7⤵
        
        PID:12988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61438.exe
        6⤵
        
        PID:9704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60549.exe
        6⤵
        
        PID:324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32717.exe
        6⤵
        
        PID:16704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60971.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:8
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63585.exe
        6⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45182.exe
        7⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49502.exe
        8⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24109.exe
        8⤵
        
        PID:12292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20865.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31940.exe
        7⤵
        
        PID:10120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33163.exe
        7⤵
        
        PID:12268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55397.exe
        7⤵
        
        PID:6240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23085.exe
        6⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        7⤵
        
        PID:16296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49771.exe
        7⤵
        
        PID:7096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64140.exe
        6⤵
        
        PID:9740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33013.exe
        6⤵
        
        PID:13636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29060.exe
        6⤵
        
        PID:13484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45935.exe
        5⤵
        
        PID:5220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28222.exe
        6⤵
        
        PID:6204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52453.exe
        6⤵
        
        PID:10840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58933.exe
        6⤵
        
        PID:15192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24094.exe
        6⤵
        
        PID:4300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65502.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53477.exe
        5⤵
        
        PID:12256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41454.exe
        5⤵
        
        PID:5296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22318.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55240.exe
        5⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2758.exe
        6⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32269.exe
        7⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14493.exe
        7⤵
        
        PID:13488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23309.exe
        7⤵
        
        PID:16984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7469.exe
        6⤵
        
        PID:7312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10091.exe
        6⤵
        
        PID:10612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25924.exe
        6⤵
        
        PID:6360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23883.exe
        5⤵
        
        PID:7060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37918.exe
        6⤵
        
        PID:11688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28996.exe
        6⤵
        
        PID:15460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44719.exe
        6⤵
        
        PID:18524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56824.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24347.exe
        5⤵
        
        PID:10748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37578.exe
        5⤵
        
        PID:17420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53954.exe
      4⤵
      PID:5324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2758.exe
        5⤵
        
        PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52584.exe
        5⤵
        
        PID:9588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20916.exe
        5⤵
        
        PID:13084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29060.exe
        5⤵
        
        PID:16364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24397.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24397.exe
      4⤵
      PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37319.exe
        5⤵
        
        PID:7520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29261.exe
        5⤵
        
        PID:11948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe
        5⤵
        
        PID:1452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52017.exe
      4⤵
      PID:8472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16132.exe
        5⤵
        
        PID:13168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59755.exe
        5⤵
        
        PID:2040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51827.exe
      4⤵
      PID:11768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28598.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28598.exe
      4⤵
      PID:17104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9316.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9316.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11683.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15844.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16161.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48548.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2080.exe
        8⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8678.exe
        9⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18820.exe
        9⤵
        
        PID:11772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe
        9⤵
        
        PID:1908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46670.exe
        8⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13012.exe
        8⤵
        
        PID:11788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48789.exe
        8⤵
        
        PID:14972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30171.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:17064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42375.exe
        7⤵
        
        PID:5208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35134.exe
        8⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16222.exe
        9⤵
        
        PID:11884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54734.exe
        9⤵
        
        PID:15488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56958.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29668.exe
        8⤵
        
        PID:10432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31636.exe
        8⤵
        
        PID:15116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44789.exe
        8⤵
        
        PID:16640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-436.exe
        7⤵
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24405.exe
        7⤵
        
        PID:11708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12717.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46280.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1888.exe
        7⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58311.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16583.exe
        9⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6247.exe
        9⤵
        
        PID:12952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33108.exe
        9⤵
        
        PID:15964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62334.exe
        9⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44878.exe
        8⤵
        
        PID:10092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33163.exe
        8⤵
        
        PID:12224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24644.exe
        8⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29997.exe
        7⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1853.exe
        8⤵
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
        8⤵
        
        PID:12568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61612.exe
        8⤵
        
        PID:16896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
        7⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45493.exe
        7⤵
        
        PID:14308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20865.exe
        7⤵
        
        PID:17596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28913.exe
        6⤵
        
        PID:5276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52903.exe
        7⤵
        
        PID:8968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45614.exe
        7⤵
        
        PID:12472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37726.exe
        7⤵
        
        PID:2368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55644.exe
        6⤵
        
        PID:9496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1581.exe
        6⤵
        
        PID:13056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50099.exe
        6⤵
        
        PID:15308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43877.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30785.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43492.exe
        7⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3453.exe
        8⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9693.exe
        9⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6247.exe
        8⤵
        
        PID:12944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60981.exe
        8⤵
        
        PID:15780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63102.exe
        8⤵
        
        PID:12772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17453.exe
        7⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56277.exe
        7⤵
        
        PID:11840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8797.exe
        7⤵
        
        PID:15400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59173.exe
        7⤵
        
        PID:15236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7620.exe
        6⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62209.exe
        7⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63045.exe
        8⤵
        
        PID:1584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40493.exe
        7⤵
        
        PID:11156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-308.exe
        7⤵
        
        PID:14744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47320.exe
        7⤵
        
        PID:16128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63020.exe
        6⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16404.exe
        6⤵
        
        PID:10312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42018.exe
        6⤵
        
        PID:14936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26692.exe
        6⤵
        
        PID:15400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25230.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14436.exe
        6⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8678.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32333.exe
        7⤵
        
        PID:11360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43500.exe
        7⤵
        
        PID:15492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34805.exe
        7⤵
        
        PID:16936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57109.exe
        6⤵
        
        PID:9616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28059.exe
        6⤵
        
        PID:13192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29783.exe
        6⤵
        
        PID:1012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1722.exe
        5⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35271.exe
        6⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51966.exe
        7⤵
        
        PID:15668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40493.exe
        6⤵
        
        PID:11164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-308.exe
        6⤵
        
        PID:14728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57269.exe
        6⤵
        
        PID:5020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40677.exe
        5⤵
        
        PID:8020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21918.exe
        6⤵
        
        PID:13668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31524.exe
        6⤵
        
        PID:1620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56741.exe
        5⤵
        
        PID:10392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42548.exe
        5⤵
        
        PID:14912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62269.exe
        5⤵
        
        PID:16628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60747.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2045.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22625.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24385.exe
        7⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28990.exe
        8⤵
        
        PID:5920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52584.exe
        8⤵
        
        PID:9580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20916.exe
        8⤵
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29060.exe
        8⤵
        
        PID:16380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46670.exe
        7⤵
        
        PID:7788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24478.exe
        8⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29291.exe
        7⤵
        
        PID:11544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29822.exe
        7⤵
        
        PID:15716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38847.exe
        7⤵
        
        PID:13004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27591.exe
        6⤵
        
        PID:5484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32062.exe
        7⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61918.exe
        8⤵
        
        PID:14824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46251.exe
        8⤵
        
        PID:18684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42541.exe
        7⤵
        
        PID:9516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23876.exe
        7⤵
        
        PID:16116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48911.exe
        6⤵
        
        PID:8568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65214.exe
        6⤵
        
        PID:12484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45005.exe
        6⤵
        
        PID:2992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22826.exe
        5⤵
        
        PID:2436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45822.exe
        6⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9638.exe
        7⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18539.exe
        7⤵
        
        PID:11716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11869.exe
        7⤵
        
        PID:16112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5153.exe
        7⤵
        
        PID:15040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15149.exe
        6⤵
        
        PID:3068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56277.exe
        6⤵
        
        PID:10308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8797.exe
        6⤵
        
        PID:15724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21395.exe
        6⤵
        
        PID:18536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21355.exe
        5⤵
        
        PID:3488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
        6⤵
        
        PID:7300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1364.exe
        6⤵
        
        PID:13516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55333.exe
        6⤵
        
        PID:4272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56286.exe
        5⤵
        
        PID:8908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53477.exe
        5⤵
        
        PID:12248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62269.exe
        5⤵
        
        PID:16616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21265.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10237.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54574.exe
        6⤵
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28798.exe
        7⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe
        7⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39660.exe
        7⤵
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47512.exe
        7⤵
        
        PID:4948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49653.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22683.exe
        6⤵
        
        PID:1680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        6⤵
        
        PID:14360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8491.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26494.exe
        6⤵
        
        PID:8304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42541.exe
        6⤵
        
        PID:11784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43036.exe
        6⤵
        
        PID:16068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60152.exe
        5⤵
        
        PID:7376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12238.exe
        6⤵
        
        PID:18464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19652.exe
        5⤵
        
        PID:12408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41454.exe
        5⤵
        
        PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57912.exe
      4⤵
      PID:3120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18241.exe
        5⤵
        
        PID:5724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28222.exe
        6⤵
        
        PID:6168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36173.exe
        6⤵
        
        PID:11056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39852.exe
        6⤵
        
        PID:15740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30491.exe
        6⤵
        
        PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-484.exe
        5⤵
        
        PID:8500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18539.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8797.exe
        5⤵
        
        PID:15440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52261.exe
        5⤵
        
        PID:16812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18555.exe
      4⤵
      PID:2740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31102.exe
        5⤵
        
        PID:7808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49381.exe
        5⤵
        
        PID:11988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42924.exe
        5⤵
        
        PID:15408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55618.exe
        5⤵
        
        PID:19004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43716.exe
      4⤵
      PID:2928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54775.exe
      4⤵
      PID:10948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56526.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56526.exe
      4⤵
      PID:5928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23150.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23150.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35361.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24516.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41924.exe
        6⤵
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8580.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7334.exe
        8⤵
        
        PID:7508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3885.exe
        8⤵
        
        PID:11224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39660.exe
        8⤵
        
        PID:15068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14263.exe
        8⤵
        
        PID:17580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4427.exe
        7⤵
        
        PID:9200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62142.exe
        7⤵
        
        PID:12380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-356.exe
        7⤵
        
        PID:16168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27591.exe
        6⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41927.exe
        7⤵
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe
        7⤵
        
        PID:11588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42732.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48638.exe
        7⤵
        
        PID:18544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4235.exe
        6⤵
        
        PID:8844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55356.exe
        6⤵
        
        PID:13352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24406.exe
        6⤵
        
        PID:5144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52811.exe
        5⤵
        
        PID:1072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22302.exe
        6⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61214.exe
        7⤵
        
        PID:9932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15780.exe
        7⤵
        
        PID:11724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24789.exe
        7⤵
        
        PID:16172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12500.exe
        6⤵
        
        PID:9980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33013.exe
        6⤵
        
        PID:12428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30171.exe
        6⤵
        
        PID:17020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43733.exe
        5⤵
        
        PID:6520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40903.exe
        6⤵
        
        PID:9860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15588.exe
        6⤵
        
        PID:13272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9419.exe
        6⤵
        
        PID:16188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55336.exe
        6⤵
        
        PID:19016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43093.exe
        5⤵
        
        PID:9472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16516.exe
        5⤵
        
        PID:14096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40308.exe
        5⤵
        
        PID:19412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20135.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7331.exe
        5⤵
        
        PID:1564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46590.exe
        6⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8678.exe
        7⤵
        
        PID:6924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32333.exe
        7⤵
        
        PID:10816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58933.exe
        7⤵
        
        PID:15168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28510.exe
        7⤵
        
        PID:1196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36996.exe
        6⤵
        
        PID:7396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56277.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11869.exe
        6⤵
        
        PID:16224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29060.exe
        6⤵
        
        PID:16352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61416.exe
        5⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12518.exe
        6⤵
        
        PID:7736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11627.exe
        6⤵
        
        PID:12700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15355.exe
        6⤵
        
        PID:2492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7499.exe
        5⤵
        
        PID:7824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62142.exe
        5⤵
        
        PID:11820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48823.exe
        5⤵
        
        PID:1840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4107.exe
      4⤵
      PID:3176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26689.exe
        5⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62238.exe
        6⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18539.exe
        6⤵
        
        PID:10900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8989.exe
        6⤵
        
        PID:15232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50533.exe
        6⤵
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50702.exe
        5⤵
        
        PID:8216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56277.exe
        5⤵
        
        PID:10088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8797.exe
        5⤵
        
        PID:15872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26500.exe
        5⤵
        
        PID:4748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15479.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15479.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31102.exe
        5⤵
        
        PID:7676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7558.exe
        6⤵
        
        PID:14152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18125.exe
        6⤵
        
        PID:5104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11819.exe
        5⤵
        
        PID:12680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61541.exe
        5⤵
        
        PID:4956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60252.exe
      4⤵
      PID:9088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3117.exe
      4⤵
      PID:12304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8060.exe
      4⤵
      PID:7268
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35864.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35864.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34433.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53377.exe
        5⤵
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23085.exe
        6⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1853.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
        7⤵
        
        PID:14100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31860.exe
        7⤵
        
        PID:15312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28971.exe
        6⤵
        
        PID:10532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64149.exe
        6⤵
        
        PID:13304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29252.exe
        6⤵
        
        PID:15764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
        5⤵
        
        PID:7640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49269.exe
        5⤵
        
        PID:10404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50466.exe
        5⤵
        
        PID:14888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22119.exe
        5⤵
        
        PID:18696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-647.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-647.exe
      4⤵
      PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60705.exe
        5⤵
        
        PID:5624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54814.exe
        6⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58631.exe
        7⤵
        
        PID:11208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21796.exe
        7⤵
        
        PID:15896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43541.exe
        7⤵
        
        PID:17436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60037.exe
        6⤵
        
        PID:11144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-308.exe
        6⤵
        
        PID:14736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4669.exe
        6⤵
        
        PID:2216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44588.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2756.exe
        5⤵
        
        PID:12500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16118.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24305.exe
      4⤵
      PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4864.exe
        5⤵
        
        PID:7536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64814.exe
        5⤵
        
        PID:11804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15355.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49374.exe
      4⤵
      PID:8536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63367.exe
        5⤵
        
        PID:3600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19652.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19652.exe
      4⤵
      PID:12728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41454.exe
      4⤵
      PID:5384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25694.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20321.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20321.exe
      4⤵
      PID:4400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22657.exe
        5⤵
        
        PID:5844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16583.exe
        6⤵
        
        PID:8556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6247.exe
        6⤵
        
        PID:12920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33108.exe
        6⤵
        
        PID:16008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
        6⤵
        
        PID:4052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32964.exe
        5⤵
        
        PID:8520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56277.exe
        5⤵
        
        PID:12028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8797.exe
        5⤵
        
        PID:15384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48420.exe
        5⤵
        
        PID:7252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50734.exe
      4⤵
      PID:5048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3613.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62341.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64309.exe
        5⤵
        
        PID:15080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        5⤵
        
        PID:17540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46700.exe
      4⤵
      PID:8528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22683.exe
      4⤵
      PID:13316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15766.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15766.exe
      4⤵
      PID:7304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60392.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60392.exe
    3⤵
    PID:4708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7044.exe
      4⤵
      PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28222.exe
        5⤵
        
        PID:8144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1581.exe
        5⤵
        
        PID:10692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27796.exe
        5⤵
        
        PID:14980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6138.exe
        5⤵
        
        PID:9964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3659.exe
      4⤵
      PID:8796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62142.exe
      4⤵
      PID:12044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-132.exe
      4⤵
      PID:15668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
      4⤵
      PID:740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19085.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19085.exe
    3⤵
    PID:4720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22078.exe
      4⤵
      PID:7528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14980.exe
      4⤵
      PID:11324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33227.exe
      4⤵
      PID:15888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30491.exe
      4⤵
      PID:17084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6963.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6963.exe
    3⤵
    PID:8548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58853.exe
    3⤵
    PID:12296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46605.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46605.exe
    3⤵
    PID:16204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56589.exe
    3⤵
    PID:6320
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19655.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19655.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12160.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12160.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35937.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19908.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42049.exe
        7⤵
        
        PID:5128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25831.exe
        8⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41159.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41159.exe
        9⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36781.exe
        10⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42541.exe
        9⤵
        
        PID:12280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37726.exe
        9⤵
        
        PID:3800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36685.exe
        8⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11229.exe
        8⤵
        
        PID:12656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
        8⤵
        
        PID:12552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65486.exe
        8⤵
        
        PID:12764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10148.exe
        7⤵
        
        PID:6808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58631.exe
        8⤵
        
        PID:11216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45774.exe
        8⤵
        
        PID:13688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8398.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:18476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3860.exe
        7⤵
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16157.exe
        7⤵
        
        PID:14448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7867.exe
        7⤵
        
        PID:11712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49096.exe
        6⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53822.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22590.exe
        8⤵
        
        PID:9744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30253.exe
        8⤵
        
        PID:13212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10763.exe
        8⤵
        
        PID:14820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4669.exe
        8⤵
        
        PID:1412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17197.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13838.exe
        7⤵
        
        PID:13240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48604.exe
        7⤵
        
        PID:15380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9716.exe
        6⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57374.exe
        7⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57861.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57861.exe
        8⤵
        
        PID:16672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57477.exe
        7⤵
        
        PID:13148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4669.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43285.exe
        6⤵
        
        PID:7840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63589.exe
        6⤵
        
        PID:14132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24388.exe
        6⤵
        
        PID:6244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26980.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28100.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25831.exe
        7⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6566.exe
        8⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
        8⤵
        
        PID:11796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57068.exe
        8⤵
        
        PID:1436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57269.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5933.exe
        7⤵
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56277.exe
        7⤵
        
        PID:12344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11869.exe
        7⤵
        
        PID:16168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15355.exe
        7⤵
        
        PID:14912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23085.exe
        6⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2429.exe
        7⤵
        
        PID:10540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44549.exe
        7⤵
        
        PID:13200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21876.exe
        7⤵
        
        PID:1120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9428.exe
        6⤵
        
        PID:10376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33013.exe
        6⤵
        
        PID:12556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16964.exe
        6⤵
        
        PID:16732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54575.exe
        5⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28990.exe
        6⤵
        
        PID:7388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9156.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20916.exe
        6⤵
        
        PID:13072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16628.exe
        6⤵
        
        PID:15400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30596.exe
        6⤵
        
        PID:14960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19508.exe
        5⤵
        
        PID:8484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53477.exe
        5⤵
        
        PID:11832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57468.exe
        5⤵
        
        PID:17136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40103.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29249.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58276.exe
        6⤵
        
        PID:5224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27393.exe
        7⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58206.exe
        8⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48805.exe
        8⤵
        
        PID:11912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29060.exe
        8⤵
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33037.exe
        7⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29198.exe
        7⤵
        
        PID:12544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15355.exe
        7⤵
        
        PID:16008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23085.exe
        6⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58956.exe
        6⤵
        
        PID:10144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33013.exe
        6⤵
        
        PID:14304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54437.exe
        6⤵
        
        PID:12744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18919.exe
        5⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33511.exe
        6⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62631.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32557.exe
        7⤵
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17658.exe
        7⤵
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31940.exe
        6⤵
        
        PID:10128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33163.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15428.exe
        6⤵
        
        PID:1188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63084.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1341.exe
        6⤵
        
        PID:9432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57477.exe
        6⤵
        
        PID:13156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63102.exe
        6⤵
        
        PID:12796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15988.exe
        5⤵
        
        PID:10016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24347.exe
        5⤵
        
        PID:12468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37901.exe
        5⤵
        
        PID:2080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39346.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47233.exe
        5⤵
        
        PID:5284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10781.exe
        6⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38430.exe
        7⤵
        
        PID:8584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15463.exe
        7⤵
        
        PID:12536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14586.exe
        7⤵
        
        PID:13344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35204.exe
        6⤵
        
        PID:9324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18449.exe
        6⤵
        
        PID:14116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
        6⤵
        
        PID:3160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10148.exe
        5⤵
        
        PID:1976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59532.exe
        5⤵
        
        PID:10180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33013.exe
        5⤵
        
        PID:13632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40924.exe
        5⤵
        
        PID:5680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13143.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13143.exe
      4⤵
      PID:5392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28929.exe
        5⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41671.exe
        6⤵
        
        PID:9944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28724.exe
        6⤵
        
        PID:13400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16532.exe
        6⤵
        
        PID:15724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32708.exe
        5⤵
        
        PID:9380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28724.exe
        5⤵
        
        PID:13428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37918.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34788.exe
      4⤵
      PID:6896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20382.exe
        5⤵
        
        PID:12656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4301.exe
        5⤵
        
        PID:6116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40196.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40196.exe
      4⤵
      PID:9260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24878.exe
      4⤵
      PID:11928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64724.exe
      4⤵
      PID:17052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7111.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7111.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43716.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60961.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1888.exe
        6⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22142.exe
        7⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40493.exe
        7⤵
        
        PID:11172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-308.exe
        7⤵
        
        PID:14716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
        7⤵
        
        PID:16224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49285.exe
        6⤵
        
        PID:8008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63207.exe
        7⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17972.exe
        7⤵
        
        PID:14112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5156.exe
        7⤵
        
        PID:18992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31851.exe
        6⤵
        
        PID:9872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33013.exe
        6⤵
        
        PID:14164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5290.exe
        6⤵
        
        PID:1432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37391.exe
        5⤵
        
        PID:6156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44231.exe
        6⤵
        
        PID:396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56277.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8797.exe
        6⤵
        
        PID:15436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35789.exe
        6⤵
        
        PID:3208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25534.exe
        5⤵
        
        PID:8620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53477.exe
        5⤵
        
        PID:12352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62071.exe
        5⤵
        
        PID:3328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13223.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1888.exe
        5⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25831.exe
        6⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25918.exe
        7⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50990.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53778.exe
        7⤵
        
        PID:15812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47512.exe
        7⤵
        
        PID:15596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59301.exe
        6⤵
        
        PID:7916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11229.exe
        6⤵
        
        PID:12664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
        6⤵
        
        PID:14220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8170.exe
        6⤵
        
        PID:18440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46350.exe
        5⤵
        
        PID:6688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5222.exe
        6⤵
        
        PID:15736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18125.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3860.exe
        5⤵
        
        PID:10664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16157.exe
        5⤵
        
        PID:14384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29060.exe
        5⤵
        
        PID:4296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12878.exe
      4⤵
      PID:3128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46343.exe
        5⤵
        
        PID:7864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62341.exe
        5⤵
        
        PID:10660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38892.exe
        5⤵
        
        PID:14904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        5⤵
        
        PID:17552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62456.exe
      4⤵
      PID:8464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7291.exe
      4⤵
      PID:10528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43955.exe
      4⤵
      PID:9568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2225.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2225.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60769.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14436.exe
        5⤵
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42695.exe
        6⤵
        
        PID:5420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe
        6⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53557.exe
        6⤵
        
        PID:15076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11924.exe
        6⤵
        
        PID:16804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37676.exe
        5⤵
        
        PID:8928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15956.exe
        5⤵
        
        PID:10056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65402.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:18492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26724.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26724.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:3992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38782.exe
        5⤵
        
        PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29364.exe
        5⤵
        
        PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2196.exe
        5⤵
        
        PID:16136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49829.exe
        5⤵
        
        PID:4392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50732.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50732.exe
      4⤵
      PID:8204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13760.exe
        5⤵
        
        PID:17464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2868.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2868.exe
      4⤵
      PID:11868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39932.exe
      4⤵
      PID:15428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6864.exe
      4⤵
      PID:19036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48283.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1888.exe
      4⤵
      PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9472.exe
        5⤵
        
        PID:7448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56277.exe
        5⤵
        
        PID:10448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8797.exe
        5⤵
        
        PID:14932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64430.exe
        5⤵
        
        PID:14916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46670.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46670.exe
      4⤵
      PID:7844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29291.exe
      4⤵
      PID:11552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29822.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30171.exe
      4⤵
      PID:17072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61669.exe
    3⤵
    PID:5192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63582.exe
      4⤵
      PID:7596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14980.exe
      4⤵
      PID:11332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41746.exe
      4⤵
      PID:15728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30491.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30491.exe
      4⤵
      PID:6120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19684.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19684.exe
    3⤵
    PID:8972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54007.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54007.exe
    3⤵
    PID:11756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44932.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44932.exe
    3⤵
    PID:5264
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6030.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6030.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26977.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26977.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12029.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56830.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-995.exe
        6⤵
        
        PID:432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31204.exe
        7⤵
        
        PID:632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8678.exe
        8⤵
        
        PID:3388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59582.exe
        9⤵
        
        PID:14228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23665.exe
        9⤵
        
        PID:18672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20164.exe
        8⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45996.exe
        8⤵
        
        PID:15204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29621.exe
        8⤵
        
        PID:17120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55461.exe
        7⤵
        
        PID:8804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11229.exe
        7⤵
        
        PID:12328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55484.exe
        7⤵
        
        PID:12660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54565.exe
        7⤵
        
        PID:7336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50734.exe
        6⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35783.exe
        7⤵
        
        PID:7544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64789.exe
        7⤵
        
        PID:13548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48965.exe
        7⤵
        
        PID:12664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23501.exe
        7⤵
        
        PID:17004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63628.exe
        6⤵
        
        PID:8868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31966.exe
        6⤵
        
        PID:12432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54565.exe
        6⤵
        
        PID:7272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64456.exe
        5⤵
        
        PID:4304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53822.exe
        6⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6374.exe
        7⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4804.exe
        7⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25547.exe
        7⤵
        
        PID:14708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5245.exe
        7⤵
        
        PID:3468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50661.exe
        6⤵
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26100.exe
        6⤵
        
        PID:12440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20612.exe
        6⤵
        
        PID:12800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62686.exe
        5⤵
        
        PID:7292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17790.exe
        6⤵
        
        PID:9020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17972.exe
        6⤵
        
        PID:14172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45784.exe
        6⤵
        
        PID:17412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35844.exe
        5⤵
        
        PID:10232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7812.exe
        5⤵
        
        PID:13928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38609.exe
        5⤵
        
        PID:17532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32330.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27332.exe
        5⤵
        
        PID:3088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30436.exe
        6⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29566.exe
        7⤵
        
        PID:7328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56293.exe
        7⤵
        
        PID:11532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43500.exe
        7⤵
        
        PID:15500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33371.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56229.exe
        6⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31349.exe
        6⤵
        
        PID:13332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59173.exe
        6⤵
        
        PID:1604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9229.exe
        5⤵
        
        PID:6940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32077.exe
        6⤵
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19982.exe
        6⤵
        
        PID:12912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62117.exe
        6⤵
        
        PID:3904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46607.exe
        5⤵
        
        PID:8652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31966.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12717.exe
        5⤵
        
        PID:15776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52146.exe
      4⤵
      PID:5240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19998.exe
        5⤵
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32269.exe
        6⤵
        
        PID:7216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19982.exe
        6⤵
        
        PID:12960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1309.exe
        6⤵
        
        PID:15936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15355.exe
        6⤵
        
        PID:16360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49317.exe
        5⤵
        
        PID:8840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57045.exe
        5⤵
        
        PID:11244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8797.exe
        5⤵
        
        PID:14820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8109.exe
        5⤵
        
        PID:1648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29749.exe
      4⤵
      PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4669.exe
        5⤵
        
        PID:12000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2253.exe
        5⤵
        
        PID:15788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39116.exe
        5⤵
        
        PID:16748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1060.exe
      4⤵
      PID:10680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56494.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56494.exe
      4⤵
      PID:14428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41454.exe
      4⤵
      PID:2956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7815.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7815.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45476.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38209.exe
        5⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10781.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18375.exe
        7⤵
        
        PID:11848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29188.exe
        7⤵
        
        PID:15364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56914.exe
        7⤵
        
        PID:18824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23492.exe
        6⤵
        
        PID:9492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25652.exe
        6⤵
        
        PID:12676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4669.exe
        6⤵
        
        PID:1460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23085.exe
        5⤵
        
        PID:6456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47271.exe
        6⤵
        
        PID:10148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
        6⤵
        
        PID:13908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41647.exe
        6⤵
        
        PID:17492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40975.exe
        5⤵
        
        PID:10012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33013.exe
        5⤵
        
        PID:13660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19268.exe
        5⤵
        
        PID:4288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28426.exe
      4⤵
      PID:5856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4324.exe
        5⤵
        
        PID:7276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18539.exe
        5⤵
        
        PID:11040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48005.exe
        5⤵
        
        PID:1616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28877.exe
        5⤵
        
        PID:2836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60405.exe
      4⤵
      PID:7884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35157.exe
      4⤵
      PID:11568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21156.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21156.exe
      4⤵
      PID:15688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33293.exe
      4⤵
      PID:16784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54831.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3928
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34177.exe
      4⤵
      PID:5940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12317.exe
        5⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16583.exe
        6⤵
        
        PID:1936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6247.exe
        6⤵
        
        PID:12936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60981.exe
        6⤵
        
        PID:15680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
        6⤵
        
        PID:16332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30596.exe
        5⤵
        
        PID:9252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6158.exe
        5⤵
        
        PID:13412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45989.exe
        5⤵
        
        PID:1676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7501.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7501.exe
      4⤵
      PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16583.exe
        5⤵
        
        PID:8664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30247.exe
        6⤵
        
        PID:12644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60523.exe
        6⤵
        
        PID:12900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6247.exe
        5⤵
        
        PID:12928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60981.exe
        5⤵
        
        PID:15856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13818.exe
        5⤵
        
        PID:15804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44332.exe
      4⤵
      PID:8764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43710.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43710.exe
      4⤵
      PID:11984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59749.exe
      4⤵
      PID:5332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5691.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5691.exe
    3⤵
    PID:6964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16583.exe
      4⤵
      PID:8276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56133.exe
        5⤵
        
        PID:13636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6247.exe
      4⤵
      PID:12904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60981.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60981.exe
      4⤵
      PID:15772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
      4⤵
      PID:936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24996.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24996.exe
    3⤵
    PID:9236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3888.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3888.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:13392
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19653.exe
    3⤵
    PID:16348
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12020.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12020.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27489.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45284.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53476.exe
        5⤵
        
        PID:5436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2758.exe
        6⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47847.exe
        7⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62094.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65406.exe
        7⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17197.exe
        6⤵
        
        PID:9796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13838.exe
        6⤵
        
        PID:13232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15547.exe
        6⤵
        
        PID:1364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25300.exe
        5⤵
        
        PID:7360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47847.exe
        6⤵
        
        PID:10492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44549.exe
        6⤵
        
        PID:13388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41647.exe
        6⤵
        
        PID:18660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14100.exe
        5⤵
        
        PID:11132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16859.exe
        5⤵
        
        PID:14768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54644.exe
        5⤵
        
        PID:17472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28426.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28426.exe
      4⤵
      PID:5848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62494.exe
        5⤵
        
        PID:7068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33374.exe
        6⤵
        
        PID:7380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12068.exe
        6⤵
        
        PID:14440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10667.exe
        6⤵
        
        PID:12492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51173.exe
        5⤵
        
        PID:9844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48789.exe
        5⤵
        
        PID:13940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22311.exe
        5⤵
        
        PID:16776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5163.exe
      4⤵
      PID:7576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47847.exe
        5⤵
        
        PID:10508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62094.exe
        5⤵
        
        PID:14372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51404.exe
        5⤵
        
        PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61438.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61438.exe
      4⤵
      PID:10116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51333.exe
      4⤵
      PID:14760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12100.exe
      4⤵
      PID:16860
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56363.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56363.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34945.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34945.exe
      4⤵
      PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12317.exe
        5⤵
        
        PID:6732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7168.exe
        6⤵
        
        PID:8224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61893.exe
        6⤵
        
        PID:11896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48293.exe
        6⤵
        
        PID:2592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47781.exe
        5⤵
        
        PID:9024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46220.exe
        5⤵
        
        PID:12452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5563.exe
        5⤵
        
        PID:15088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38796.exe
      4⤵
      PID:7632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49269.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49269.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4571.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4571.exe
      4⤵
      PID:15512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32717.exe
      4⤵
      PID:16656
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12110.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12110.exe
    3⤵
    PID:5784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16551.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16551.exe
      4⤵
      PID:7972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62341.exe
      4⤵
      PID:10616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28756.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28756.exe
      4⤵
      PID:15296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20253.exe
      4⤵
      PID:16968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25659.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25659.exe
    3⤵
    PID:9444
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51685.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51685.exe
    3⤵
    PID:13172
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8060.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8060.exe
    3⤵
    PID:2760
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19518.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19518.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60961.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60961.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52734.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52734.exe
      4⤵
      PID:5776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28161.exe
        5⤵
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8448.exe
        6⤵
        
        PID:10048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20388.exe
        6⤵
        
        PID:10876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48053.exe
        6⤵
        
        PID:2332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29828.exe
        5⤵
        
        PID:10196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37845.exe
        5⤵
        
        PID:3604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9979.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61518.exe
      4⤵
      PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64894.exe
        5⤵
        
        PID:10252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48197.exe
        5⤵
        
        PID:14404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64341.exe
        5⤵
        
        PID:4152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9355.exe
      4⤵
      PID:9636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22302.exe
      4⤵
      PID:14236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61541.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22315.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22315.exe
    3⤵
    PID:6184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9472.exe
      4⤵
      PID:7440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60117.exe
      4⤵
      PID:12648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15355.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15355.exe
      4⤵
      PID:4412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43349.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43349.exe
    3⤵
    PID:8952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6148.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6148.exe
    3⤵
    PID:13324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13779.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13779.exe
    3⤵
    PID:12896
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7623.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7623.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1888.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1888.exe
    3⤵
    PID:5740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1446.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1446.exe
      4⤵
      PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47847.exe
        5⤵
        
        PID:10500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44549.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10667.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15044.exe
      4⤵
      PID:10416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27147.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12512
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12512 -s 424
        5⤵
        Program crash
        
        PID:15476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24021.exe
      4⤵
      PID:16100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13732.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13732.exe
    3⤵
    PID:7856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1853.exe
      4⤵
      PID:10348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13412.exe
      4⤵
      PID:13496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31860.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31860.exe
      4⤵
      PID:12660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10539.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10539.exe
    3⤵
    PID:10248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2909.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2909.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39845.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39845.exe
    3⤵
    PID:17036
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52305.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52305.exe
  2⤵
  PID:5576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27137.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27137.exe
    3⤵
    PID:7680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62229.exe
    3⤵
    PID:5768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47998.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47998.exe
    3⤵
    PID:16104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-49253.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-49253.exe
    3⤵
    PID:16716
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42172.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42172.exe
  2⤵
  PID:8136
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46492.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46492.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:11932
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10397.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10397.exe
  2⤵
  PID:16832

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 768 -ip 768
1⤵
PID:4304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 9988 -ip 9988
1⤵
PID:10916

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:5900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11683.exe

Filesize
468KB

MD5
eca56c5b7dfc163bf11c93000eb679f0

SHA1
72d252f3227d405fd61922f7fc5f385903c980ac

SHA256
9d3fb25055ab86c901f8361f9e1168e265a43aad895376132babb187cf470eae

SHA512
b4b1d56795a756e2e00be853a33b695d52ae7de8f8eaf9ca29f38f33d7388a6ce287243f79e686362b5170947d30acd47d67940056042acf92d09c4150ce8668

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12020.exe

Filesize
468KB

MD5
8e7f581c8f0c46c82ee3a1e85c7bce51

SHA1
1623f932747ddefedfc32b88524c2df3777b1c36

SHA256
007bd4b9d36bfab7dfbf00c95a8a10b4f5ae845df2766d1f42708c911328974d

SHA512
00bd8d0ad7412412acceb832dc6ffbd5417ea8d6dafb7f248cd485957ac52f2842aae5a964cb0b0f82bab956f316fa5ca2dc8ca958f607af400f7f221a8847e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12029.exe

Filesize
468KB

MD5
c50c1182e5a640682c5a7d781b9424d6

SHA1
63dd273a1fd42511889a638f0a720075fae048a2

SHA256
8a04c873c2a0cc592c27e167190e7785bce770687bddad85e431b6263301b754

SHA512
c8503d1ad92aecd182c3f5782def90950d1c12e54f2fd6a4afc3e64bbcbca7a214c81bbd88734c9262d654ce97797c166a14efc4b92df0c859d61ceebbaa49aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12160.exe

Filesize
468KB

MD5
43067ef7390d4973d99ec73f6656b899

SHA1
673ebd4ba0a37e77bdee3d63b32c56ec561ad678

SHA256
b0e16f75120312a808cbbc93c04d39264d55ec40984d335755450b240132b7cb

SHA512
7973daafc954df2fd6f2f2cf860bb06a293a41ee75aef48f921392016ea9fb50005e5c141abbe76963759f9727482a5dddb1810f93cade0db417c34ddb383cc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12999.exe

Filesize
468KB

MD5
9fcce4239baf1c3f86367f5a28985325

SHA1
0678150a25dc71f4efd14bfc5b48d89a66285746

SHA256
09ed7793d2dc9571c1d28477feadc129fa8d5513a3819e34fcfc8e9dc80d72c4

SHA512
c6eb7de898bf4cbcef0842e7f60712c1c0abacbef8e590668d95b44a6b8592a2427c34849beba6935de9abdb4cce75025f55e9a9d806174fb130a77b7cf185bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15844.exe

Filesize
468KB

MD5
4b00b1f60ab01bccf19b44d44700f656

SHA1
ee32151b89b54798f157a93c819ba5a0496a2010

SHA256
c022fb65c9f7d177133dae8e4c47e3036364c1e6dd15287ea893d8a4333c9018

SHA512
8503eb8f6350cc6acbd2e99da5cd1c0a6d8adcc868bbe0e9854a020b236c785dbf73d60c0c615e388bdb3981a6849830293dd51384f1110c248512767f151daa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16161.exe

Filesize
468KB

MD5
e38339cb713087eacb943cac487e03b1

SHA1
f8cd267e8f3973323d1ccbe6169532704367dafe

SHA256
747ac01eebdbb27190fd2649639ad0385f7da34e8ea010ecd5eda465ef60badb

SHA512
d341198b57b1bb64511773d8bdc0aaea8322409aac8d957dd06a36b10519368decfc9afa6c50893e0245f74af22803745939eb67856857fb9a81fd8ae8908eaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19518.exe

Filesize
468KB

MD5
f3d25a5d733890b060dce09e00597832

SHA1
0d15abe65c17c78a4e3d8639b3d407a3c4b34ae3

SHA256
3bdd1ec3d8d526f03c9f18d58da8be4ae2fd0e9bb841a13680eff48e2feff0c4

SHA512
5a3b678f49bde34b52f0b2ed895c239300eba24acc843efcf2693fc62980b6e44b2026d36ac0c13a40c4af46f9895e825c3a3e9f650c93a204777c2b99cebf13

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19655.exe

Filesize
468KB

MD5
43b998cf3a593b5a846326c60da27cfa

SHA1
414cc2815355b2cf72796cd613a84c37f7e4b3dc

SHA256
18541a7165875b46172905f5e5d33bc42ecfa18dccde3c2da723e50b5e1035e0

SHA512
57829cd5f83e0c145343d0b1e67d69731c10c7c6dc7d5639d90a898192ffdf3baed83f71ee19ffe28a9935e24d9005c8c55b137b4e4747107c69a9296001d8e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2225.exe

Filesize
468KB

MD5
49e978477861b18c3c5d4b5aa63b1e25

SHA1
f298b645519c5cee0910710e82942e3ff6191c83

SHA256
1d8f683468d4fbc8192ee6ef96984b94aeb6bf57283ae13c4af220f06eaa6a4f

SHA512
4d78c4e73a7a5b75385a9b836032bad9716f92e1fea9b4f5899ab26c19e88552b89b6fed1f6ed9a9797ffcc63994f771818bfcc60736faef17b409f3df22608a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22318.exe

Filesize
468KB

MD5
386b1cf150bc4f00b0b90a8a8125b66c

SHA1
ef5b40d28ee85a327100ea0c52403d38ba609689

SHA256
67c9f0d6bc7d71a083dc5390bfcb9fbaeadf73cd14246227dc3f8b9739f595c7

SHA512
b293ea2b3801e185f4989921e67d218e95a224f26cd9421a840971702465d2c10611b7812ed803dc987e3ec166cfc329582f5d4d8615b391bf0110f8adfdf449

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23150.exe

Filesize
468KB

MD5
a9082bcb93d2e4b1bcf33a070d8f1b2e

SHA1
fc67759591083bb196783bcacc36abd96cdd8eee

SHA256
f64e0bbc8277c1db5434b303ad53e8f79d7f1276a4c56185cdf33e235203a98d

SHA512
72c8dc095e4fc2fd57b46e13ed8da09692c69cc54927f668810be275184dfede259aecc1070a9f0266c8268f0c040c046dc5fe799d767ff2df65a696422f5527

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26977.exe

Filesize
468KB

MD5
76aa68ccb0e4a8b6ca726bef33d76f55

SHA1
af564d4b2b7f13ed7a77e308629ecb24809a0151

SHA256
9e300bd228425081bfd3b3a78170cda0aa179c62ec235b34253da2ae56716f62

SHA512
242a7ec0a4f048976d3e019b893ec903e23910c9b8501328b0e20005c58685a0b1b023082cac5825c38ada32c97a92768e85f9776a1601cae0c6bc6b4605d203

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27169.exe

Filesize
468KB

MD5
fc2dc51ae60a11ff381ab018f829d429

SHA1
491014f22f85c9d985ea115650cacae5f13e183d

SHA256
35d1aab7b283f103740ad4ad18b52955a93eecf8696677143efe2e7950d71982

SHA512
375dd0d113c1e22fa3f8e9fc945fda8c2dfaff0ad800cf6518d69192465446b9a56a0c35c679d02ff3cd8f3c694d7c1a9d60c989c7bc27f8338a9e46841d40a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27489.exe

Filesize
468KB

MD5
7f000224ba8f7d24d9a8277a30a7d88f

SHA1
c0bbcd49571f55b75840809e6ed87aa493f4ca19

SHA256
dd761a4420fabe57775cca7732723e99c30993d7cddfa8b9336bf6e133cf2726

SHA512
97c90f6eda696308e2bb3130e9757148625f91223d429d720cee920d0dccd7475c299a27cab22e49011c1d30b8bfc51d925f293ad1c4122af8b739136747ae87

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28756.exe

Filesize
468KB

MD5
0fba95f66fa78cf1c26485e4bba176d3

SHA1
879c787f6db35f81a9bb0a2cde6e84a57ea4b6ec

SHA256
f75d1ebb5c1fb5e137c1712aa5213f3ef352f29251a193b5a80b22528e94acbc

SHA512
84316f867d4527b498d46079c6f15794c8846e39054910d28514dfee7f1bf89fc5ddbe52481b0b627823b00ab9701b270cf5fd589f32eae1d36355fd553eb67a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29281.exe

Filesize
468KB

MD5
0cba6546c0b8a5120ce9521b700dcb00

SHA1
edc4de95a5ec54d7e32952d97ae827d19b8d0821

SHA256
10c339517c2d760288eff773db0836680bfe85489449e852e5ecf1dc4c60c274

SHA512
e1531b22bc1b70d559bff084c9ecb9cf5bb40f0fb00f1247e129d6aadbe3e49d93a24f1eb14348f281d3d30dd3d1543588075be349059948cdbe94cfb36e6876

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35361.exe

Filesize
468KB

MD5
adfc90911f00f21e0c5773c3421d4317

SHA1
2a17ffc02d856f0ec7423ce0de86196493c40e47

SHA256
e5766e6660fd5b9ef40aa2b230c855bff8ccb2a25440f53286490b3eee9fdbe9

SHA512
2962b3f8d3f801ea8c886b0a3f3a021340a28e2095f81b610a901a0bd98279847a7fe968352d2d94529e41c9f60599808b68fc1c4f24834b3348da31991701a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35864.exe

Filesize
468KB

MD5
dee4eae9c8158a9c487be26350731fd9

SHA1
21698b4af77bc04871d85ba654492797e41ccf74

SHA256
0ff827578920f2a3ec92785351bd65d5de691e961fd4b70fd1576efd677939ff

SHA512
37f1fe6518598d5196388da1099fdac61080f2b3899a299e65c85f55234d88b501f7f237a1157d321b86ec4b8e9fc98d2869b68e654d0b5c2f826f3b19fb2ea4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35937.exe

Filesize
468KB

MD5
a675cf8006e69c2abd98817847120dc1

SHA1
35951bb649433d27b5d6f880982e548f4ca75830

SHA256
a0f2c73b2dace95101ed413781f1deed1ffbd5f0f0fe7a72780926603f0fbdc6

SHA512
8c80dfe3862294bad61c54c4daf70f6c3731eaa075c21c15762120039fb949181c90c4985e635505d673d05ac0c631d474ae8082ae3e8400b4aec705b5d3fea5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39396.exe

Filesize
468KB

MD5
ac8a627c23989ccee7d3a7061097247d

SHA1
556cc6bf9dc0a7fe43ab983e6ed0eed208d0bc1e

SHA256
f3e2e0155114952aa864f5e9dae0adf7fcecc8acdaadaac3d58f20a354ba4086

SHA512
7f66f6d6ca7bccc9ec7bbe5e89dcfd5e7c53d1ff505e30633308c2de66ebfeab2dfa34cab5aebb40e6aecbfb211c545a1bb0841cce284921dd466d7795d704c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39713.exe

Filesize
468KB

MD5
c9599b8721699edd8626849e634cc2b2

SHA1
1e53b73f135dcf59ac2c4da283f81981528eb659

SHA256
a016abac13f6f1afe3e3ac62b85ae8977269bf75521f778735dfec4f000c7141

SHA512
e00cd3654b09d99dc2f0f35fb913ab436ce0e6b05bd6f495f824a931a652bed37e4b6acc0d00429efa686973c338c6df39dac3f6ce26ce48b6449a6d7a09bb49

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40103.exe

Filesize
468KB

MD5
bcb6877b49cd6b7311a63f8ca4395725

SHA1
3f7ce12d7365807e384e06ee3f1689491735f2a4

SHA256
2d01a359ced64007bf0b8562126d908e7b6b56e8a3388eabc1d60ec136f6e670

SHA512
a4308ea30a171b5f53603b6ac04ed12b235a06542d0fa765b3cf651a55201fd02422d9288c27dc9a83f3db7445e8af069300ddee02e393f950d1f81bd8e04dd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42980.exe

Filesize
468KB

MD5
dc10cfb77522634f3b21fa20b9de13c7

SHA1
1e2a39920a01a49d0de6c19a2ed5adf6ec8201d2

SHA256
a0c6f3b7e2023e6f4b0bf789b6984ac3910170c68a9a93f96fcb368bd914eee4

SHA512
179c2d554044711a502f4803b6c5acc992f2a0b5ebb438989e7039afa432d8aed3709d22defd4c538f9ed088f35f6b45f9938a7f0e6b1d4be7ff79f47f71a35d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43716.exe

Filesize
468KB

MD5
bc8df2a35001f3f31ab96d25aa99b38a

SHA1
6de50620c51b03e540b2e04c6482dd76a4d5c230

SHA256
71a02bb5b265a6778da7ffdc99bd1bea1728b91a57dcbe04d149eb8c0b7a60d6

SHA512
91c5052b279c20f35a6fc66e9650f3299627f0f590e1776b4d5844c12ed94c39e0d60d5d0e98c994ab0869cb04ca636afd40dc71b7dc0a995512a27ac939af5e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43873.exe

Filesize
468KB

MD5
bcab85241aa3d9bfef2522ce95530477

SHA1
679e924a065fa4535f473d213b708191859d1af4

SHA256
23a629a708fa445a0d9b4faade244417f01ae8fe25e7894eb94f51e8af04f44c

SHA512
ea684b99e1a6f98453856699dd1ab8b03643a119adf24f7b42fbf288032fa3a8aeb93fecb6df831ae0c6f15914d93144c28102504caf7ce5e71269f95196021e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43877.exe

Filesize
468KB

MD5
572fc751b6e10e0654cffdfa9ecd8e68

SHA1
0c64d76753fd6e54b14671c59a53757bcfd3798c

SHA256
247bf430496049c3dddf9908764a1e81b5898c9a691185b41d57e6f278fcd836

SHA512
ca15e7d7d099f1eb56706fd75edc6293e213454d22369bb846e450012187b512c0a6c12b53e095d984650b004500e80a92c5a8693ace466c29859b38c165f4ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54859.exe

Filesize
468KB

MD5
dfbca62a0b6712bc34849d890b116832

SHA1
29c7c95f5db55f1d9bc61cf320018c9862c73138

SHA256
9a2f2d66902857c7baa951f3aa6dd9d9e374c08698c7f862e520ec5125a8793b

SHA512
9288f76f84cb42e73fba3b4fa1bc445adc902a2dc2de205079c52da97395b66a04050f24cff4aaba7014cf5cbef19f10fba95c6727da219a629352d549bd457a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58276.exe

Filesize
468KB

MD5
a9179d06847a303872defe35eebca276

SHA1
df83c20288c16847c73b047329881e189e3d0cd6

SHA256
26f40964d1a81f5c0752722dcb3c379739571a7fd38ee55913d3b9a6b1701bbb

SHA512
7b4555c1025a0c1a07cc4a816dbfcd8f5b051cf6103cee9ff09f969f99cf9617b70fbe8f2694799de78660907109f08351c4eabc058a6a6ac9764b573910076d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6030.exe

Filesize
468KB

MD5
42d685d017ba28445933d9e127a4cbf5

SHA1
b5c582be5705b7ae677ab40946c7d010f1472ef2

SHA256
8a52c66a6f34c7de9b1c4a8aeb87c1f2a1c7b7448fc7ad90b10727f8a2070fb6

SHA512
ac7f5d39cda4f8a233c6196d0a0924df8ed3d191726d9d844afc08a2f6ade10a54c2ca31100a6d66fe93f698d19608682cb8a0d1fd39a3fc8c25c5dcac985c67

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60737.exe

Filesize
468KB

MD5
237d421627bf9c6e4da74c0ba8e300d8

SHA1
f38b4fe036686a5f88476bcdb51bc76062ecf0cc

SHA256
7263f9dcbcc5cc494bb7305c4edafe19758c7620317844452feeb7e60b52e28a

SHA512
7cdf53bd05e06ac9884a134f54bb35371eb38c8806e540da32f15f44461b1266c9e9e91625cb4b8b5d7b11f27291a962bc9d6733baf0e4855cfd4aa0e93e128b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60747.exe

Filesize
468KB

MD5
da5e681c119ec4f3c2bd3d4121815918

SHA1
c8c69bbba6ef6a41e65c317df31440dadbc1d8b7

SHA256
bb1c0a5662285da617e39eb0f08b46f4a24ad5c55ffafbf90fa53de5913f37c5

SHA512
b3859bc101e8cc3a354274533930dff8ebc8dda054a41eefc0ec3f954f81ac8fddc37348b81695a3321353134d2f163acfa2aaafaacf52f2cbec615b26c260e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7111.exe

Filesize
468KB

MD5
3a4481e3fa972d0c623948cb3e89eed5

SHA1
a0d9fcd5612d2f916ddfbc9835cd8e9c7b58d273

SHA256
4ac292a0f6ef9df11173b5289d82a7ebc2e5d55493a3dd34f2a1161b460bf791

SHA512
c3bc97d0c2db8b82c1de2e8bc66bc30b866b79f7f14755c57d0d86ad9131ccaa87d76bf5c08dc0a0a23f809a7a59cb24c4e0d44414893ac3336b07587f037e0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7815.exe

Filesize
468KB

MD5
f6f97576ca95f119caafc4450eb95a19

SHA1
6292c4e344df34a07fd168109a6701c964397d64

SHA256
ebae797e455cc211b8d46969ed25d2e21eb6f147810b03da94be6b05db824625

SHA512
ca9a3e439caa93c24b6fd4440acfbae2ea28311c945124b0da701356710c10f99fa854df4c97291e638a9c9dcb1a620f12d5d2b683e3e18b47ee5ec76687956c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9316.exe

Filesize
468KB

MD5
47ee562e0dee7387f9f81767b3fa80fe

SHA1
ed88d3d01a1e489e2983c3ee2610c99d4aac380a

SHA256
9ae5bddf97640529b84550dc6e738ca03c10484b400967fb98a9dc82c2285758

SHA512
ae663990c1dcb48a5fc58d88613013673cd05fb2fe3d9f2f666766bf528883632bdb95d3d00a23862a8703d55e604af817838ca5a7ecd01daac209f8e7868544

Download Submit
memory/8-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/116-33-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/216-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/412-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/432-463-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/512-161-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/556-201-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/576-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/708-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/736-160-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/768-213-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/768-68-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/840-88-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/872-14-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1072-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1536-112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1564-423-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1724-469-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1760-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1812-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1872-444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2004-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2052-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2084-153-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2108-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2280-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2284-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2312-46-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2336-432-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2352-90-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2384-67-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2436-427-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2484-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2504-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2528-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2584-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2616-300-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2716-223-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2728-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2784-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2796-431-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2872-118-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2952-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2960-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3084-266-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3088-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3120-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3176-446-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3216-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3476-149-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3504-276-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3664-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3724-150-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3808-303-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3844-261-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3916-256-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3928-359-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3960-451-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4004-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4124-49-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4128-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4180-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4252-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4260-199-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4284-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4304-464-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4400-450-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4420-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4452-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4508-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4600-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4640-89-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4708-449-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4828-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4844-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4904-191-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4944-304-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4992-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4996-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5056-28-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5084-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5100-366-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5128-472-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5196-478-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5224-476-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5284-502-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5324-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5356-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5392-514-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5408-510-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5424-511-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5436-509-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5452-513-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5528-512-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5748-548-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5756-547-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15784-2710-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads