4a73f4710c98850f9ae9bc1f8b6eca1dc471508c62a9998349d0ff1c9f685893

Analysis

max time kernel
120s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 16:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4847ace35927271821c8d40e61be2ae0N.exe
Size

468KB
MD5

4847ace35927271821c8d40e61be2ae0
SHA1

abf9bfba9fdf18c676c757b2a4a9a11a08648621
SHA256

4a73f4710c98850f9ae9bc1f8b6eca1dc471508c62a9998349d0ff1c9f685893
SHA512

fcf4acd64f16043f6a83e262dc65b4882fe504a56598e86598f93c5bfaaaa8d2a64b8df1cf4f5c3886602e24f721f0ef68e1658fb2466ee57b1dde97d8530777
SSDEEP

3072:P4kiogxxj28U2bYWPa37Lf8/Ew/0zIpdymHxw/HdGJy++MEVW2lO:P4RoqXU29PQ7LfJ014GJVbEVW

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3728	Unicorn-34255.exe
5104	Unicorn-16295.exe
5076	Unicorn-4597.exe
4244	Unicorn-23835.exe
4868	Unicorn-20305.exe
2256	Unicorn-34040.exe
4280	Unicorn-59522.exe
4552	Unicorn-42247.exe
4620	Unicorn-42801.exe
1756	Unicorn-58583.exe
2972	Unicorn-51110.exe
3476	Unicorn-51375.exe
4864	Unicorn-45245.exe
1316	Unicorn-65355.exe
760	Unicorn-9448.exe
3496	Unicorn-50363.exe
3128	Unicorn-60569.exe
3192	Unicorn-1162.exe
1704	Unicorn-41625.exe
2080	Unicorn-26605.exe
3484	Unicorn-58458.exe
3784	Unicorn-46471.exe
216	Unicorn-46471.exe
4696	Unicorn-38857.exe
4396	Unicorn-38857.exe
3776	Unicorn-46471.exe
2296	Unicorn-46855.exe
2436	Unicorn-1738.exe
3664	Unicorn-56538.exe
4952	Unicorn-6517.exe
3732	Unicorn-5342.exe
3328	Unicorn-4979.exe
1088	Unicorn-41928.exe
3252	Unicorn-55695.exe
4344	Unicorn-10023.exe
4792	Unicorn-42815.exe
4340	Unicorn-6302.exe
3596	Unicorn-59032.exe
396	Unicorn-9831.exe
804	Unicorn-26360.exe
976	Unicorn-45694.exe
2348	Unicorn-51824.exe
3736	Unicorn-36042.exe
4220	Unicorn-64076.exe
1712	Unicorn-19152.exe
1260	Unicorn-19152.exe
3260	Unicorn-17105.exe
3716	Unicorn-32150.exe
4712	Unicorn-52016.exe
1416	Unicorn-10983.exe
5132	Unicorn-13213.exe
5140	Unicorn-65015.exe
5152	Unicorn-19344.exe
5188	Unicorn-63499.exe
5252	Unicorn-51995.exe
5280	Unicorn-5753.exe
5344	Unicorn-31766.exe
5368	Unicorn-51632.exe
5352	Unicorn-51632.exe
5376	Unicorn-47548.exe
5412	Unicorn-54954.exe
5420	Unicorn-57754.exe
5448	Unicorn-385.exe
5672	Unicorn-12519.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
9604	6996	WerFault.exe	246
15636	12748	WerFault.exe	676

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51767.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54528.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18418.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58583.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10023.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32690.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28541.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51764.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1162.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48798.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39464.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55695.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47268.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40584.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53148.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31247.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51859.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17921.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20564.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1694.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62839.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-698.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59634.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33711.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23764.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55763.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7218.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39680.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21241.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60968.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22503.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40298.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59899.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45734.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53635.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37838.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9685.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4227.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22603.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32742.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6701.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36150.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28667.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46431.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5202.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4227.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36080.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17714.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51375.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54072.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15538.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59904.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15884	dwm.exe
Token: SeChangeNotifyPrivilege	15884	dwm.exe
Token: 33	15884	dwm.exe
Token: SeIncBasePriorityPrivilege	15884	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1584	4847ace35927271821c8d40e61be2ae0N.exe
3728	Unicorn-34255.exe
5076	Unicorn-4597.exe
5104	Unicorn-16295.exe
2256	Unicorn-34040.exe
4244	Unicorn-23835.exe
4868	Unicorn-20305.exe
4280	Unicorn-59522.exe
4552	Unicorn-42247.exe
4620	Unicorn-42801.exe
1756	Unicorn-58583.exe
2972	Unicorn-51110.exe
4864	Unicorn-45245.exe
3476	Unicorn-51375.exe
1316	Unicorn-65355.exe
760	Unicorn-9448.exe
3128	Unicorn-60569.exe
3496	Unicorn-50363.exe
3192	Unicorn-1162.exe
4396	Unicorn-38857.exe
3784	Unicorn-46471.exe
216	Unicorn-46471.exe
1704	Unicorn-41625.exe
3776	Unicorn-46471.exe
4696	Unicorn-38857.exe
3484	Unicorn-58458.exe
2080	Unicorn-26605.exe
3664	Unicorn-56538.exe
4952	Unicorn-6517.exe
2436	Unicorn-1738.exe
2296	Unicorn-46855.exe
3732	Unicorn-5342.exe
3328	Unicorn-4979.exe
1088	Unicorn-41928.exe
3252	Unicorn-55695.exe
4344	Unicorn-10023.exe
4792	Unicorn-42815.exe
4340	Unicorn-6302.exe
3596	Unicorn-59032.exe
396	Unicorn-9831.exe
804	Unicorn-26360.exe
976	Unicorn-45694.exe
3736	Unicorn-36042.exe
2348	Unicorn-51824.exe
4220	Unicorn-64076.exe
1260	Unicorn-19152.exe
1416	Unicorn-10983.exe
5140	Unicorn-65015.exe
5152	Unicorn-19344.exe
3260	Unicorn-17105.exe
3716	Unicorn-32150.exe
5132	Unicorn-13213.exe
4712	Unicorn-52016.exe
1712	Unicorn-19152.exe
5188	Unicorn-63499.exe
5368	Unicorn-51632.exe
5352	Unicorn-51632.exe
5376	Unicorn-47548.exe
5280	Unicorn-5753.exe
5412	Unicorn-54954.exe
5344	Unicorn-31766.exe
5420	Unicorn-57754.exe
5448	Unicorn-385.exe
5252	Unicorn-51995.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1584 wrote to memory of 3728	1584	4847ace35927271821c8d40e61be2ae0N.exe	97
PID 1584 wrote to memory of 3728	1584	4847ace35927271821c8d40e61be2ae0N.exe	97
PID 1584 wrote to memory of 3728	1584	4847ace35927271821c8d40e61be2ae0N.exe	97
PID 3728 wrote to memory of 5104	3728	Unicorn-34255.exe	100
PID 3728 wrote to memory of 5104	3728	Unicorn-34255.exe	100
PID 3728 wrote to memory of 5104	3728	Unicorn-34255.exe	100
PID 1584 wrote to memory of 5076	1584	4847ace35927271821c8d40e61be2ae0N.exe	101
PID 1584 wrote to memory of 5076	1584	4847ace35927271821c8d40e61be2ae0N.exe	101
PID 1584 wrote to memory of 5076	1584	4847ace35927271821c8d40e61be2ae0N.exe	101
PID 5076 wrote to memory of 4244	5076	Unicorn-4597.exe	104
PID 5076 wrote to memory of 4244	5076	Unicorn-4597.exe	104
PID 5076 wrote to memory of 4244	5076	Unicorn-4597.exe	104
PID 3728 wrote to memory of 4868	3728	Unicorn-34255.exe	105
PID 3728 wrote to memory of 4868	3728	Unicorn-34255.exe	105
PID 3728 wrote to memory of 4868	3728	Unicorn-34255.exe	105
PID 1584 wrote to memory of 2256	1584	4847ace35927271821c8d40e61be2ae0N.exe	106
PID 1584 wrote to memory of 2256	1584	4847ace35927271821c8d40e61be2ae0N.exe	106
PID 1584 wrote to memory of 2256	1584	4847ace35927271821c8d40e61be2ae0N.exe	106
PID 5104 wrote to memory of 4280	5104	Unicorn-16295.exe	107
PID 5104 wrote to memory of 4280	5104	Unicorn-16295.exe	107
PID 5104 wrote to memory of 4280	5104	Unicorn-16295.exe	107
PID 4244 wrote to memory of 4552	4244	Unicorn-23835.exe	108
PID 4244 wrote to memory of 4552	4244	Unicorn-23835.exe	108
PID 4244 wrote to memory of 4552	4244	Unicorn-23835.exe	108
PID 5076 wrote to memory of 4620	5076	Unicorn-4597.exe	109
PID 5076 wrote to memory of 4620	5076	Unicorn-4597.exe	109
PID 5076 wrote to memory of 4620	5076	Unicorn-4597.exe	109
PID 2256 wrote to memory of 1756	2256	Unicorn-34040.exe	110
PID 2256 wrote to memory of 1756	2256	Unicorn-34040.exe	110
PID 2256 wrote to memory of 1756	2256	Unicorn-34040.exe	110
PID 1584 wrote to memory of 2972	1584	4847ace35927271821c8d40e61be2ae0N.exe	111
PID 1584 wrote to memory of 2972	1584	4847ace35927271821c8d40e61be2ae0N.exe	111
PID 1584 wrote to memory of 2972	1584	4847ace35927271821c8d40e61be2ae0N.exe	111
PID 4868 wrote to memory of 3476	4868	Unicorn-20305.exe	112
PID 4868 wrote to memory of 3476	4868	Unicorn-20305.exe	112
PID 4868 wrote to memory of 3476	4868	Unicorn-20305.exe	112
PID 3728 wrote to memory of 4864	3728	Unicorn-34255.exe	113
PID 3728 wrote to memory of 4864	3728	Unicorn-34255.exe	113
PID 3728 wrote to memory of 4864	3728	Unicorn-34255.exe	113
PID 4280 wrote to memory of 1316	4280	Unicorn-59522.exe	114
PID 4280 wrote to memory of 1316	4280	Unicorn-59522.exe	114
PID 4280 wrote to memory of 1316	4280	Unicorn-59522.exe	114
PID 5104 wrote to memory of 760	5104	Unicorn-16295.exe	115
PID 5104 wrote to memory of 760	5104	Unicorn-16295.exe	115
PID 5104 wrote to memory of 760	5104	Unicorn-16295.exe	115
PID 4620 wrote to memory of 3496	4620	Unicorn-42801.exe	116
PID 4620 wrote to memory of 3496	4620	Unicorn-42801.exe	116
PID 4620 wrote to memory of 3496	4620	Unicorn-42801.exe	116
PID 5076 wrote to memory of 3128	5076	Unicorn-4597.exe	117
PID 5076 wrote to memory of 3128	5076	Unicorn-4597.exe	117
PID 5076 wrote to memory of 3128	5076	Unicorn-4597.exe	117
PID 4552 wrote to memory of 3192	4552	Unicorn-42247.exe	118
PID 4552 wrote to memory of 3192	4552	Unicorn-42247.exe	118
PID 4552 wrote to memory of 3192	4552	Unicorn-42247.exe	118
PID 1584 wrote to memory of 1704	1584	4847ace35927271821c8d40e61be2ae0N.exe	119
PID 1584 wrote to memory of 1704	1584	4847ace35927271821c8d40e61be2ae0N.exe	119
PID 1584 wrote to memory of 1704	1584	4847ace35927271821c8d40e61be2ae0N.exe	119
PID 4244 wrote to memory of 2080	4244	Unicorn-23835.exe	120
PID 4244 wrote to memory of 2080	4244	Unicorn-23835.exe	120
PID 4244 wrote to memory of 2080	4244	Unicorn-23835.exe	120
PID 3728 wrote to memory of 3484	3728	Unicorn-34255.exe	122
PID 3728 wrote to memory of 3484	3728	Unicorn-34255.exe	122
PID 3728 wrote to memory of 3484	3728	Unicorn-34255.exe	122
PID 1756 wrote to memory of 216	1756	Unicorn-58583.exe	124

C:\Users\Admin\AppData\Local\Temp\4847ace35927271821c8d40e61be2ae0N.exe
"C:\Users\Admin\AppData\Local\Temp\4847ace35927271821c8d40e61be2ae0N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34255.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34255.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16295.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16295.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59522.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59522.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65355.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46855.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10983.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19256.exe
        8⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62120.exe
        9⤵
        
        PID:7600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
        10⤵
        
        PID:12668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27406.exe
        10⤵
        
        PID:16736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42986.exe
        9⤵
        
        PID:2588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9685.exe
        9⤵
        
        PID:13688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14910.exe
        9⤵
        
        PID:16608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1554.exe
        8⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42292.exe
        9⤵
        
        PID:12584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4163.exe
        9⤵
        
        PID:17424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18761.exe
        8⤵
        
        PID:10676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27715.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34833.exe
        8⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29898.exe
        7⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61892.exe
        8⤵
        
        PID:9996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57403.exe
        8⤵
        
        PID:13516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41142.exe
        8⤵
        
        PID:16828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1221.exe
        7⤵
        
        PID:8364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54367.exe
        7⤵
        
        PID:11852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14214.exe
        7⤵
        
        PID:1328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31766.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24492.exe
        7⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37948.exe
        8⤵
        
        PID:8132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63776.exe
        9⤵
        
        PID:15100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6986.exe
        9⤵
        
        PID:6036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21362.exe
        8⤵
        
        PID:10768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21849.exe
        8⤵
        
        PID:13568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43307.exe
        8⤵
        
        PID:5300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52255.exe
        7⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23408.exe
        8⤵
        
        PID:12436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56763.exe
        8⤵
        
        PID:16408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6701.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57263.exe
        7⤵
        
        PID:3780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        7⤵
        
        PID:15028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5854.exe
        7⤵
        
        PID:7140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63862.exe
        6⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1082.exe
        7⤵
        
        PID:8396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52690.exe
        7⤵
        
        PID:12824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46431.exe
        7⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62535.exe
        7⤵
        
        PID:6236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49542.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62816.exe
        7⤵
        
        PID:12720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35602.exe
        7⤵
        
        PID:4880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44842.exe
        7⤵
        
        PID:5760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2901.exe
        6⤵
        
        PID:14684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29034.exe
        6⤵
        
        PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56538.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51632.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36168.exe
        7⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58036.exe
        8⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36812.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57403.exe
        9⤵
        
        PID:13496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49338.exe
        9⤵
        
        PID:5000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53895.exe
        8⤵
        
        PID:5016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9685.exe
        8⤵
        
        PID:13600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26587.exe
        8⤵
        
        PID:16592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36390.exe
        7⤵
        
        PID:8040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57964.exe
        8⤵
        
        PID:14112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35602.exe
        8⤵
        
        PID:1996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27218.exe
        8⤵
        
        PID:17904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49322.exe
        7⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12198.exe
        7⤵
        
        PID:13916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        7⤵
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1386.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1386.exe
        7⤵
        
        PID:16688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50127.exe
        6⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7735.exe
        7⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58732.exe
        8⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27790.exe
        8⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30978.exe
        7⤵
        
        PID:12836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33549.exe
        7⤵
        
        PID:7708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7845.exe
        6⤵
        
        PID:10212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35340.exe
        6⤵
        
        PID:14832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46697.exe
        6⤵
        
        PID:2220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-385.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19256.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62120.exe
        7⤵
        
        PID:7592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16008.exe
        8⤵
        
        PID:12724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19622.exe
        8⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51155.exe
        7⤵
        
        PID:10256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9685.exe
        7⤵
        
        PID:13656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33650.exe
        6⤵
        
        PID:7196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55608.exe
        7⤵
        
        PID:15244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46156.exe
        7⤵
        
        PID:7764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17609.exe
        6⤵
        
        PID:10200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14310.exe
        6⤵
        
        PID:15020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22581.exe
        6⤵
        
        PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11782.exe
        5⤵
        
        PID:6440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48576.exe
        6⤵
        
        PID:8676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26740.exe
        7⤵
        
        PID:11336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33711.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23246.exe
        6⤵
        
        PID:9892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31361.exe
        6⤵
        
        PID:15992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22503.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1545.exe
        5⤵
        
        PID:8252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55608.exe
        6⤵
        
        PID:15236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47443.exe
        6⤵
        
        PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29166.exe
        5⤵
        
        PID:11864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30169.exe
        5⤵
        
        PID:412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9448.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1738.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19344.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56588.exe
        7⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34108.exe
        8⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53340.exe
        9⤵
        
        PID:10088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37610.exe
        9⤵
        
        PID:14772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64111.exe
        9⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33474.exe
        8⤵
        
        PID:10232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9685.exe
        8⤵
        
        PID:13664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3806.exe
        8⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30334.exe
        7⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54072.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44511.exe
        8⤵
        
        PID:14808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26545.exe
        7⤵
        
        PID:10672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47943.exe
        7⤵
        
        PID:4812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44647.exe
        7⤵
        
        PID:17032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16878.exe
        6⤵
        
        PID:5508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14455.exe
        7⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53340.exe
        8⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61487.exe
        8⤵
        
        PID:13560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43555.exe
        8⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4397.exe
        7⤵
        
        PID:11004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17050.exe
        7⤵
        
        PID:13912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15289.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15289.exe
        6⤵
        
        PID:7816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6894.exe
        6⤵
        
        PID:8808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55178.exe
        6⤵
        
        PID:12140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12504.exe
        6⤵
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51995.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19256.exe
        6⤵
        
        PID:5968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45976.exe
        7⤵
        
        PID:7676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17980.exe
        8⤵
        
        PID:12944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36835.exe
        8⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17906.exe
        7⤵
        
        PID:10336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9685.exe
        7⤵
        
        PID:13696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46431.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62535.exe
        7⤵
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54263.exe
        6⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13407.exe
        7⤵
        
        PID:11328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44871.exe
        7⤵
        
        PID:14432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47447.exe
        7⤵
        
        PID:17048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13525.exe
        6⤵
        
        PID:10392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54767.exe
        6⤵
        
        PID:14692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11014.exe
        6⤵
        
        PID:17928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5917.exe
        5⤵
        
        PID:6456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19028.exe
        6⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1771.exe
        7⤵
        
        PID:6192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10262.exe
        6⤵
        
        PID:11692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26587.exe
        6⤵
        
        PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10210.exe
        5⤵
        
        PID:8272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45702.exe
        5⤵
        
        PID:11792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48014.exe
        5⤵
        
        PID:15600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11544.exe
        5⤵
        
        PID:17524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6517.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6517.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51632.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52120.exe
        6⤵
        
        PID:4052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12078.exe
        7⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23320.exe
        8⤵
        
        PID:14928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6986.exe
        8⤵
        
        PID:16672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28325.exe
        7⤵
        
        PID:10696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12198.exe
        7⤵
        
        PID:13968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30557.exe
        7⤵
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15970.exe
        6⤵
        
        PID:7980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33268.exe
        7⤵
        
        PID:13844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54516.exe
        7⤵
        
        PID:6720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53406.exe
        6⤵
        
        PID:10528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12198.exe
        6⤵
        
        PID:13936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17921.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1118.exe
        5⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37838.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11849.exe
        6⤵
        
        PID:12960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37786.exe
        5⤵
        
        PID:8716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14767.exe
        6⤵
        
        PID:15192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25735.exe
        6⤵
        
        PID:17456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20246.exe
        5⤵
        
        PID:13780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35364.exe
        5⤵
        
        PID:7504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54954.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54954.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36168.exe
        5⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61004.exe
        6⤵
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35312.exe
        7⤵
        
        PID:10004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
        7⤵
        
        PID:13032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10690.exe
        7⤵
        
        PID:17364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65031.exe
        6⤵
        
        PID:9768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54034.exe
        6⤵
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14910.exe
        6⤵
        
        PID:16600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14818.exe
        5⤵
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4139.exe
        6⤵
        
        PID:9272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57403.exe
        6⤵
        
        PID:13572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31110.exe
        6⤵
        
        PID:17276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10262.exe
        5⤵
        
        PID:11012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47260.exe
        5⤵
        
        PID:4328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7310.exe
        5⤵
        
        PID:17264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48802.exe
      4⤵
      PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4227.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
        5⤵
        
        PID:12260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43499.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28541.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7218.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39231.exe
      4⤵
      PID:17584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20305.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20305.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51375.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46471.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64076.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43376.exe
        7⤵
        
        PID:3920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18052.exe
        8⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27964.exe
        9⤵
        
        PID:8456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11186.exe
        9⤵
        
        PID:11920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49420.exe
        9⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-698.exe
        8⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65208.exe
        9⤵
        
        PID:12488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52487.exe
        9⤵
        
        PID:1968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12285.exe
        8⤵
        
        PID:12224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59831.exe
        7⤵
        
        PID:3232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10475.exe
        8⤵
        
        PID:8344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33268.exe
        9⤵
        
        PID:13828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23706.exe
        9⤵
        
        PID:13984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10262.exe
        8⤵
        
        PID:11704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17842.exe
        8⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62535.exe
        8⤵
        
        PID:9744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15201.exe
        7⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17714.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44123.exe
        6⤵
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10459.exe
        7⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8311.exe
        8⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44243.exe
        8⤵
        
        PID:12164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30095.exe
        8⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
        7⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36354.exe
        7⤵
        
        PID:12872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64111.exe
        7⤵
        
        PID:15852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47438.exe
        6⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48576.exe
        7⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
        7⤵
        
        PID:12212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16637.exe
        7⤵
        
        PID:16400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22603.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32882.exe
        6⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18451.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18451.exe
        6⤵
        
        PID:7960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65015.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        6⤵
        
        PID:5428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1243.exe
        7⤵
        
        PID:5824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37662.exe
        8⤵
        
        PID:14908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49338.exe
        8⤵
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16555.exe
        8⤵
        
        PID:17316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43475.exe
        7⤵
        
        PID:14840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39603.exe
        7⤵
        
        PID:16796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49219.exe
        6⤵
        
        PID:7892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64352.exe
        7⤵
        
        PID:15084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6986.exe
        7⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65466.exe
        6⤵
        
        PID:10424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16090.exe
        6⤵
        
        PID:13864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        6⤵
        
        PID:4048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64100.exe
        6⤵
        
        PID:17468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5917.exe
        5⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22728.exe
        6⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49109.exe
        7⤵
        
        PID:17564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36162.exe
        6⤵
        
        PID:12644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56436.exe
        6⤵
        
        PID:5436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43651.exe
        5⤵
        
        PID:8684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51716.exe
        6⤵
        
        PID:4548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1039.exe
        6⤵
        
        PID:7300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14145.exe
        5⤵
        
        PID:12032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23111.exe
        5⤵
        
        PID:5276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38857.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51824.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        6⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65363.exe
        7⤵
        
        PID:8168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57964.exe
        8⤵
        
        PID:14100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40234.exe
        8⤵
        
        PID:1192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28325.exe
        7⤵
        
        PID:10712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12198.exe
        7⤵
        
        PID:13960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47771.exe
        7⤵
        
        PID:17228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28222.exe
        6⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7647.exe
        7⤵
        
        PID:13584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53406.exe
        6⤵
        
        PID:10492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12198.exe
        6⤵
        
        PID:13976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20142.exe
        6⤵
        
        PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53635.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60968.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
        6⤵
        
        PID:12220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49886.exe
        6⤵
        
        PID:5568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12514.exe
        5⤵
        
        PID:4560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53974.exe
        5⤵
        
        PID:12576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14022.exe
        5⤵
        
        PID:4516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13213.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13213.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        5⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62431.exe
        6⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52115.exe
        7⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11185.exe
        7⤵
        
        PID:13748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46431.exe
        7⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-697.exe
        6⤵
        
        PID:10864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27409.exe
        6⤵
        
        PID:14496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
        6⤵
        
        PID:5404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45903.exe
        5⤵
        
        PID:7348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17225.exe
        5⤵
        
        PID:10896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13350.exe
        5⤵
        
        PID:14180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13837.exe
        5⤵
        
        PID:8092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11782.exe
      4⤵
      PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7735.exe
        5⤵
        
        PID:7200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27330.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51667.exe
        5⤵
        
        PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1545.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1545.exe
      4⤵
      PID:8292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28667.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42252.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42252.exe
      4⤵
      PID:13116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38529.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38529.exe
      4⤵
      PID:15060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45245.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45245.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46471.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19152.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19256.exe
        6⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45976.exe
        7⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4051.exe
        8⤵
        
        PID:15692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13291.exe
        8⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21990.exe
        7⤵
        
        PID:10320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9685.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15098.exe
        7⤵
        
        PID:7492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16981.exe
        6⤵
        
        PID:3816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29863.exe
        6⤵
        
        PID:11712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45734.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1612.exe
        6⤵
        
        PID:9104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30090.exe
        5⤵
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31612.exe
        6⤵
        
        PID:9860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12553.exe
        6⤵
        
        PID:8088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1221.exe
        5⤵
        
        PID:8372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33361.exe
        5⤵
        
        PID:13148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32150.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32150.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        5⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33532.exe
        6⤵
        
        PID:7340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52115.exe
        7⤵
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11185.exe
        7⤵
        
        PID:13528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22503.exe
        7⤵
        
        PID:6216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4397.exe
        6⤵
        
        PID:11060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35385.exe
        6⤵
        
        PID:14448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11967.exe
        6⤵
        
        PID:17440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15970.exe
        5⤵
        
        PID:7988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-211.exe
        6⤵
        
        PID:13280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32751.exe
        6⤵
        
        PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53406.exe
        5⤵
        
        PID:10536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12198.exe
        5⤵
        
        PID:13944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59530.exe
        5⤵
        
        PID:16420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1833.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1833.exe
      4⤵
      PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22536.exe
        5⤵
        
        PID:7456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36162.exe
        5⤵
        
        PID:12600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24916.exe
        5⤵
        
        PID:15860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12017.exe
      4⤵
      PID:9152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50180.exe
        5⤵
        
        PID:14504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36150.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17018.exe
      4⤵
      PID:12888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48301.exe
      4⤵
      PID:17212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58458.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58458.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52016.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52016.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19256.exe
        5⤵
        
        PID:6072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37424.exe
        6⤵
        
        PID:6260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2063.exe
        7⤵
        
        PID:9520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
        7⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28889.exe
        7⤵
        
        PID:16784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16022.exe
        6⤵
        
        PID:9832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23901.exe
        6⤵
        
        PID:14728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30002.exe
        6⤵
        
        PID:15956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4336.exe
        6⤵
        
        PID:17372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22986.exe
        5⤵
        
        PID:7356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13843.exe
        6⤵
        
        PID:10656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58135.exe
        6⤵
        
        PID:13900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6606.exe
        6⤵
        
        PID:5972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2093.exe
        5⤵
        
        PID:9188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11466.exe
        5⤵
        
        PID:13488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21241.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21241.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61892.exe
        5⤵
        
        PID:9808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37610.exe
        5⤵
        
        PID:14816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28808.exe
        5⤵
        
        PID:15724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50039.exe
      4⤵
      PID:9220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43066.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43066.exe
      4⤵
      PID:12896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36471.exe
      4⤵
      PID:6160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5753.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19256.exe
      4⤵
      PID:5960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54528.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21576.exe
        6⤵
        
        PID:11340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44871.exe
        6⤵
        
        PID:14360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23764.exe
        6⤵
        
        PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33474.exe
        5⤵
        
        PID:10180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9685.exe
        5⤵
        
        PID:13672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36966.exe
      4⤵
      PID:7940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41820.exe
        5⤵
        
        PID:12748
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12748 -s 436
        6⤵
        Program crash
        
        PID:15636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15538.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61383.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61383.exe
      4⤵
      PID:10544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5645.exe
      4⤵
      PID:15032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4894.exe
      4⤵
      PID:6868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56971.exe
    3⤵
    PID:6856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8311.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8311.exe
      4⤵
      PID:9212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
      4⤵
      PID:11564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9730.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9730.exe
      4⤵
      PID:6932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64296.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64296.exe
    3⤵
    PID:8776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25484.exe
      4⤵
      PID:12756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56763.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56763.exe
      4⤵
      PID:16428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62766.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62766.exe
    3⤵
    PID:11960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15630.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15630.exe
    3⤵
    PID:5668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12663.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12663.exe
    3⤵
    PID:8796
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4597.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4597.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5076
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23835.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4244
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42247.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1162.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4979.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12519.exe
        7⤵
        Executes dropped EXE
        
        PID:5672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28576.exe
        8⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3910.exe
        9⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39464.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:14808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6986.exe
        10⤵
        
        PID:16512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28325.exe
        9⤵
        
        PID:10720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12198.exe
        9⤵
        
        PID:14132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        9⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33674.exe
        9⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17122.exe
        8⤵
        
        PID:3148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19324.exe
        9⤵
        
        PID:12912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54516.exe
        9⤵
        
        PID:7536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21693.exe
        8⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14310.exe
        8⤵
        
        PID:15040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17921.exe
        8⤵
        
        PID:16552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54403.exe
        7⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
        8⤵
        
        PID:7936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31414.exe
        8⤵
        
        PID:9552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55751.exe
        8⤵
        
        PID:16012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58207.exe
        7⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54263.exe
        7⤵
        
        PID:13816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13266.exe
        6⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52120.exe
        7⤵
        
        PID:6116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35364.exe
        8⤵
        
        PID:7972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34958.exe
        8⤵
        
        PID:11504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46930.exe
        8⤵
        
        PID:15576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35139.exe
        8⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14190.exe
        7⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14767.exe
        8⤵
        
        PID:15256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32066.exe
        8⤵
        
        PID:5600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6701.exe
        7⤵
        
        PID:11392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57263.exe
        7⤵
        
        PID:14964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        7⤵
        
        PID:15064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15667.exe
        7⤵
        
        PID:17020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5917.exe
        6⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55156.exe
        7⤵
        
        PID:9876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20721.exe
        7⤵
        
        PID:5392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12017.exe
        6⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39680.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26530.exe
        6⤵
        
        PID:12852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16204.exe
        6⤵
        
        PID:17892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55695.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40724.exe
        6⤵
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20024.exe
        7⤵
        
        PID:6292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10475.exe
        8⤵
        
        PID:8336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49280.exe
        9⤵
        
        PID:16956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55763.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34641.exe
        8⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe
        7⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54663.exe
        7⤵
        
        PID:13016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28310.exe
        7⤵
        
        PID:17404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41958.exe
        6⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52115.exe
        7⤵
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11185.exe
        7⤵
        
        PID:2704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30095.exe
        7⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7845.exe
        6⤵
        
        PID:9884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-138.exe
        6⤵
        
        PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26617.exe
        5⤵
        
        PID:5832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33428.exe
        6⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55784.exe
        7⤵
        
        PID:7996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10262.exe
        7⤵
        
        PID:11736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35139.exe
        7⤵
        
        PID:7744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15690.exe
        6⤵
        
        PID:8548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48502.exe
        6⤵
        
        PID:11840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17786.exe
        5⤵
        
        PID:5820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14123.exe
        6⤵
        
        PID:9656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
        6⤵
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42403.exe
        6⤵
        
        PID:16760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11633.exe
        5⤵
        
        PID:9128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41820.exe
        6⤵
        
        PID:3520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56763.exe
        6⤵
        
        PID:6120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58487.exe
        5⤵
        
        PID:12232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22001.exe
        5⤵
        
        PID:6032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26605.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26360.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65363.exe
        7⤵
        
        PID:8124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28325.exe
        7⤵
        
        PID:10704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12198.exe
        7⤵
        
        PID:14144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40755.exe
        7⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18082.exe
        6⤵
        
        PID:7952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1231.exe
        7⤵
        
        PID:17936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22811.exe
        6⤵
        
        PID:12024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17146.exe
        6⤵
        
        PID:6692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57719.exe
        5⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50392.exe
        6⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41820.exe
        7⤵
        
        PID:13764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        6⤵
        
        PID:9596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50246.exe
        6⤵
        
        PID:15048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12471.exe
        6⤵
        
        PID:7860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16597.exe
        5⤵
        
        PID:8220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29671.exe
        5⤵
        
        PID:11632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55784.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55784.exe
        5⤵
        
        PID:6612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17105.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47268.exe
        5⤵
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40584.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24404.exe
        7⤵
        
        PID:9492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37610.exe
        7⤵
        
        PID:14780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52779.exe
        6⤵
        
        PID:9748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13926.exe
        6⤵
        
        PID:13552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51767.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53340.exe
        6⤵
        
        PID:10168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57403.exe
        6⤵
        
        PID:13536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31110.exe
        6⤵
        
        PID:17384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10262.exe
        5⤵
        
        PID:11036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8385.exe
        5⤵
        
        PID:13592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26658.exe
        5⤵
        
        PID:7608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36095.exe
      4⤵
      PID:6328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47616.exe
        5⤵
        
        PID:7916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10262.exe
        5⤵
        
        PID:11728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58722.exe
      4⤵
      PID:8184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33892.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33892.exe
      4⤵
      PID:12628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27922.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27922.exe
      4⤵
      PID:5564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42801.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42801.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50363.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50363.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10023.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40724.exe
        6⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20024.exe
        7⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4227.exe
        8⤵
        
        PID:7668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44243.exe
        8⤵
        
        PID:12148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5398.exe
        8⤵
        
        PID:5196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62535.exe
        8⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47787.exe
        7⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50387.exe
        7⤵
        
        PID:12592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24418.exe
        7⤵
        
        PID:17912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5202.exe
        6⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46988.exe
        7⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
        7⤵
        
        PID:7416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62330.exe
        7⤵
        
        PID:15744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1029.exe
        6⤵
        
        PID:8816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10259.exe
        6⤵
        
        PID:15164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25134.exe
        5⤵
        
        PID:5872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20024.exe
        6⤵
        
        PID:6300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21420.exe
        7⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21362.exe
        7⤵
        
        PID:10776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21849.exe
        7⤵
        
        PID:2016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49420.exe
        7⤵
        
        PID:4496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47491.exe
        6⤵
        
        PID:10188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51234.exe
        6⤵
        
        PID:13288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30550.exe
        6⤵
        
        PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27107.exe
        5⤵
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40408.exe
        6⤵
        
        PID:9168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52411.exe
        6⤵
        
        PID:12184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31055.exe
        6⤵
        
        PID:6596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41374.exe
        5⤵
        
        PID:7364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19475.exe
        5⤵
        
        PID:13268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6302.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17180.exe
        5⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65140.exe
        6⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15519.exe
        7⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36162.exe
        7⤵
        
        PID:12608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2862.exe
        6⤵
        
        PID:8264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33460.exe
        7⤵
        
        PID:12712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35602.exe
        7⤵
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50387.exe
        6⤵
        
        PID:12560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63531.exe
        5⤵
        
        PID:6996
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6996 -s 632
        6⤵
        Program crash
        
        PID:9604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46914.exe
        5⤵
        
        PID:8948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24088.exe
        6⤵
        
        PID:14804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26895.exe
        5⤵
        
        PID:11996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52658.exe
      4⤵
      PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18820.exe
        5⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9759.exe
        6⤵
        
        PID:10644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-766.exe
        6⤵
        
        PID:13988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10690.exe
        6⤵
        
        PID:17336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17418.exe
        5⤵
        
        PID:8828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56774.exe
        5⤵
        
        PID:12508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23764.exe
        5⤵
        
        PID:13028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49411.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49411.exe
      4⤵
      PID:6164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        5⤵
        
        PID:9512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
        5⤵
        
        PID:12180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37442.exe
        5⤵
        
        PID:6972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39210.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39210.exe
      4⤵
      PID:9900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5791.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5791.exe
      4⤵
      PID:3440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60569.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60569.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41928.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61336.exe
        5⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20024.exe
        6⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2063.exe
        7⤵
        
        PID:9560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
        7⤵
        
        PID:12208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41142.exe
        7⤵
        
        PID:16576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe
        6⤵
        
        PID:8940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42219.exe
        6⤵
        
        PID:13188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14221.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54403.exe
        5⤵
        
        PID:6784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21332.exe
        6⤵
        
        PID:8696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22618.exe
        6⤵
        
        PID:13048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10690.exe
        6⤵
        
        PID:17296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7845.exe
        5⤵
        
        PID:10048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18811.exe
        5⤵
        
        PID:14740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59634.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12882.exe
      4⤵
      PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36360.exe
        5⤵
        
        PID:6316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20564.exe
        6⤵
        
        PID:8216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27330.exe
        6⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22887.exe
        6⤵
        
        PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41094.exe
        5⤵
        
        PID:10352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55887.exe
        5⤵
        
        PID:13444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6775.exe
        5⤵
        
        PID:14916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14853.exe
      4⤵
      PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3267.exe
        5⤵
        
        PID:8384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53148.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34766.exe
        5⤵
        
        PID:11872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23764.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6894.exe
      4⤵
      PID:8800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55178.exe
      4⤵
      PID:12172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11544.exe
      4⤵
      PID:17412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42815.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42815.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12135.exe
      4⤵
      PID:5792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48612.exe
        5⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30704.exe
        6⤵
        
        PID:7292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36162.exe
        6⤵
        
        PID:12652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16555.exe
        6⤵
        
        PID:17324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51574.exe
        5⤵
        
        PID:8956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51810.exe
        5⤵
        
        PID:12456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55247.exe
        5⤵
        
        PID:15868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5202.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57076.exe
        5⤵
        
        PID:9352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45151.exe
        5⤵
        
        PID:13376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31110.exe
        5⤵
        
        PID:17392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5114.exe
      4⤵
      PID:2432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37445.exe
      4⤵
      PID:12492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23817.exe
    3⤵
    PID:5852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20024.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20024.exe
      4⤵
      PID:6268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27004.exe
        5⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41820.exe
        6⤵
        
        PID:13800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56763.exe
        6⤵
        
        PID:16392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1518.exe
        5⤵
        
        PID:10312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13837.exe
        5⤵
        
        PID:16584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39322.exe
      4⤵
      PID:8916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36781.exe
      4⤵
      PID:13752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62839.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24106.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24106.exe
    3⤵
    PID:6684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18208.exe
      4⤵
      PID:9384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
      4⤵
      PID:12556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58246.exe
      4⤵
      PID:8064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35516.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35516.exe
    3⤵
    PID:8728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58681.exe
    3⤵
    PID:12064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61707.exe
    3⤵
    PID:6668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-34040.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-34040.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2256
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58583.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58583.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46471.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59032.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59904.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44668.exe
        7⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60828.exe
        8⤵
        
        PID:8488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42012.exe
        9⤵
        
        PID:14364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23898.exe
        9⤵
        
        PID:13804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60579.exe
        8⤵
        
        PID:11948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11325.exe
        8⤵
        
        PID:15756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31055.exe
        8⤵
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1466.exe
        7⤵
        
        PID:8724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48798.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14818.exe
        6⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52115.exe
        7⤵
        
        PID:11204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8445.exe
        7⤵
        
        PID:15056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59835.exe
        7⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10262.exe
        6⤵
        
        PID:11052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5089.exe
        6⤵
        
        PID:16920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57719.exe
        5⤵
        
        PID:6464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26080.exe
        6⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30106.exe
        6⤵
        
        PID:10764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26665.exe
        6⤵
        
        PID:13800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4345.exe
        5⤵
        
        PID:8208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41820.exe
        6⤵
        
        PID:14348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54367.exe
        5⤵
        
        PID:11880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56892.exe
        5⤵
        
        PID:17344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36042.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36042.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1419.exe
        5⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44668.exe
        6⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52115.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11185.exe
        7⤵
        
        PID:13824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60027.exe
        7⤵
        
        PID:6064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55135.exe
        6⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11776.exe
        7⤵
        
        PID:6628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23901.exe
        6⤵
        
        PID:14756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30002.exe
        6⤵
        
        PID:1748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4336.exe
        6⤵
        
        PID:436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39026.exe
        5⤵
        
        PID:7188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14087.exe
        6⤵
        
        PID:12048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27559.exe
        5⤵
        
        PID:9708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5645.exe
        5⤵
        
        PID:15128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49498.exe
      4⤵
      PID:4756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63552.exe
        5⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18208.exe
        6⤵
        
        PID:9372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48595.exe
        7⤵
        
        PID:15284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
        6⤵
        
        PID:11860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45994.exe
        6⤵
        
        PID:7500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58643.exe
        5⤵
        
        PID:8428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36162.exe
        5⤵
        
        PID:12568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20639.exe
        5⤵
        
        PID:6680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53303.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53303.exe
      4⤵
      PID:5244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40844.exe
        5⤵
        
        PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7730.exe
        5⤵
        
        PID:12808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47447.exe
        5⤵
        
        PID:17072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63714.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63714.exe
      4⤵
      PID:9756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25484.exe
        5⤵
        
        PID:13144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28667.exe
        5⤵
        
        PID:16712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34698.exe
      4⤵
      PID:13232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38857.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38857.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9831.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46536.exe
        5⤵
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58316.exe
        6⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4227.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
        7⤵
        
        PID:12248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31247.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49899.exe
        6⤵
        
        PID:9072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42027.exe
        6⤵
        
        PID:13040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28502.exe
        6⤵
        
        PID:17540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6738.exe
        5⤵
        
        PID:7124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6775.exe
        6⤵
        
        PID:7816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10262.exe
        6⤵
        
        PID:11720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17842.exe
        6⤵
        
        PID:7080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34277.exe
        5⤵
        
        PID:9160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63843.exe
        5⤵
        
        PID:12132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18983.exe
        5⤵
        
        PID:16768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23318.exe
      4⤵
      PID:5364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44668.exe
        5⤵
        
        PID:6724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65244.exe
        6⤵
        
        PID:9116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28814.exe
        6⤵
        
        PID:12700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29273.exe
        6⤵
        
        PID:6980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10645.exe
        5⤵
        
        PID:9984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15550.exe
        5⤵
        
        PID:13412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23509.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23509.exe
      4⤵
      PID:7284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24316.exe
        5⤵
        
        PID:10908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8114.exe
        5⤵
        
        PID:14036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50571.exe
        5⤵
        
        PID:7488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7958.exe
      4⤵
      PID:7920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6885.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6885.exe
      4⤵
      PID:13420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57084.exe
      4⤵
      PID:7352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45694.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5503.exe
      4⤵
      PID:6092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42172.exe
        5⤵
        
        PID:6824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4227.exe
        6⤵
        
        PID:9144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15154.exe
        7⤵
        
        PID:16820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
        6⤵
        
        PID:12240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8387.exe
        6⤵
        
        PID:5708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29670.exe
        5⤵
        
        PID:8892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6986.exe
        6⤵
        
        PID:8060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9729.exe
        5⤵
        
        PID:15180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62839.exe
        5⤵
        
        PID:6124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21450.exe
      4⤵
      PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8223.exe
        5⤵
        
        PID:8500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26740.exe
        6⤵
        
        PID:9508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42071.exe
        6⤵
        
        PID:4144
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37610.exe
        5⤵
        
        PID:14788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-977.exe
      4⤵
      PID:9728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59899.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59338.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59338.exe
      4⤵
      PID:3972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26775.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26775.exe
    3⤵
    PID:4724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5223.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5223.exe
      4⤵
      PID:6180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20564.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23152.exe
        6⤵
        
        PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
        5⤵
        
        PID:12268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18418.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-698.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57978.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57978.exe
      4⤵
      PID:12116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62270.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62270.exe
      4⤵
      PID:5580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45999.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45999.exe
      4⤵
      PID:8244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64134.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64134.exe
    3⤵
    PID:6152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36080.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37610.exe
      4⤵
      PID:14796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48268.exe
      4⤵
      PID:16700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47178.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47178.exe
    3⤵
    PID:9712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51764.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:13236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59634.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59634.exe
    3⤵
    PID:7728
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51110.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51110.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5342.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5342.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47548.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30932.exe
        5⤵
        
        PID:5588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44668.exe
        6⤵
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31612.exe
        7⤵
        
        PID:9816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40298.exe
        7⤵
        
        PID:13304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41526.exe
        7⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30438.exe
        6⤵
        
        PID:8416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45447.exe
        6⤵
        
        PID:13788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46538.exe
        6⤵
        
        PID:15712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31235.exe
        6⤵
        
        PID:17240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59638.exe
        5⤵
        
        PID:7204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49685.exe
        6⤵
        
        PID:17572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35727.exe
        5⤵
        
        PID:9332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5645.exe
        5⤵
        
        PID:15112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16878.exe
      4⤵
      PID:5572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51020.exe
        5⤵
        
        PID:7376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21488.exe
        6⤵
        
        PID:13096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4397.exe
        5⤵
        
        PID:11028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35385.exe
        5⤵
        
        PID:13796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28111.exe
        5⤵
        
        PID:17056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50126.exe
      4⤵
      PID:8032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53340.exe
        5⤵
        
        PID:10072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57403.exe
        5⤵
        
        PID:13544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21105.exe
        5⤵
        
        PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55187.exe
      4⤵
      PID:10508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3533.exe
      4⤵
      PID:13924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38718.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38718.exe
      4⤵
      PID:7052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57754.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57754.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19256.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50252.exe
        5⤵
        
        PID:7084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31576.exe
        6⤵
        
        PID:12440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32742.exe
        5⤵
        
        PID:9840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9685.exe
        5⤵
        
        PID:13608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55203.exe
        5⤵
        
        PID:2572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46126.exe
        5⤵
        
        PID:5812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58252.exe
        5⤵
        
        PID:8436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32690.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32690.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-211.exe
        5⤵
        
        PID:14196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13291.exe
        5⤵
        
        PID:8068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44854.exe
      4⤵
      PID:10404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16090.exe
      4⤵
      PID:13856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26665.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26665.exe
      4⤵
      PID:7632
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24803.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24803.exe
    3⤵
    PID:6912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19028.exe
      4⤵
      PID:1668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2286.exe
      4⤵
      PID:11528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46930.exe
      4⤵
      PID:15588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48268.exe
      4⤵
      PID:16744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63766.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63766.exe
    3⤵
    PID:8768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31104.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31104.exe
      4⤵
      PID:15304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42071.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42071.exe
      4⤵
      PID:7136
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1694.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1694.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:11976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29209.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29209.exe
    3⤵
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4679.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4679.exe
    3⤵
    PID:8960
- C:\Users\Admin\AppData\Local\Temp\Unicorn-41625.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-41625.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19152.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19152.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19256.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62120.exe
        5⤵
        
        PID:7256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13407.exe
        6⤵
        
        PID:11320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44871.exe
        6⤵
        
        PID:3936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47447.exe
        6⤵
        
        PID:17064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33474.exe
        5⤵
        
        PID:10108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5601.exe
        5⤵
        
        PID:13480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49420.exe
        5⤵
        
        PID:1292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4729.exe
      4⤵
      PID:7112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29863.exe
      4⤵
      PID:11744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1770.exe
      4⤵
      PID:6928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21241.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21241.exe
    3⤵
    PID:6848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5846.exe
      4⤵
      PID:9556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9685.exe
      4⤵
      PID:13680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51859.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51859.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65214.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65214.exe
    3⤵
    PID:9784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35340.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35340.exe
    3⤵
    PID:14824
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63499.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63499.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5188
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19256.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19256.exe
    3⤵
    PID:6056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62120.exe
      4⤵
      PID:7580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61664.exe
        5⤵
        
        PID:14020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46156.exe
        5⤵
        
        PID:6524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30542.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30542.exe
      4⤵
      PID:9720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9685.exe
      4⤵
      PID:13616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39104.exe
        5⤵
        
        PID:16564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10826.exe
      4⤵
      PID:16724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57195.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57195.exe
    3⤵
    PID:8104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30808.exe
      4⤵
      PID:13064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1039.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1039.exe
      4⤵
      PID:5576
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16073.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16073.exe
    3⤵
    PID:10680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12198.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12198.exe
    3⤵
    PID:13952
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53424.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53424.exe
  2⤵
  PID:6712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50392.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50392.exe
    3⤵
    PID:7452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-211.exe
      4⤵
      PID:3696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60847.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60847.exe
      4⤵
      PID:15916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58503.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58503.exe
    3⤵
    PID:11412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51398.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51398.exe
    3⤵
    PID:3056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38726.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38726.exe
    3⤵
    PID:7240
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13985.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13985.exe
  2⤵
  PID:8668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53346.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53346.exe
  2⤵
  PID:12052

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4380,i,11251706013556949551,5157034131170452377,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:8
1⤵
PID:4560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 6996 -ip 6996
1⤵
PID:9332

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1162.exe

Filesize
468KB

MD5
2b5a8cdb558baf170af251808f15cd93

SHA1
52c69bef9003092741d5b20320842532735fd616

SHA256
fcc070a6bd2cb33eee91d4f89b7c13c54627e7adf1ba96330ab4f32c68f7c26c

SHA512
ea495bb024bad479ed141c8de95d38de2a12035294fc60d586711b0a37288dd6971e0f908ab1881b69fcd4ba5c18e808d6faf69e31d5e9bf17ab7afe1c45e936

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16295.exe

Filesize
468KB

MD5
4b2907cf68c635188215610387f4c07c

SHA1
4939d95f59257efc78604cd9909703413217f052

SHA256
5fa490bc4c143b675cb9a418d4f148cf008adfa3f92ee4e476315202f6b0fdb4

SHA512
0ac53f0444d4b1808945a49f4d3f4e9ccbe539f7bbbdf80917f1162a8e1d8364d922c5dd5bb6f6f32a27c6504e41e80ab965c670ca6d5931ad4c8334f5a2aed5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1738.exe

Filesize
468KB

MD5
54bd8599c9408e0cae4211989b01f1d1

SHA1
fa2321992a6c2c6225816e5aff2236ae03a84cb3

SHA256
dd834791470f33df2390cd1d4990be3404d8e4b8d107a9a13d3eea63bdc80222

SHA512
c5d0a7df4adeb14fb7820ac9a1dff8a68112028e6146b6592f6a5d85cd04e8a6fd6e76f9ae9b0dbea556c545c73a4321c183eb81f29ba4216a1408162cfc6c12

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20305.exe

Filesize
468KB

MD5
def3afa0c4c1220fc5a62b61f07f4656

SHA1
31a38c05f64ee5c84e3c49b6dd664397f0cab6bf

SHA256
349ae578decbd77320b15aaebb0005023da4359be86ccca0b5ca743575b88910

SHA512
ae44f2564333612ee39bb774840b001e95096eca7cf7a056f396545f61182c9a58c9ceb4a70877e95a37e082a529f426248de539e45906eed74d8c66acb9bef8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23764.exe

Filesize
468KB

MD5
e5cb6c9ba9ad19042ef5ba3432ebada8

SHA1
a59a85e61b049226438cfed148762194f3ba95c8

SHA256
76d2ed07d312d7f95c1db70523988e4d4a45d1969f4fbd462d38d20e260dfeb1

SHA512
cdaf7e78ad919a68607e5cf373007b491726b490b33e87c4b37b41e4b98d128a2d44ba685e3c05915cdbce232e8b11f82e062b623e267da4e5b7f999af7f138c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23835.exe

Filesize
468KB

MD5
8e90a3b31f3ccbcb1c4da7383d7f583f

SHA1
1a761f260403eaf41354402936f6a0776d9da2ee

SHA256
12722dc7852d4a20b26a28a01b69c665fa2ebfe534bda55b0ee40d5385cdccb4

SHA512
25e8aeb15f9c0fe2249ce5984b9e78f12f97abd80325bc2aa42e9fc4d154b421fb498c48457c109044b2e36847b1e015e023152c5b0901f7486a5ff3af1c3814

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26605.exe

Filesize
468KB

MD5
295b6c316bab3d5f4c4bc913eb66c1a1

SHA1
ac8188d584d12fe5d2f82cfb628de01be4a4c39c

SHA256
3c79d03a4a01dc1712369eb0d203c0e6c18ec2565e4020dfe4a1dd15c71b41ca

SHA512
6abae8c93bb685a5e0e3c04c5ac505b865bb394aff39b0d369dd5428c88e9e53da4d7f52cb07b7a6d66c3ebd1fe6304084016e64642a492c046e93b0506bd6b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34040.exe

Filesize
468KB

MD5
a48d16496454b8990db3a729e3017172

SHA1
7c3b25d2d1aa91152c22c558f3fe2f0d76660646

SHA256
d963363dc0fa345d5a3059f1a3b1716af02c3d3bf8ba3219cc83b9fde8f38ab0

SHA512
1edf10ce411facd055ea22eb92c040ce438b2822c12f45c296b318d9d4cb21eaddeea9a2768e1ff433407a6a35afd61b89a0a712f5d886a5da43eb83eb345be5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34255.exe

Filesize
468KB

MD5
5b8563bad32e6e5ef314aaefcc43768f

SHA1
1cfb6f079c420571a2b5261fee931c60ca879c49

SHA256
d60ce6979b50228c66e8f2327df0fab579e171ac0276d813f32e96c1ab96365c

SHA512
8124b558a0a6f1273ac0a8a10d8c3f5dacf5db79bcc25225f5b612d4d910105c03ba4eb060e531e851f1ca001fa83e723ceb356206aac4f0930958d9e531cc4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38857.exe

Filesize
468KB

MD5
3b96f4e0ee8868c386f7e56b85df3534

SHA1
e7b85f2e0120744228eabe2839b46f70dac57331

SHA256
c7e7427f5da2c1ce282762af4f3dea6644c133d5f1d8460c422dcbb396dc0eff

SHA512
5a3d2dca1bb01d14de6ca9c6cbbfd17759b4671dbc764f926329ddd15d2e6424c6e45576e1d3f375e2a6259e2414b9c37aaafb3a04e424a92015d6463b3fbdc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41625.exe

Filesize
468KB

MD5
52bc7a9582bcb452d5f93800de5f00a9

SHA1
e3ee0bac5f1b50cb78e697c007fff9d11db0c951

SHA256
dc149709c343cdbc0001a86d7f636525bcc1e53bc1f4cd373957a3bf855e1fee

SHA512
05ddc058ea342b2be5cff5cb24c07873008a92654107551a15d8677f702dbde75e537a985ca25ba2183e03143d2a230143803f8ea7ddc609a69c095e0f076831

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41928.exe

Filesize
468KB

MD5
701423a61dd2f2513142524f1c827366

SHA1
db1fbb7bebc7a08a1ebc726c2b93875c03ef43e6

SHA256
886e3cad6e219e6994e04bb914a48782c70f2ac11c6588a983e9254809ec013d

SHA512
b94d137ba89451a5a66782cc3ea2adcd6bed0323cb13af0466902c32974a7a8474f526e7c1221cc7b891ee2a6ae0a82ed431569d1710d91c0ca476aceba3073d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42247.exe

Filesize
468KB

MD5
d9bee0b677bcfb662f609f51f9f77876

SHA1
38d7c3c4f6e3f003d8f016834c9faa0da81a938e

SHA256
b3657f8bfeaaab2259c0dac29c00fcc76ecea51c88097de69558dd990dc588d4

SHA512
a8b750bcd63780e4d1c2501c1c9020b051a52a7afc2bde7710e79a3311487ba057ad2688d4192b576843cc82cf70aae456fc5b1f18b096768c7711bebf7b0871

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4227.exe

Filesize
468KB

MD5
46bb16da84ab40a03a862f946a3ef19d

SHA1
07c2453071864e8c09ab1c2d316844132cbcfea3

SHA256
6d388ffbcc4aecf501c649a1e217344c15f831d0bf2563ca913884794e3cf83a

SHA512
4af1210c07c144175d80263e24e642396c2e372c3c25508c0835b64d512a61c3c82f617c361faff96aa77d690d81507b3c9fd58a959920f723377b3b5725ceb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42801.exe

Filesize
468KB

MD5
8e4e4cd9c13890772b4cb001d23ef642

SHA1
ff59d64c865989c890c7c6d3f32c1b806461de9c

SHA256
a6ea98636dae7bfffbeaa9225f442061ce25f5b559455ef03a82946540a15444

SHA512
e5c4e1f8eb36a2b02ea5155dc748fef43c9d66b82e27c61ca0dda0750fa4dd69bcce1ee9a3b8a955b5ae03d322534a19caeae267cbc02ab33b676f06bf5a22b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45245.exe

Filesize
468KB

MD5
69330745369db8e105153cd07fc574bb

SHA1
be53e537d91fa177f297a6791111bce239c0664a

SHA256
2114e3a65861231ae084427ffcbb962972aa304cdabbb98faef8f062366ed9e6

SHA512
ad4e28b457f4886207db211bcd554372ad781f396700eb1f38bff9ff302c411c7208dd6f913c527be97212f8d4d4c8ef689665b2600c006e5f9689c6efadbf76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4597.exe

Filesize
468KB

MD5
ad89379ad88dfd64fd889d582e55be19

SHA1
9a14cf6f359c1d285b90fd9dde3b457e964bbece

SHA256
49a5d9d7db440ee7a92c08f3120ce353b6ee0ebcff43af20a8a9c2b87ef52b28

SHA512
daea5ab0c5802ba7d83cf5a8b5b6da7cf8a973ced470e5d92368c709f24a63d127b5eaae0f6b500e01382765d890566cbc760c82078d58078d9f79e644bdaf16

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46471.exe

Filesize
468KB

MD5
d7767b8c8888b77eb6bee08376b2cab8

SHA1
9faf7eda5c3b510e60b60d0e0c1fea67ddcf7fc0

SHA256
dc45008f3d9b40103633808bcc71c0042539f6af58a7f5aa990921ca0bea55fd

SHA512
cd4f07eff83d4062b35a06f9524eda4abafdb6a00641a04f0ffe0134083365a0c08a05d8f78ccdfcf2eb7881d9c1dc3c10e2a6b4b1c32301875fe563e8a84ea7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46855.exe

Filesize
468KB

MD5
e25ca161e266ada678158539f863b1be

SHA1
92a5e865efc681718469162ad80bd9bff28644cc

SHA256
4e3f8fe87ad36b9297f6206a2410464d391f1fcc022603fc508a95183391f78d

SHA512
75dabd49f2545b3c467347700a9548cdd6c390bed204daeba7de12c84b5c3e2f422a041da647f5f1e764ba0a460b08fe9df4d621b7796625c72fa7cc66d9a293

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4979.exe

Filesize
468KB

MD5
a4edc34fb4c0848efad567a8bd5e07f7

SHA1
ba6d08eb038323eb105fbd4d565ca8e052ffa44d

SHA256
ad1d9ffa5282d82bfba404920241cb4ca7126fb996e9779d9ab7d08e14d0fdff

SHA512
6a7fb3e921413aec3db63b0b3a9261902f103057a5a06ef0b3397a54cac70623822119718a6a464b0ad495d94d4c3ee008c44262e03f555fd233d8647e0cc793

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50363.exe

Filesize
468KB

MD5
daed258b8f1becebe59912f97f841813

SHA1
7c88cce0e2aeb3cb044795494bcafd5225e7c580

SHA256
04c18d9ae5d3808f10ff577b6a7407f15aeeb0fd48cc3daa47217a822d7e8e6d

SHA512
f16387c24e62399211c66a176d88f77cf18fcb11e6f8b7e9b76f09bafd3a3c9b53aad8ba85bdbb101d95e935fe55eb2bd8b793a828dfa4e13ed843d78bbcefc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51110.exe

Filesize
468KB

MD5
1e2d5b4aae80dc138fea64ff41647afc

SHA1
32c9e77af28c56819cb5bf4f843bb19277080397

SHA256
f0d51331f0dc0c307b481606b3504259f6aad5bfa6415c4909bbab428afa5fcf

SHA512
b3d1478bd49a2f326340cb1e7435c859edc0ce6ca7d9ff6569fefbbb3ec907d9f5214f155310ca6a0375164373b3560e6272d4b91f4a1155945dfce41cdced0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51375.exe

Filesize
468KB

MD5
d940d35dd8c7db95e7f715abaa5263e3

SHA1
4270b1e05bc412b4217e7ffb64cf42cee437d902

SHA256
8a2c71877411fb3bfc8690332225dff1a9578504a960f4f8f8c26b39aed74a53

SHA512
8c122ac976b00f53a231e6fc41e2e5d64982fb03e69cfe34619088ff834079a1c3b2b5b471c13dccde7c8f2b39da437e4ec0378dea382677cea1bfd00957c48a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5342.exe

Filesize
468KB

MD5
a7e33fb9b1ca8b9156f37da2d08c35b3

SHA1
204867b842d4dc3bfb21bc7db22937cb7350deec

SHA256
33d1e6d0d2829a7e228fc411955b6584a5cd94295c917f3d2f3f8dc6933785ec

SHA512
669a45dedaf126536382a5fe51b84305130f082fc0d91feb0956de33f7652bec3f8c9d66f0ce5fb28b839e3e5a275b50c36e07630d70bd296bc8e1526a7b6771

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56538.exe

Filesize
468KB

MD5
608feb70e886982c441bfecea637a584

SHA1
b57730a989ca2260cbdc2b3d82198474266b147f

SHA256
30048f23154e7dd93f849d077a4756de64e63e809304330dd56651b1c0ce1889

SHA512
c26ef03f5da5b88dfe16da7ce24ed311fc3744d2800a042264d830c3957a74429edbfcdb0f8dbdcab5fa29609ec53597ca5c604a6e64625355e209549ed31227

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58458.exe

Filesize
468KB

MD5
91c780eadbf5f0e385615223c3acd22d

SHA1
f1456a581b6e2fd1a887b2cbd7883b3f7265ee8a

SHA256
43cfbbcad1b9ac186b560bd8e51dafae2ebe1b23d017f6fc1bb756b624ca5aa5

SHA512
fb6f99a9f79c76d8908abed6cc8cadf7f658a840b886eaaf9a584b12f2fa0aa544fd00fb454e186531bbbceb90596bc32589c2f652d700ac5279259c1ff4b2d4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58583.exe

Filesize
468KB

MD5
180160013016c508123deab178bc93bf

SHA1
2fa748eaf11d4ee15ab015058b5efe1fadb5e7a4

SHA256
e31ada0eb553d837b115b570fe362e56256c3c7978db32c270ff0458dee29bb6

SHA512
9e2b6f1d35bd40a73b65cb3000700f12fe3563c77e6ae9b1621e5f21901d132b601468a1960c88761b248fdfb08ccdfb87a8137a31ae639b43aa28c110f2cbec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59522.exe

Filesize
468KB

MD5
7fdf37200c6a028965eaf272668a7856

SHA1
23fa7f71bd4cc842f1bfd99c020c659c6f7052ec

SHA256
594d1c3b0de7d3c60cd606c8f63a4fc4a5cd29379ba63a38035e62a0568da4d7

SHA512
069ffde92e184875489053b108964e5c18c8ba3ec65c78099bdc73519e7c50b406b4ccc51fc368a8a42c31bc5f4663df35f1d80800da27070fbe86680c7ab437

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60569.exe

Filesize
468KB

MD5
79263d2ac1b55fc9d272415f641e01c1

SHA1
8bb0fc2ea35101af13cff2e2ce5f722ab3cb74a2

SHA256
26c5f16b7cb7e88431b300e5b3c3f31300cb6da022ae20b35d47c7c45f15ea2d

SHA512
9e89373bc64f02a3b02a495fd8c057cb364a5de917e155571d88ea26ddd9cc25243a56e092050f375cc40e6b6db4bcb914ca6ba3ee232a588a365ed44f0d5a17

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6517.exe

Filesize
468KB

MD5
b2ea42e3b79f1a3d40ee1dfda52add7e

SHA1
2646309d9899a17b8bd1448c5acc6203fafbc9db

SHA256
79177c4cc903a2f5853d1da16fef7dfa7a3c7451f32b4223cb803356998d5185

SHA512
4787e709150cd864040c5aa536c4b2cb4c6cf15c7cc6fc7163470335a78e9b79cf38e2c1a13cc82451406105756462420785809293053bb1c425201f46cee9cc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65355.exe

Filesize
468KB

MD5
953c690e3c3b5ba014ce6e497911c2f4

SHA1
b7139c3964d722bff1da0806820566139932c58a

SHA256
4f0105a332ef7e1a26fe3b4bf4de6083075d1f96189d2e8a671a6a11ecbbf96d

SHA512
8c7c7a5f3fa55480932396ba8a7605306bd8bcfe58de64d91765f3769662cfcbb69bee915f73275fde59c0ddd1d832d0e7639e00f8650486329e35a3e9aa260b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9448.exe

Filesize
468KB

MD5
b1a3c42985dd39358cb4d865bbba32e1

SHA1
8794b7563ab1aa160a3ef4fa78b06b6d72f9256b

SHA256
ef0ff577cd975c9b0df0d46f64f29bce501ffb3fe65538064b1669b42797c97c

SHA512
bd58968d52a0010c33f0c426cbb302f3ae2dd9b1fd7c1fc1d71cdb39d55c4b64b1538b36eb070aa80d8ed570e15ec3034c8b67439792cdf7cb97f33fc1795558

Download Submit
memory/396-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/760-104-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/804-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/976-274-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1088-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1260-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1316-99-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1416-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1584-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1704-154-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1712-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1756-68-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2080-156-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2256-38-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2296-187-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2348-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2436-189-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2972-88-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3128-125-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3192-126-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3252-229-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3260-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3328-215-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3476-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3484-164-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3496-113-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3596-249-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3664-194-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3716-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3728-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3732-208-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3736-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3784-165-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3920-455-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4052-526-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4220-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4244-29-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4280-50-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4340-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4344-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4460-457-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4552-57-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4620-67-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4696-166-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4712-311-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4724-458-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4752-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4756-456-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4792-238-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4864-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4868-37-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4952-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5076-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5104-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5132-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5140-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5152-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5188-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5252-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5280-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5340-535-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5344-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5364-480-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5368-343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5376-344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5412-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5420-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5428-481-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5448-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5508-564-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5588-483-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5612-536-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5652-484-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5672-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5688-376-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5736-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5764-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5792-411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5828-485-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5832-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5840-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5852-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5872-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5968-503-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5992-507-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6024-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6076-437-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6092-438-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6108-439-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6132-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6244-590-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6276-591-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6316-596-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6328-599-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6432-601-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6440-600-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14684-2411-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15588-2425-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads