a37ad8d14e37a8d51b178d474e5d62e0f559e3486615952e4c032c7dcc306b68

Analysis

max time kernel
120s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 15:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

a37ad8d14e37a8d51b178d474e5d62e0f559e3486615952e4c032c7dcc306b68N.exe
Size

468KB
MD5

b6c48826bd9d5f212b79b134310afd10
SHA1

403765ec97206b6ac209c3b07f6043563c4d01eb
SHA256

a37ad8d14e37a8d51b178d474e5d62e0f559e3486615952e4c032c7dcc306b68
SHA512

7e0ef69a4d08a550518ed7844f4f57805fac61ce3a7e02b72e67c68642b487a18a15504cabbbbc5df1beffa27b66ff096df6a6250bac7bc4a354a606d8cb2a6e
SSDEEP

3072:tSeCogK0jU8GpbY9P13yqfQmoxQVr+Dkq+08ENaglU:tSzoYZGp+PNyqf05DkdNENa

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
4796	Unicorn-52952.exe
1924	Unicorn-51328.exe
4776	Unicorn-19210.exe
5088	Unicorn-5775.exe
1044	Unicorn-50700.exe
4212	Unicorn-30834.exe
736	Unicorn-40486.exe
4008	Unicorn-4535.exe
3600	Unicorn-33678.exe
3840	Unicorn-24956.exe
2592	Unicorn-58567.exe
516	Unicorn-4727.exe
3328	Unicorn-51882.exe
1936	Unicorn-57747.exe
2900	Unicorn-52703.exe
4196	Unicorn-7607.exe
4088	Unicorn-24498.exe
3860	Unicorn-15968.exe
2380	Unicorn-53471.exe
3984	Unicorn-23560.exe
3052	Unicorn-3139.exe
4360	Unicorn-3139.exe
3364	Unicorn-64592.exe
3220	Unicorn-64592.exe
2896	Unicorn-41934.exe
3516	Unicorn-20030.exe
2828	Unicorn-30965.exe
5084	Unicorn-33765.exe
3676	Unicorn-39631.exe
3688	Unicorn-25096.exe
1468	Unicorn-10797.exe
4532	Unicorn-39232.exe
4904	Unicorn-12681.exe
644	Unicorn-10835.exe
64	Unicorn-63736.exe
2332	Unicorn-51484.exe
1048	Unicorn-9365.exe
2692	Unicorn-44831.exe
836	Unicorn-40746.exe
2980	Unicorn-52060.exe
5032	Unicorn-52060.exe
876	Unicorn-7498.exe
2440	Unicorn-11774.exe
1224	Unicorn-24432.exe
1692	Unicorn-40198.exe
1228	Unicorn-32792.exe
2076	Unicorn-28708.exe
3888	Unicorn-7711.exe
1448	Unicorn-7711.exe
4484	Unicorn-3627.exe
1428	Unicorn-44468.exe
3500	Unicorn-44203.exe
4276	Unicorn-4182.exe
468	Unicorn-4182.exe
2324	Unicorn-24048.exe
3528	Unicorn-24048.exe
1676	Unicorn-11987.exe
2608	Unicorn-3554.exe
1496	Unicorn-41322.exe
2792	Unicorn-46890.exe
4052	Unicorn-27554.exe
1592	Unicorn-28878.exe
2576	Unicorn-52755.exe
5260	Unicorn-41152.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
7052	6552	WerFault.exe	267

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21403.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54231.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55715.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38523.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39423.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16840.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43604.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45561.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49380.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4896.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38664.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24345.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62855.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4182.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60065.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59240.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22867.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56187.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23428.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55420.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22076.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54511.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19169.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52392.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43604.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62248.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32702.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43847.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32121.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40481.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19677.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13599.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20645.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17738.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12872.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19639.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31823.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42571.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17329.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32570.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51703.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	3056	dwm.exe
Token: SeChangeNotifyPrivilege	3056	dwm.exe
Token: 33	3056	dwm.exe
Token: SeIncBasePriorityPrivilege	3056	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4536	a37ad8d14e37a8d51b178d474e5d62e0f559e3486615952e4c032c7dcc306b68N.exe
4796	Unicorn-52952.exe
1924	Unicorn-51328.exe
4776	Unicorn-19210.exe
5088	Unicorn-5775.exe
1044	Unicorn-50700.exe
736	Unicorn-40486.exe
4212	Unicorn-30834.exe
4008	Unicorn-4535.exe
3600	Unicorn-33678.exe
3840	Unicorn-24956.exe
2592	Unicorn-58567.exe
3328	Unicorn-51882.exe
1936	Unicorn-57747.exe
516	Unicorn-4727.exe
2900	Unicorn-52703.exe
4196	Unicorn-7607.exe
4088	Unicorn-24498.exe
2380	Unicorn-53471.exe
3860	Unicorn-15968.exe
3984	Unicorn-23560.exe
3676	Unicorn-39631.exe
3364	Unicorn-64592.exe
4360	Unicorn-3139.exe
3220	Unicorn-64592.exe
2896	Unicorn-41934.exe
3516	Unicorn-20030.exe
5084	Unicorn-33765.exe
2828	Unicorn-30965.exe
3052	Unicorn-3139.exe
3688	Unicorn-25096.exe
1468	Unicorn-10797.exe
4532	Unicorn-39232.exe
644	Unicorn-10835.exe
4904	Unicorn-12681.exe
64	Unicorn-63736.exe
2332	Unicorn-51484.exe
1048	Unicorn-9365.exe
836	Unicorn-40746.exe
2692	Unicorn-44831.exe
5032	Unicorn-52060.exe
876	Unicorn-7498.exe
2980	Unicorn-52060.exe
2440	Unicorn-11774.exe
1224	Unicorn-24432.exe
1692	Unicorn-40198.exe
1228	Unicorn-32792.exe
3500	Unicorn-44203.exe
2076	Unicorn-28708.exe
3888	Unicorn-7711.exe
4484	Unicorn-3627.exe
1428	Unicorn-44468.exe
1448	Unicorn-7711.exe
1496	Unicorn-41322.exe
2608	Unicorn-3554.exe
4276	Unicorn-4182.exe
1676	Unicorn-11987.exe
3528	Unicorn-24048.exe
2576	Unicorn-52755.exe
4052	Unicorn-27554.exe
468	Unicorn-4182.exe
2324	Unicorn-24048.exe
1592	Unicorn-28878.exe
2792	Unicorn-46890.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4536 wrote to memory of 4796	4536	a37ad8d14e37a8d51b178d474e5d62e0f559e3486615952e4c032c7dcc306b68N.exe	89
PID 4536 wrote to memory of 4796	4536	a37ad8d14e37a8d51b178d474e5d62e0f559e3486615952e4c032c7dcc306b68N.exe	89
PID 4536 wrote to memory of 4796	4536	a37ad8d14e37a8d51b178d474e5d62e0f559e3486615952e4c032c7dcc306b68N.exe	89
PID 4796 wrote to memory of 1924	4796	Unicorn-52952.exe	95
PID 4796 wrote to memory of 1924	4796	Unicorn-52952.exe	95
PID 4796 wrote to memory of 1924	4796	Unicorn-52952.exe	95
PID 4536 wrote to memory of 4776	4536	a37ad8d14e37a8d51b178d474e5d62e0f559e3486615952e4c032c7dcc306b68N.exe	96
PID 4536 wrote to memory of 4776	4536	a37ad8d14e37a8d51b178d474e5d62e0f559e3486615952e4c032c7dcc306b68N.exe	96
PID 4536 wrote to memory of 4776	4536	a37ad8d14e37a8d51b178d474e5d62e0f559e3486615952e4c032c7dcc306b68N.exe	96
PID 1924 wrote to memory of 5088	1924	Unicorn-51328.exe	98
PID 1924 wrote to memory of 5088	1924	Unicorn-51328.exe	98
PID 1924 wrote to memory of 5088	1924	Unicorn-51328.exe	98
PID 4776 wrote to memory of 1044	4776	Unicorn-19210.exe	99
PID 4776 wrote to memory of 1044	4776	Unicorn-19210.exe	99
PID 4776 wrote to memory of 1044	4776	Unicorn-19210.exe	99
PID 4796 wrote to memory of 4212	4796	Unicorn-52952.exe	100
PID 4796 wrote to memory of 4212	4796	Unicorn-52952.exe	100
PID 4796 wrote to memory of 4212	4796	Unicorn-52952.exe	100
PID 4536 wrote to memory of 736	4536	a37ad8d14e37a8d51b178d474e5d62e0f559e3486615952e4c032c7dcc306b68N.exe	101
PID 4536 wrote to memory of 736	4536	a37ad8d14e37a8d51b178d474e5d62e0f559e3486615952e4c032c7dcc306b68N.exe	101
PID 4536 wrote to memory of 736	4536	a37ad8d14e37a8d51b178d474e5d62e0f559e3486615952e4c032c7dcc306b68N.exe	101
PID 5088 wrote to memory of 4008	5088	Unicorn-5775.exe	104
PID 5088 wrote to memory of 4008	5088	Unicorn-5775.exe	104
PID 5088 wrote to memory of 4008	5088	Unicorn-5775.exe	104
PID 1924 wrote to memory of 3600	1924	Unicorn-51328.exe	105
PID 1924 wrote to memory of 3600	1924	Unicorn-51328.exe	105
PID 1924 wrote to memory of 3600	1924	Unicorn-51328.exe	105
PID 1044 wrote to memory of 3840	1044	Unicorn-50700.exe	106
PID 1044 wrote to memory of 3840	1044	Unicorn-50700.exe	106
PID 1044 wrote to memory of 3840	1044	Unicorn-50700.exe	106
PID 4776 wrote to memory of 2592	4776	Unicorn-19210.exe	107
PID 4776 wrote to memory of 2592	4776	Unicorn-19210.exe	107
PID 4776 wrote to memory of 2592	4776	Unicorn-19210.exe	107
PID 4212 wrote to memory of 516	4212	Unicorn-30834.exe	108
PID 4212 wrote to memory of 516	4212	Unicorn-30834.exe	108
PID 4212 wrote to memory of 516	4212	Unicorn-30834.exe	108
PID 4796 wrote to memory of 3328	4796	Unicorn-52952.exe	109
PID 4796 wrote to memory of 3328	4796	Unicorn-52952.exe	109
PID 4796 wrote to memory of 3328	4796	Unicorn-52952.exe	109
PID 4536 wrote to memory of 1936	4536	a37ad8d14e37a8d51b178d474e5d62e0f559e3486615952e4c032c7dcc306b68N.exe	110
PID 4536 wrote to memory of 1936	4536	a37ad8d14e37a8d51b178d474e5d62e0f559e3486615952e4c032c7dcc306b68N.exe	110
PID 4536 wrote to memory of 1936	4536	a37ad8d14e37a8d51b178d474e5d62e0f559e3486615952e4c032c7dcc306b68N.exe	110
PID 736 wrote to memory of 2900	736	Unicorn-40486.exe	111
PID 736 wrote to memory of 2900	736	Unicorn-40486.exe	111
PID 736 wrote to memory of 2900	736	Unicorn-40486.exe	111
PID 4008 wrote to memory of 4196	4008	Unicorn-4535.exe	112
PID 4008 wrote to memory of 4196	4008	Unicorn-4535.exe	112
PID 4008 wrote to memory of 4196	4008	Unicorn-4535.exe	112
PID 5088 wrote to memory of 4088	5088	Unicorn-5775.exe	113
PID 5088 wrote to memory of 4088	5088	Unicorn-5775.exe	113
PID 5088 wrote to memory of 4088	5088	Unicorn-5775.exe	113
PID 3840 wrote to memory of 3860	3840	Unicorn-24956.exe	114
PID 3840 wrote to memory of 3860	3840	Unicorn-24956.exe	114
PID 3840 wrote to memory of 3860	3840	Unicorn-24956.exe	114
PID 1044 wrote to memory of 2380	1044	Unicorn-50700.exe	115
PID 1044 wrote to memory of 2380	1044	Unicorn-50700.exe	115
PID 1044 wrote to memory of 2380	1044	Unicorn-50700.exe	115
PID 3600 wrote to memory of 3984	3600	Unicorn-33678.exe	116
PID 3600 wrote to memory of 3984	3600	Unicorn-33678.exe	116
PID 3600 wrote to memory of 3984	3600	Unicorn-33678.exe	116
PID 1936 wrote to memory of 3052	1936	Unicorn-57747.exe	117
PID 1936 wrote to memory of 3052	1936	Unicorn-57747.exe	117
PID 1936 wrote to memory of 3052	1936	Unicorn-57747.exe	117
PID 3328 wrote to memory of 4360	3328	Unicorn-51882.exe	118

C:\Users\Admin\AppData\Local\Temp\a37ad8d14e37a8d51b178d474e5d62e0f559e3486615952e4c032c7dcc306b68N.exe
"C:\Users\Admin\AppData\Local\Temp\a37ad8d14e37a8d51b178d474e5d62e0f559e3486615952e4c032c7dcc306b68N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4536
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52952.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52952.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51328.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51328.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5775.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5775.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4535.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7607.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10835.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16840.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30671.exe
        9⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60065.exe
        10⤵
        
        PID:8948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        10⤵
        
        PID:13092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        10⤵
        
        PID:17124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
        9⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51788.exe
        9⤵
        
        PID:13220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50976.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50976.exe
        9⤵
        
        PID:17064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37391.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31285.exe
        9⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        9⤵
        
        PID:11704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55158.exe
        9⤵
        
        PID:4560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51772.exe
        8⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16750.exe
        8⤵
        
        PID:14532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58075.exe
        8⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50259.exe
        7⤵
        
        PID:5360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30671.exe
        8⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51897.exe
        9⤵
        
        PID:8836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        9⤵
        
        PID:13048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        9⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
        8⤵
        
        PID:7376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59956.exe
        8⤵
        
        PID:12648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52358.exe
        8⤵
        
        PID:6220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39171.exe
        7⤵
        
        PID:6544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13064.exe
        8⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26589.exe
        9⤵
        
        PID:12544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61074.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:17576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40635.exe
        8⤵
        
        PID:10744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
        8⤵
        
        PID:15732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54775.exe
        8⤵
        
        PID:17336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43848.exe
        7⤵
        
        PID:8640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22126.exe
        7⤵
        
        PID:12328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40098.exe
        7⤵
        
        PID:5808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44831.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50280.exe
        7⤵
        
        PID:5684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43137.exe
        8⤵
        
        PID:4712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61217.exe
        9⤵
        
        PID:9176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47412.exe
        10⤵
        
        PID:18376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        9⤵
        
        PID:13016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        9⤵
        
        PID:16856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54180.exe
        8⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4879.exe
        9⤵
        
        PID:17168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24350.exe
        8⤵
        
        PID:12464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-722.exe
        8⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13287.exe
        7⤵
        
        PID:7136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36817.exe
        8⤵
        
        PID:10824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22727.exe
        8⤵
        
        PID:15168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48910.exe
        8⤵
        
        PID:17320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51107.exe
        7⤵
        
        PID:10736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        7⤵
        
        PID:15312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41738.exe
        7⤵
        
        PID:17784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12629.exe
        6⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36173.exe
        7⤵
        
        PID:6248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22733.exe
        8⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61077.exe
        9⤵
        
        PID:11804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62855.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:17220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        8⤵
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59434.exe
        8⤵
        
        PID:5732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51684.exe
        7⤵
        
        PID:8388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32121.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39258.exe
        8⤵
        
        PID:17288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7438.exe
        7⤵
        
        PID:12160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52855.exe
        7⤵
        
        PID:2804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38212.exe
        6⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
        7⤵
        
        PID:8892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61074.exe
        8⤵
        
        PID:16684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        7⤵
        
        PID:11768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43866.exe
        7⤵
        
        PID:5788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64731.exe
        6⤵
        
        PID:9268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55560.exe
        6⤵
        
        PID:12732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49380.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24498.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51484.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58448.exe
        7⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3884.exe
        8⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31285.exe
        9⤵
        
        PID:9072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        9⤵
        
        PID:12128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe
        8⤵
        
        PID:8256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21578.exe
        9⤵
        
        PID:6828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7438.exe
        8⤵
        
        PID:11708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45647.exe
        8⤵
        
        PID:6096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13183.exe
        7⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22733.exe
        8⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15977.exe
        9⤵
        
        PID:12912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        8⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        8⤵
        
        PID:17208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43604.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6662.exe
        7⤵
        
        PID:12880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13778.exe
        7⤵
        
        PID:17760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1634.exe
        6⤵
        
        PID:5636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58897.exe
        7⤵
        
        PID:6272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44881.exe
        8⤵
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61288.exe
        9⤵
        
        PID:2748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        8⤵
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15469.exe
        8⤵
        
        PID:6716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5939.exe
        7⤵
        
        PID:9416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38523.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37671.exe
        7⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42783.exe
        6⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56277.exe
        7⤵
        
        PID:10280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13599.exe
        7⤵
        
        PID:15184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44250.exe
        7⤵
        
        PID:17372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48804.exe
        6⤵
        
        PID:10728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32702.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25490.exe
        6⤵
        
        PID:17136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9365.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22076.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12872.exe
        7⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40481.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30706.exe
        8⤵
        
        PID:17432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19063.exe
        7⤵
        
        PID:10460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8585.exe
        7⤵
        
        PID:6852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1611.exe
        6⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3272.exe
        7⤵
        
        PID:7716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32187.exe
        7⤵
        
        PID:12620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        7⤵
        
        PID:16660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45523.exe
        6⤵
        
        PID:8752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        6⤵
        
        PID:15256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8585.exe
        6⤵
        
        PID:6884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58183.exe
        5⤵
        
        PID:5596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56785.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56785.exe
        6⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34335.exe
        7⤵
        
        PID:9644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18294.exe
        7⤵
        
        PID:12976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42347.exe
        7⤵
        
        PID:8708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40391.exe
        6⤵
        
        PID:8436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29010.exe
        6⤵
        
        PID:12296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1974.exe
        6⤵
        
        PID:6700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46075.exe
        5⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63905.exe
        6⤵
        
        PID:9428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        6⤵
        
        PID:15144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19169.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41179.exe
        5⤵
        
        PID:9396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6704.exe
        5⤵
        
        PID:12812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16557.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33678.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33678.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23560.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52060.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18760.exe
        7⤵
        
        PID:5768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51860.exe
        8⤵
        
        PID:4568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22733.exe
        9⤵
        
        PID:7752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        9⤵
        
        PID:10216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19361.exe
        9⤵
        
        PID:1132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
        8⤵
        
        PID:8628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30216.exe
        8⤵
        
        PID:12444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        8⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25435.exe
        7⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43537.exe
        8⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        8⤵
        
        PID:12356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59434.exe
        8⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55280.exe
        7⤵
        
        PID:9612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16750.exe
        7⤵
        
        PID:14524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57587.exe
        7⤵
        
        PID:2888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43434.exe
        6⤵
        
        PID:5928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63557.exe
        7⤵
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
        8⤵
        
        PID:8852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        8⤵
        
        PID:13040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31229.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31229.exe
        8⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42311.exe
        7⤵
        
        PID:9940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58548.exe
        8⤵
        
        PID:1540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9846.exe
        7⤵
        
        PID:12708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25611.exe
        7⤵
        
        PID:6120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30530.exe
        6⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23885.exe
        7⤵
        
        PID:8384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10615.exe
        7⤵
        
        PID:12452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63518.exe
        7⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51388.exe
        6⤵
        
        PID:8924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24876.exe
        6⤵
        
        PID:6568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11774.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30436.exe
        6⤵
        
        PID:5984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47221.exe
        7⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10864.exe
        8⤵
        
        PID:8928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        8⤵
        
        PID:13108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51842.exe
        8⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42311.exe
        7⤵
        
        PID:9952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29690.exe
        7⤵
        
        PID:14328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13358.exe
        7⤵
        
        PID:4900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33707.exe
        6⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39453.exe
        7⤵
        
        PID:8844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        7⤵
        
        PID:11616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2065.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27458.exe
        6⤵
        
        PID:9596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56832.exe
        6⤵
        
        PID:12944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21181.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55389.exe
        6⤵
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61217.exe
        7⤵
        
        PID:9192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        7⤵
        
        PID:13056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60202.exe
        7⤵
        
        PID:16776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35679.exe
        6⤵
        
        PID:8516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19550.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45455.exe
        6⤵
        
        PID:5368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11699.exe
        5⤵
        
        PID:6552
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6552 -s 464
        6⤵
        Program crash
        
        PID:7052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29318.exe
        5⤵
        
        PID:9520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56136.exe
        5⤵
        
        PID:12904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45296.exe
        5⤵
        
        PID:5288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33765.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7711.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31972.exe
        6⤵
        
        PID:5204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47901.exe
        7⤵
        
        PID:7276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34757.exe
        8⤵
        
        PID:12568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26046.exe
        8⤵
        
        PID:5972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11174.exe
        7⤵
        
        PID:12240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20645.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64792.exe
        6⤵
        
        PID:7212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37969.exe
        7⤵
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26322.exe
        7⤵
        
        PID:15832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30271.exe
        7⤵
        
        PID:17392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23862.exe
        6⤵
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38436.exe
        6⤵
        
        PID:15660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41738.exe
        6⤵
        
        PID:16912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60272.exe
        5⤵
        
        PID:6024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16957.exe
        6⤵
        
        PID:7940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33081.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33081.exe
        7⤵
        
        PID:14056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2222.exe
        7⤵
        
        PID:8672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24683.exe
        6⤵
        
        PID:11852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65299.exe
        6⤵
        
        PID:15856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27354.exe
        5⤵
        
        PID:7744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62248.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47024.exe
        5⤵
        
        PID:10488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29770.exe
        5⤵
        
        PID:15696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21022.exe
        5⤵
        
        PID:1620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3554.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3554.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26085.exe
        5⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4896.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24683.exe
        6⤵
        
        PID:11920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1974.exe
        6⤵
        
        PID:17804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
        5⤵
        
        PID:7356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56625.exe
        6⤵
        
        PID:14132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51319.exe
        6⤵
        
        PID:17440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15886.exe
        5⤵
        
        PID:10204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38436.exe
        5⤵
        
        PID:15676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50194.exe
        5⤵
        
        PID:17264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39495.exe
      4⤵
      PID:6196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
        5⤵
        
        PID:8732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        5⤵
        
        PID:13100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44826.exe
        5⤵
        
        PID:17248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17879.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17879.exe
      4⤵
      PID:8288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5168.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5168.exe
      4⤵
      PID:12032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20065.exe
      4⤵
      PID:3088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30834.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30834.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64592.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28708.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59333.exe
        7⤵
        
        PID:784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21041.exe
        8⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39675.exe
        8⤵
        
        PID:10548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41450.exe
        8⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37739.exe
        7⤵
        
        PID:8116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26166.exe
        7⤵
        
        PID:11640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43973.exe
        7⤵
        
        PID:15880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37557.exe
        7⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37687.exe
        6⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17497.exe
        7⤵
        
        PID:7684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46796.exe
        7⤵
        
        PID:11848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18401.exe
        7⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54511.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51788.exe
        6⤵
        
        PID:12612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41066.exe
        6⤵
        
        PID:5844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4182.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51357.exe
        6⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47901.exe
        7⤵
        
        PID:7284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26589.exe
        8⤵
        
        PID:12552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61074.exe
        8⤵
        
        PID:16652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        7⤵
        
        PID:10160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8585.exe
        7⤵
        
        PID:4460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50568.exe
        6⤵
        
        PID:7836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39244.exe
        7⤵
        
        PID:18132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30826.exe
        6⤵
        
        PID:11436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46988.exe
        6⤵
        
        PID:15536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50194.exe
        6⤵
        
        PID:17256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9814.exe
        5⤵
        
        PID:5868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12872.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48457.exe
        7⤵
        
        PID:14148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34214.exe
        7⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55715.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4501.exe
        6⤵
        
        PID:6840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22660.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4638.exe
        5⤵
        
        PID:11812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27654.exe
        5⤵
        
        PID:3448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20030.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24048.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23537.exe
        6⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16957.exe
        7⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32489.exe
        8⤵
        
        PID:12152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24071.exe
        8⤵
        
        PID:15452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43482.exe
        8⤵
        
        PID:3520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6811.exe
        7⤵
        
        PID:10384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4693.exe
        7⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35436.exe
        6⤵
        
        PID:8796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19298.exe
        6⤵
        
        PID:13180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52351.exe
        6⤵
        
        PID:5408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5975.exe
        5⤵
        
        PID:6724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30901.exe
        6⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        6⤵
        
        PID:12104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51074.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43604.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21984.exe
        6⤵
        
        PID:17688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24918.exe
        5⤵
        
        PID:14488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-794.exe
        5⤵
        
        PID:17148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46890.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51165.exe
        5⤵
        
        PID:1416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50361.exe
        6⤵
        
        PID:8084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46796.exe
        6⤵
        
        PID:11660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17738.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37739.exe
        5⤵
        
        PID:8100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40657.exe
        6⤵
        
        PID:11996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        6⤵
        
        PID:17156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26166.exe
        5⤵
        
        PID:11680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22484.exe
        5⤵
        
        PID:15812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49042.exe
        5⤵
        
        PID:5588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53204.exe
      4⤵
      PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60065.exe
        5⤵
        
        PID:8956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40355.exe
        5⤵
        
        PID:13196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39782.exe
        5⤵
        
        PID:6104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51711.exe
      4⤵
      PID:8180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5591.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5591.exe
      4⤵
      PID:11652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49764.exe
      4⤵
      PID:1068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51882.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51882.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7711.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52392.exe
        6⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21041.exe
        7⤵
        
        PID:7784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22017.exe
        8⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26322.exe
        8⤵
        
        PID:15852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22643.exe
        8⤵
        
        PID:17816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35591.exe
        7⤵
        
        PID:10532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42026.exe
        7⤵
        
        PID:17128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28611.exe
        6⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65161.exe
        7⤵
        
        PID:11792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11051.exe
        7⤵
        
        PID:15832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10639.exe
        7⤵
        
        PID:14088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49712.exe
        6⤵
        
        PID:12108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35006.exe
        6⤵
        
        PID:15420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28998.exe
        6⤵
        
        PID:560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23131.exe
        5⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51897.exe
        6⤵
        
        PID:8816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        6⤵
        
        PID:13024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11577.exe
        6⤵
        
        PID:1460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35139.exe
        5⤵
        
        PID:8048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19677.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38106.exe
        6⤵
        
        PID:16940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27948.exe
        5⤵
        
        PID:11692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13818.exe
        5⤵
        
        PID:15608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4182.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4182.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27429.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45353.exe
        6⤵
        
        PID:8076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44549.exe
        7⤵
        
        PID:11716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2883.exe
        7⤵
        
        PID:15924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57810.exe
        7⤵
        
        PID:18388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33043.exe
        6⤵
        
        PID:11776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16618.exe
        6⤵
        
        PID:15784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27495.exe
        6⤵
        
        PID:7056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21595.exe
        5⤵
        
        PID:7132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60517.exe
        6⤵
        
        PID:12828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22450.exe
        6⤵
        
        PID:7600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23234.exe
        5⤵
        
        PID:12020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20453.exe
        5⤵
        
        PID:16872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15434.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2260.exe
        5⤵
        
        PID:9112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42571.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44250.exe
        5⤵
        
        PID:17380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60376.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60376.exe
      4⤵
      PID:7668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43123.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12596
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32698.exe
      4⤵
      PID:5856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39631.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39631.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24432.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24432.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30339.exe
        5⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13064.exe
        6⤵
        
        PID:7872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7003.exe
        6⤵
        
        PID:10672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22643.exe
        6⤵
        
        PID:17676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14910.exe
        5⤵
        
        PID:7672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27760.exe
        6⤵
        
        PID:17344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38664.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33044.exe
        5⤵
        
        PID:6696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11530.exe
      4⤵
      PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51985.exe
        5⤵
        
        PID:7308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29365.exe
        6⤵
        
        PID:12060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24071.exe
        6⤵
        
        PID:15404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55926.exe
        6⤵
        
        PID:16824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54947.exe
        5⤵
        
        PID:11828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43973.exe
        5⤵
        
        PID:15976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25113.exe
        5⤵
        
        PID:5356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54599.exe
      4⤵
      PID:6308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33885.exe
        5⤵
        
        PID:11024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26322.exe
        5⤵
        
        PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46223.exe
        5⤵
        
        PID:6872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46448.exe
      4⤵
      PID:11176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29770.exe
      4⤵
      PID:15788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-986.exe
      4⤵
      PID:17360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40198.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40198.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56284.exe
      4⤵
      PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59473.exe
        5⤵
        
        PID:6656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27149.exe
        6⤵
        
        PID:10152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13599.exe
        6⤵
        
        PID:15200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15469.exe
        6⤵
        
        PID:6744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54231.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        5⤵
        
        PID:15304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37941.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33707.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33707.exe
      4⤵
      PID:7160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51897.exe
        5⤵
        
        PID:8808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        5⤵
        
        PID:13032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11385.exe
        5⤵
        
        PID:6976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39711.exe
      4⤵
      PID:9616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20075.exe
      4⤵
      PID:12960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1846.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1846.exe
    3⤵
    PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12872.exe
      4⤵
      PID:7720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25854.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51631.exe
      4⤵
      PID:11260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20645.exe
      4⤵
      PID:6948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52329.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52329.exe
    3⤵
    PID:5392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44985.exe
      4⤵
      PID:10764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13599.exe
      4⤵
      PID:15172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64286.exe
      4⤵
      PID:16800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11738.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11738.exe
    3⤵
    PID:11192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3435.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3435.exe
    3⤵
    PID:15928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44306.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44306.exe
    3⤵
    PID:15440
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50700.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50700.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15968.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63736.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:64
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1655.exe
        7⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8544.exe
        8⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60065.exe
        9⤵
        
        PID:8940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        9⤵
        
        PID:13008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55734.exe
        9⤵
        
        PID:16548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3827.exe
        8⤵
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42053.exe
        9⤵
        
        PID:11208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18835.exe
        9⤵
        
        PID:15748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16045.exe
        9⤵
        
        PID:17080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34142.exe
        8⤵
        
        PID:10820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38436.exe
        8⤵
        
        PID:15644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13977.exe
        8⤵
        
        PID:18112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39223.exe
        7⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34025.exe
        8⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48457.exe
        9⤵
        
        PID:14104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23135.exe
        9⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        8⤵
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        8⤵
        
        PID:16728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26114.exe
        7⤵
        
        PID:6796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30216.exe
        7⤵
        
        PID:12436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44766.exe
        7⤵
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14462.exe
        6⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56593.exe
        7⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22733.exe
        8⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37165.exe
        9⤵
        
        PID:13376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6394.exe
        9⤵
        
        PID:17056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        8⤵
        
        PID:12192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        8⤵
        
        PID:16668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47600.exe
        7⤵
        
        PID:8368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7438.exe
        7⤵
        
        PID:12124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61023.exe
        7⤵
        
        PID:5944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32346.exe
        6⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35369.exe
        7⤵
        
        PID:8720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        7⤵
        
        PID:12392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        7⤵
        
        PID:17100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7859.exe
        6⤵
        
        PID:9276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6558.exe
        6⤵
        
        PID:12724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58804.exe
        6⤵
        
        PID:17076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40746.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21500.exe
        6⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60869.exe
        7⤵
        
        PID:6364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36521.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10615.exe
        8⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15277.exe
        8⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3827.exe
        7⤵
        
        PID:8560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24926.exe
        7⤵
        
        PID:11724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3846.exe
        7⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35139.exe
        6⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2696.exe
        7⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40355.exe
        7⤵
        
        PID:13204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19553.exe
        7⤵
        
        PID:14500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23758.exe
        6⤵
        
        PID:9452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44388.exe
        6⤵
        
        PID:12868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52934.exe
        6⤵
        
        PID:16788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44150.exe
        5⤵
        
        PID:5696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47221.exe
        6⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43537.exe
        7⤵
        
        PID:8772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        7⤵
        
        PID:13084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52994.exe
        7⤵
        
        PID:17224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42311.exe
        6⤵
        
        PID:9560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9934.exe
        6⤵
        
        PID:12892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45263.exe
        6⤵
        
        PID:6760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53308.exe
        5⤵
        
        PID:5976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61793.exe
        6⤵
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27760.exe
        7⤵
        
        PID:16540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10615.exe
        6⤵
        
        PID:12472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        6⤵
        
        PID:16928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22302.exe
        5⤵
        
        PID:10168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7999.exe
        5⤵
        
        PID:15296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39012.exe
        5⤵
        
        PID:18152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53471.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41152.exe
        6⤵
        
        PID:5268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38913.exe
        7⤵
        
        PID:5132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21041.exe
        8⤵
        
        PID:7824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26589.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26589.exe
        9⤵
        
        PID:12536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45699.exe
        9⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60288.exe
        8⤵
        
        PID:10628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9161.exe
        8⤵
        
        PID:16720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-983.exe
        7⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57780.exe
        8⤵
        
        PID:5044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54947.exe
        7⤵
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        7⤵
        
        PID:10428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21351.exe
        6⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15997.exe
        7⤵
        
        PID:7624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32121.exe
        8⤵
        
        PID:14068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51319.exe
        8⤵
        
        PID:17420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19639.exe
        7⤵
        
        PID:10376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46110.exe
        7⤵
        
        PID:17664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65419.exe
        6⤵
        
        PID:8396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13303.exe
        6⤵
        
        PID:11740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16561.exe
        6⤵
        
        PID:6664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21286.exe
        5⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7200.exe
        6⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25125.exe
        7⤵
        
        PID:7732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40481.exe
        8⤵
        
        PID:12344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13410.exe
        8⤵
        
        PID:1288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27423.exe
        7⤵
        
        PID:10508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50194.exe
        7⤵
        
        PID:17308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe
        6⤵
        
        PID:6780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43847.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43672.exe
        6⤵
        
        PID:15400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8585.exe
        6⤵
        
        PID:1124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62907.exe
        5⤵
        
        PID:6320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29941.exe
        6⤵
        
        PID:7536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        6⤵
        
        PID:12212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59434.exe
        6⤵
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23428.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31823.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51456.exe
        5⤵
        
        PID:18140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12681.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12681.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41152.exe
        5⤵
        Executes dropped EXE
        
        PID:5260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42997.exe
        6⤵
        
        PID:6112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44393.exe
        7⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37777.exe
        8⤵
        
        PID:10948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26811.exe
        8⤵
        
        PID:15280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11961.exe
        8⤵
        
        PID:16884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10127.exe
        7⤵
        
        PID:8312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
        7⤵
        
        PID:15628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50115.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21403.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4879.exe
        7⤵
        
        PID:17068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22082.exe
        6⤵
        
        PID:11672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43973.exe
        6⤵
        
        PID:15844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
        6⤵
        
        PID:5852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21351.exe
        5⤵
        
        PID:6496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
        6⤵
        
        PID:9320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39971.exe
        6⤵
        
        PID:12760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19745.exe
        6⤵
        
        PID:17712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38751.exe
        5⤵
        
        PID:8072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30792.exe
        5⤵
        
        PID:12316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44958.exe
        5⤵
        
        PID:16760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28635.exe
      4⤵
      PID:5312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11092.exe
        5⤵
        
        PID:5776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47901.exe
        6⤵
        
        PID:7296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21057.exe
        7⤵
        
        PID:11124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18835.exe
        7⤵
        
        PID:15764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60778.exe
        7⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10127.exe
        6⤵
        
        PID:10788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17329.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:17044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42747.exe
        5⤵
        
        PID:8164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7438.exe
        5⤵
        
        PID:11912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61023.exe
        5⤵
        
        PID:116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32286.exe
      4⤵
      PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17689.exe
        5⤵
        
        PID:7768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46990.exe
        5⤵
        
        PID:6352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19415.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19415.exe
      4⤵
      PID:7968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22656.exe
      4⤵
      PID:13296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25109.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25109.exe
      4⤵
      PID:17300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58567.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58567.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64592.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52060.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10015.exe
        6⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13116.exe
        7⤵
        
        PID:6312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24077.exe
        8⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22867.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        8⤵
        
        PID:16880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11367.exe
        7⤵
        
        PID:10172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60007.exe
        7⤵
        
        PID:15224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17442.exe
        7⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exe
        6⤵
        
        PID:7096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51653.exe
        7⤵
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46296.exe
        8⤵
        
        PID:5876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13599.exe
        7⤵
        
        PID:15216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40358.exe
        7⤵
        
        PID:6416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23670.exe
        6⤵
        
        PID:10980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57779.exe
        6⤵
        
        PID:5320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47711.exe
        5⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53765.exe
        6⤵
        
        PID:6164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40325.exe
        7⤵
        
        PID:9028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13599.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11961.exe
        7⤵
        
        PID:16960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29203.exe
        6⤵
        
        PID:10708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60007.exe
        6⤵
        
        PID:15232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58859.exe
        6⤵
        
        PID:17276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52487.exe
        5⤵
        
        PID:5240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48581.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10615.exe
        6⤵
        
        PID:12484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11193.exe
        6⤵
        
        PID:6392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51388.exe
        5⤵
        
        PID:9000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24534.exe
        5⤵
        
        PID:15284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7810.exe
        5⤵
        
        PID:6848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7498.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7498.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2423.exe
        5⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60869.exe
        6⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60065.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        7⤵
        
        PID:12372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59434.exe
        7⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3827.exe
        6⤵
        
        PID:8544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24926.exe
        6⤵
        
        PID:12308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61023.exe
        6⤵
        
        PID:4508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56187.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19225.exe
        6⤵
        
        PID:8972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44440.exe
        6⤵
        
        PID:12676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        6⤵
        
        PID:16700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12903.exe
        5⤵
        
        PID:9680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39423.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60519.exe
        5⤵
        
        PID:5212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33049.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33049.exe
      4⤵
      PID:5860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60869.exe
        5⤵
        
        PID:6372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60065.exe
        6⤵
        
        PID:9032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40355.exe
        6⤵
        
        PID:12636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23637.exe
        6⤵
        
        PID:5168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19866.exe
        5⤵
        
        PID:9500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19883.exe
        5⤵
        
        PID:12924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32513.exe
        5⤵
        
        PID:6816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58824.exe
      4⤵
      PID:6264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51897.exe
        5⤵
        
        PID:8824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        5⤵
        
        PID:12400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62855.exe
        5⤵
        
        PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20958.exe
      4⤵
      PID:9444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19187.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19187.exe
      4⤵
      PID:12832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41596.exe
      4⤵
      PID:5616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41934.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41934.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32792.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43648.exe
        5⤵
        
        PID:4944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21949.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31477.exe
        7⤵
        
        PID:8988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40355.exe
        7⤵
        
        PID:12656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63518.exe
        7⤵
        
        PID:5172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32171.exe
        6⤵
        
        PID:8652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60007.exe
        6⤵
        
        PID:15092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26187.exe
        6⤵
        
        PID:17348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53552.exe
        5⤵
        
        PID:4996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32245.exe
        6⤵
        
        PID:8528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10615.exe
        6⤵
        
        PID:13116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39398.exe
        6⤵
        
        PID:6720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37355.exe
        5⤵
        
        PID:10208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51703.exe
        6⤵
        
        PID:17184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33200.exe
        5⤵
        
        PID:15272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50194.exe
        5⤵
        
        PID:17212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55420.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8980.exe
        5⤵
        
        PID:7900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42053.exe
        6⤵
        
        PID:11008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12014.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12014.exe
        6⤵
        
        PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52555.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44824.exe
        5⤵
        
        PID:15856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37557.exe
        5⤵
        
        PID:1120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30286.exe
      4⤵
      PID:7568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30880.exe
      4⤵
      PID:4112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29770.exe
      4⤵
      PID:15756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57779.exe
      4⤵
      PID:1628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44203.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44203.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13832.exe
      4⤵
      PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46277.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40481.exe
        6⤵
        
        PID:12672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63763.exe
        6⤵
        
        PID:16896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        5⤵
        
        PID:12284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52034.exe
        5⤵
        
        PID:6060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8767.exe
      4⤵
      PID:7364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61077.exe
        5⤵
        
        PID:11748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        5⤵
        
        PID:6708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19970.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19970.exe
      4⤵
      PID:10272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38436.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38436.exe
      4⤵
      PID:15776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42026.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42026.exe
      4⤵
      PID:17092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11290.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11290.exe
    3⤵
    PID:6036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53521.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53521.exe
      4⤵
      PID:8168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49188.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49188.exe
      4⤵
      PID:11544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41123.exe
      4⤵
      PID:15548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9570.exe
      4⤵
      PID:7420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13795.exe
    3⤵
    PID:8272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3340.exe
      4⤵
      PID:12796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51703.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51703.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:17200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5168.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5168.exe
    3⤵
    PID:12196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27849.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27849.exe
    3⤵
    PID:2944
- C:\Users\Admin\AppData\Local\Temp\Unicorn-40486.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-40486.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:736
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52703.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52703.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25096.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11987.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64569.exe
        6⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19697.exe
        7⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40709.exe
        8⤵
        
        PID:10696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        8⤵
        
        PID:15152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56310.exe
        8⤵
        
        PID:13576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21803.exe
        7⤵
        
        PID:11152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24345.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21595.exe
        6⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45912.exe
        7⤵
        
        PID:5796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6898.exe
        6⤵
        
        PID:12224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43672.exe
        6⤵
        
        PID:15500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8585.exe
        6⤵
        
        PID:6888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25435.exe
        5⤵
        
        PID:6516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60065.exe
        6⤵
        
        PID:8904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        6⤵
        
        PID:12384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60394.exe
        6⤵
        
        PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43604.exe
        5⤵
        
        PID:8868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63839.exe
        5⤵
        
        PID:11760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54271.exe
        5⤵
        
        PID:17240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41322.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34422.exe
        5⤵
        
        PID:7016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3376.exe
        6⤵
        
        PID:9204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13599.exe
        6⤵
        
        PID:15208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33113.exe
        6⤵
        
        PID:17808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59364.exe
        5⤵
        
        PID:7636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16750.exe
        5⤵
        
        PID:14540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21022.exe
        5⤵
        
        PID:15864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47339.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47339.exe
      4⤵
      PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22733.exe
        5⤵
        
        PID:7780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59240.exe
        5⤵
        
        PID:11992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        5⤵
        
        PID:3420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39023.exe
      4⤵
      PID:9496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17516.exe
        5⤵
        
        PID:6644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-215.exe
      4⤵
      PID:14556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14507.exe
      4⤵
      PID:17796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10797.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10797.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24048.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24048.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3116.exe
        5⤵
        
        PID:5908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25125.exe
        6⤵
        
        PID:7816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49977.exe
        7⤵
        
        PID:12180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51650.exe
        7⤵
        
        PID:6928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47844.exe
        6⤵
        
        PID:10572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
        6⤵
        
        PID:15668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50691.exe
        6⤵
        
        PID:17116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58787.exe
        5⤵
        
        PID:8284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30792.exe
        5⤵
        
        PID:11728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40682.exe
        5⤵
        
        PID:6916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33603.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33603.exe
      4⤵
      PID:6592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31285.exe
        5⤵
        
        PID:9084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        5⤵
        
        PID:11744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59434.exe
        5⤵
        
        PID:5724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47688.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47688.exe
      4⤵
      PID:8880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27023.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27023.exe
      4⤵
      PID:15636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57164.exe
      4⤵
      PID:5556
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52755.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52755.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30671.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30671.exe
      4⤵
      PID:6772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10864.exe
        5⤵
        
        PID:9056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
        5⤵
        
        PID:11636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1402.exe
        5⤵
        
        PID:16676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
      4⤵
      PID:8008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51788.exe
      4⤵
      PID:12688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19685.exe
      4⤵
      PID:5460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61835.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61835.exe
    3⤵
    PID:6648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43537.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43537.exe
      4⤵
      PID:8800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
      4⤵
      PID:13076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11385.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11385.exe
      4⤵
      PID:1192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35175.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35175.exe
    3⤵
    PID:7740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43653.exe
    3⤵
    PID:12604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48845.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48845.exe
    3⤵
    PID:4184
- C:\Users\Admin\AppData\Local\Temp\Unicorn-57747.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-57747.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44468.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52776.exe
        5⤵
        
        PID:1792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25125.exe
        6⤵
        
        PID:7796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45561.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18835.exe
        7⤵
        
        PID:15704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19745.exe
        7⤵
        
        PID:17612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56012.exe
        6⤵
        
        PID:10592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5077.exe
        6⤵
        
        PID:16952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49032.exe
        5⤵
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31965.exe
        6⤵
        
        PID:10564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21767.exe
        6⤵
        
        PID:15160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44826.exe
        6⤵
        
        PID:17104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40583.exe
        5⤵
        
        PID:11168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38436.exe
        5⤵
        
        PID:15576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-801.exe
        5⤵
        
        PID:17600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12106.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12106.exe
      4⤵
      PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13064.exe
        5⤵
        
        PID:7864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25489.exe
        6⤵
        
        PID:14588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51319.exe
        6⤵
        
        PID:16632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41211.exe
        5⤵
        
        PID:11732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16618.exe
        5⤵
        
        PID:6616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9466.exe
        5⤵
        
        PID:17588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12990.exe
      4⤵
      PID:7204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61077.exe
        5⤵
        
        PID:11836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59434.exe
        5⤵
        
        PID:5660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25644.exe
      4⤵
      PID:7580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29770.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29770.exe
      4⤵
      PID:15716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62055.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62055.exe
      4⤵
      PID:17724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28878.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28878.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60869.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60869.exe
      4⤵
      PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31477.exe
        5⤵
        
        PID:9008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44440.exe
        5⤵
        
        PID:13212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27145.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19866.exe
      4⤵
      PID:9508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19883.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19883.exe
      4⤵
      PID:12932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50976.exe
      4⤵
      PID:13368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48875.exe
    3⤵
    PID:6148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20097.exe
      4⤵
      PID:7756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13599.exe
      4⤵
      PID:15240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7493.exe
      4⤵
      PID:15232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29624.exe
    3⤵
    PID:9460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35722.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35722.exe
    3⤵
    PID:12852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61479.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61479.exe
    3⤵
    PID:6636
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30965.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30965.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3627.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3627.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52392.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52392.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21041.exe
        5⤵
        
        PID:7852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62056.exe
        6⤵
        
        PID:2428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60288.exe
        5⤵
        
        PID:10624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32570.exe
        5⤵
        
        PID:15652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50115.exe
        5⤵
        
        PID:8
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36779.exe
      4⤵
      PID:7184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24129.exe
        5⤵
        
        PID:11664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24372.exe
        5⤵
        
        PID:15804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56502.exe
        5⤵
        
        PID:3020
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3250.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3250.exe
      4⤵
      PID:11248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58163.exe
      4⤵
      PID:16704
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7755.exe
    3⤵
    PID:5504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20081.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20081.exe
      4⤵
      PID:7640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3340.exe
        5⤵
        
        PID:13172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6010.exe
        5⤵
        
        PID:17564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19639.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19639.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61486.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61486.exe
      4⤵
      PID:16816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64843.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64843.exe
    3⤵
    PID:7200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57813.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57813.exe
      4⤵
      PID:11064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18835.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18835.exe
      4⤵
      PID:15740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16045.exe
      4⤵
      PID:17192
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32032.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32032.exe
    3⤵
    PID:11628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13818.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13818.exe
    3⤵
    PID:15616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20830.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20830.exe
    3⤵
    PID:6856
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27554.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27554.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42997.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42997.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4896.exe
      4⤵
      PID:7880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52555.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52555.exe
      4⤵
      PID:11452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8585.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8585.exe
      4⤵
      PID:6820
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37739.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37739.exe
    3⤵
    PID:8108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16153.exe
      4⤵
      PID:11900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65296.exe
      4⤵
      PID:1788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40358.exe
      4⤵
      PID:6396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30250.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30250.exe
    3⤵
    PID:11888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19359.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19359.exe
    3⤵
    PID:748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56634.exe
    3⤵
    PID:556
- C:\Users\Admin\AppData\Local\Temp\Unicorn-36901.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-36901.exe
  2⤵
  PID:6536
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39453.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39453.exe
    3⤵
    PID:8744
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11191.exe
    3⤵
    PID:5720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10639.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10639.exe
    3⤵
    PID:7044
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14950.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14950.exe
  2⤵
  PID:7144
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61328.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61328.exe
  2⤵
  PID:11648
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64047.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64047.exe
  2⤵
  PID:6804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4372,i,3861745594156495651,17595114179815238301,262144 --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:8
1⤵
PID:1208

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 6552 -ip 6552
1⤵
PID:5968

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10797.exe

Filesize
468KB

MD5
733b5478548fa216381c8c4c4fe9fd65

SHA1
ad91118b4cc5c328e9f7801eb298eec360524f1a

SHA256
5fe3bf1acceb0d0f3abc786f38b8a91908066c748c8dd6df2a93efba8fc6cb8c

SHA512
60407c65293905fc4a054e8b217ebb7c687cb5838071873acedb9f376df835be5ed293f592b2cf609e7f9915c9c2188d97c4d386508af9efa7637c35cd2e28ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15968.exe

Filesize
468KB

MD5
bc48c6e0c9edbd278947540392d47866

SHA1
33d93979f3710f156241ec2a9bf907b8fce46888

SHA256
d269f916835b5de32b5f60b3b7f6827878a9e822d260ddca413e13d834e1d2dc

SHA512
3c1a7355bee5d730a7941c00e8706d31fee1b5ae1c888f1783606075e5c895958fa910ef420cebbd172ed2171fca00c2ddbf689d13b7ca3b29852dd12dc68a13

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19210.exe

Filesize
468KB

MD5
ba2236a7e0f5234511b198225df23f4f

SHA1
eb916c9d5c6a5b898eec35c8ac4b4704e30541de

SHA256
1070d3787b3964ee4cda0d31005f2732040368f518c77ad34d0ce3daf71feff5

SHA512
71f895b2b1a5b42fa8e0ea3688208eafdb1311365f47f69192e1bdb0f21fd97d1c2206ca938b6a24e9ff8fb061a35a43ada35425c67f7ba0c7f0a2835febbccc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19685.exe

Filesize
468KB

MD5
d1603daf5fa35662f4981e25a0d98359

SHA1
0e84305fcfa362bd35eeaa5dfb0050a348a552c3

SHA256
4c287c7a7c661068e6220ed424b14b10736b6d66bec6ab588234f7f6e1b4deee

SHA512
09eaaa3d22c27d8ef384c7b0eb98baa3d01a38bccda39d809f5a0ccac38a719bd4fc48adcb0b4ce1049ba03b4f3eda4947a4d394e7e31db8be6b4448375e5bec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20030.exe

Filesize
468KB

MD5
252780dfdd1fdd3cbd55a092390fc6e4

SHA1
de7757699e14207af529babfe42b313cb182ec91

SHA256
779403eedd68609c4a60ebbe713c03daf07bd4d5329003cebc8f1f32fe0cf443

SHA512
41eb9e452ddfe800897f65ed2dd540a4efdb76fcea405d17b6b82434987feec0cf34a87c45e86bab8c26039f1c43a437645dd22c9b8a700f016b6aad50803572

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23560.exe

Filesize
468KB

MD5
374d5461ed2eca20f99d8d456694b3d8

SHA1
4397a73bd0cc9d002f49e2527c5149440af87784

SHA256
41fd5b543cf5c5d1af6eba3ee9504a702187a27474ba34ff584b609015c241a1

SHA512
0878010f31606d7cc69ceac6d8c52ceda1401393f6c178d48f85abac66c1489b2723e3e79e5850e95b35fe1345132b8033a048c559f27af18bec0fe7902cdb2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24498.exe

Filesize
468KB

MD5
6ed208835fcd7b2d88c9429ed616b699

SHA1
8d241ec0204fd281806f90e819ac3828c3dcba52

SHA256
cdcd0f20410a459dd9fde16ac6324c2280223c61f2ad65b97df861101dbfe98d

SHA512
4f7abc3b5e3e800b1c6ff358669336daf8f44d510a2191576b8be69c0c4463cd9d0af6682335e8aa506db952d6a5602f7f14568b1c5a3a962dcdf56b995d476a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24956.exe

Filesize
468KB

MD5
7ba3ad8dcbdb640f163b4d1a9dc4adcf

SHA1
bbacbaf1a7f558c36dfef980c8a0111836f2a185

SHA256
5094ed3f919ace637be1a9d8c6ff19ca36d6c9de72299baac20d311698990471

SHA512
d40351259a052caf312385042173274af8ed9bb088d922b7fb43b8afaf55d2f63433f0ddd2e98b3793b289c0c199e7ab8f5c5de195c1b9196874b69761428416

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25096.exe

Filesize
468KB

MD5
4b8393723d60e00a861ea5ff19681177

SHA1
58f8c79f03114f8f32a22a35875b09fd89f0f6ba

SHA256
6772a0a51560838da5a083d88f18fc7bbbcc1778b87fdd53637701ed7a2eb5a6

SHA512
5b50ddfe3102db434234aa286077f05408818a8bead82f15eb49cb96aa273a20176dbe172548f798dd1b5570d7c49458414357c9316c5612041a980d2620d632

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30834.exe

Filesize
468KB

MD5
716037116cb0e570374f62843d5de201

SHA1
cff4123893d08848a528aecbce40e9d43b8fb93c

SHA256
f559cf9466f536781964f869280d58adb3d71892604ac668210e12ea4e6b5bb0

SHA512
2b4a4233f0b827f2c2d71928b9157523f506d4dfc87e08d6f39ee9b0bab2d42dc4383e2fca639176f143cfc3b7317948946c0247fd91d6aedb4bbb4fb9db1b75

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30965.exe

Filesize
468KB

MD5
162dd2278f5d05afe7baeb5900d0c9c0

SHA1
f1752a39319704fb28a11bfc9915e75ebb0977aa

SHA256
ea74465f7b8e1e23bba27e896465587b155c19c3a0199ff23320edb2095d6437

SHA512
926c6e56b67a846ec603e687f2e70dd1b1a2d7687a421e9bd467be2310d3f068ea215ecd393806faf75fea72fdf63cab0baabc64c56136f5b64937562cd37177

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe

Filesize
468KB

MD5
2a0efbf141fe9d9159361d8d629c7500

SHA1
1cf7ab3aca799b41a1a59fa41287f587ad6ebb25

SHA256
26b2ff5bb6de797838272fdb5e5124504bab43b9c3bedf2b0972803541766a35

SHA512
367cbb603f28fbdf2b059575d9f4d53d6929b967abe79d64a4506540d1552f1300f3b98f3a742fd8c6a8c2d9c0767b83caeb8e29c417158d70747fbe0094045c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33678.exe

Filesize
468KB

MD5
d4e4b68b07103c6672a9312ccfc323c4

SHA1
7844bb052a7b4ef66efbfa48cd0baee3454b5250

SHA256
104d1424a856355702d7e3a9a7eb1c66900cd380559fe9c2bf0ad5ae9c7d46bf

SHA512
316d97891fd6b005a938ef648b697d898974e6797e321c649481d901b4ef90aa9dc372b7311d5bbed1c09dc884906ddb86587657256ceb2ddc157ce3a493e56c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33765.exe

Filesize
468KB

MD5
379ddacc211fe8680ef72e466c57cf28

SHA1
3599f45ee7efe029178dfda51655f76bd8336239

SHA256
3c2ce2067d832bcab3a9df51c36a703bc0e2b8aee7663780941384f2b884f240

SHA512
88a97ff9758e60e2c2a5c89f8ad15a061769be872f99e6ce89f9a07b9119743896db6405b2dc38b04912b084ea2360fcb0acf5332d2fc117d06f426c8b09d1d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39232.exe

Filesize
468KB

MD5
9cc0aad76ba63124660282855c54d46f

SHA1
817bc4302510bfb4c44a247206a69ac0957978ea

SHA256
f170753b2ca210709cc5fbc0a56b395bae397328972107ff2ee9a0d7400a79ff

SHA512
a25b21bfe08d5c7ff740712a931f4f6660e3904a37cb404c9815f00c4621e4c4f92c11e735f2b84caa849953045eb347e54781c1f78121650a1169cb6428df41

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39631.exe

Filesize
468KB

MD5
f028e6d3c608e7077116afe5476d92da

SHA1
97e323ad49d02376fa3b24ec06cd3bb88710cad5

SHA256
28cdf599763a1210277dd215abcf5e6d59d8da3a6bafbb4ba7884b4d5b9ec3cf

SHA512
5cd9e1382c89a6506949b4796d6b7dc83e7c55328fc115cca2192d9d2a3d09b28e6c949618a80ba11ad20692d5ff3b7ebdf7452c22717de6de777e5bed4dd282

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-40486.exe

Filesize
468KB

MD5
c8fd7a1b3b6faf058b92471576d103ae

SHA1
784bc83c6daec80c2e657a20d359f0201ce0a784

SHA256
8662f2a02660c96abe41d95a9209c0c702b51cfe73fd09584ae816abcac2d6ca

SHA512
df9555ea4f668ce727dcffdeae76fb14f6a38e79567d216b960d8ad4759cea1d715f6b597cdae2805911afa557b627b8b05921b6bc681f60f3d5635db0b9a9a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41934.exe

Filesize
468KB

MD5
f7e250706e385875b1493d0cc951c75f

SHA1
e2460ef366881e12385df234e487e5ee13ba794b

SHA256
41592049025c8902ea1062c83e4c87f1895aacd28f3a48aa1dec5fa388653f72

SHA512
5de2f70435f6370c1ec3968be1c838e11986c97d7e394dc9c4d711388f178391b385053f071eea99da88e7ca4964504b4c1871e761c0c59aecdb0c4eba6f45bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4535.exe

Filesize
468KB

MD5
4ae3d52d9001e3898e0533d5eea2f547

SHA1
60edb0bf1ce270b6a427d4e4e3688e0c752013d8

SHA256
fd04b2b417ef47be0c37a8ba489ab4a6dd8ba445bfaec4e3650a9cbb06edbc71

SHA512
a5bc3b90d7dab1e02f1422c31c0f524ff2550fc6344ec4744e3acddb53b7fcb343648b8f913df01b0aac5baaa9382b6c63208769fd7b6f31110118f962fe25ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4727.exe

Filesize
468KB

MD5
25d054305ac1390bac48c59c931c1cee

SHA1
0591182c8c2dd3b11574ab04b91188053ef72d91

SHA256
fd26b6cb61ad6360aa11067d9808f4f3dd5205a65a445d704ea431ad80585ddc

SHA512
e02de09f97901ad3b66864279223e0dd742591b4e135a9830e49c0d6a65815264c6e0f25fdf4cdde4e9099d4e29127067ce4901442d26590ea33dcf739168202

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50700.exe

Filesize
468KB

MD5
ebe5da3cc8a1f8e17c0c1c45e3c568cc

SHA1
cbd60f686c7288592d5de3f28583edc2a9fd8624

SHA256
a4df39ee9d18ea0c62dbac30f5634ceb4592175a77e72c2660bb3ab876720ed1

SHA512
b451cb7d47ce86ff1e21710746e1a14190767443d4997e118010abb9390ddea005f0494b5e3256c22b558b4ad148ab1b22d1030e7a7925af7c6640de695bb1af

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51328.exe

Filesize
468KB

MD5
d2d699358076564d499b728d507efda8

SHA1
e81c000d39b4b5f4ab40bf26044e2651969919b2

SHA256
ff19ea71a82c36c5c108290f2a75d7d5e60a68cb93f45dab348ffd13a687db6c

SHA512
0b426135ee1e1e38c0a671887d1a4710eafba5af05a6f295bb3fa2251fa4db868e56f5f20bd392af103bcbbc0cf5d998a67bffb64bab17583313ab28ca24719e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51882.exe

Filesize
468KB

MD5
e3e1b1d07c814dda3ea3315a9d2e074b

SHA1
22273d9fe4fdc2a3ce29eb753011ef15e72b3e89

SHA256
e4747200c2583633502e2bdd754b8624df471e847f8e99945d47f244967b9d6d

SHA512
642b9daa9701c758baa143e26614760633973681d8e1564dd9f7aa5bba9371a3c2a5cb6521203716a3647fb355554a0cef0cce3a455c34ce0b73f7455a1e13d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52703.exe

Filesize
468KB

MD5
ad7525937cc1997a9c1966b02f0581b8

SHA1
31d34bc7b6917885cc71a70c13c4717976c11224

SHA256
381018629a0dc6df3d6a633b9adc042ce8cd1c834571e1803383d7b2aa8443fa

SHA512
07463ab46e0a71634899ba3ff432ac9e37b8b6ee5bebaedc406a9bf90510bd31a57e6f4bce7740ff98b475eeb7f2302bec660cc7925e197dcadfb98f305fbb40

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52952.exe

Filesize
468KB

MD5
652b8627771ad4d2a251f21daecad542

SHA1
5ad4785601a3d29130957747171ab9dc9b461893

SHA256
1610e29e1e42de79107034a313f5c9e6ce64770a5e3d8880e23b7e60dc8cba0b

SHA512
b4229542e8d4767047a4348a750d06177b308723c8488a7713d34a742004e948a327d889028346b66b3b4d12de8e29462eb4d8e240d4c2641c12119c73a083ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53471.exe

Filesize
468KB

MD5
d87a69879876bf697759670dc578c658

SHA1
9c9ea78629b17953a405665ba3e7f941609eaa71

SHA256
4fb667ce59ba12626b158154e83a3dc3cde833e73c828af45fca2a10942344c1

SHA512
70a176a77ec5b7611f15038f5547e1856a9220079cbc17642b9c3b944925a9ea70bfee27cfb5986156949d9729b8c47a7259fb412a9e5cd02439c0bb475e1db7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-57747.exe

Filesize
468KB

MD5
cf28cdfd8ad6eaf10a9e765332b114dd

SHA1
2632df47faa1cbd2bb88c156fb94252244c853e7

SHA256
5c9bfdd70728ff16fb9788353faf1ae7a894dff615589c018cf13c09274b48dc

SHA512
70e55a756bc1ae6a356c714795e10f4b9700b8e96b7a370a8f08cfc85fd2009ce5d69c1572a3438e60f3e31cfb39204203f7a704ce88eda32462a5429b3c95f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5775.exe

Filesize
468KB

MD5
d37a32b49005dd03ff7da2e7266c2879

SHA1
3c1a8d8328b843008956039895e66f942025e33d

SHA256
f20fba7534921956001b26a46d427c6464d4f815a453ebfa2faa6b799e8b0791

SHA512
ef9140441424b5d60aad693c07ba509bc1e1891ab08f2a03a1abfca873ae87e9c6718c7698e952900c2ced1c644ebe5c097c92587f3f90ff9246802d631c9945

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58567.exe

Filesize
468KB

MD5
38efdd118377312d5799c6a1b2e7b97a

SHA1
d5c5a6e478c98956033020e8ceb1bd4c90bc1c82

SHA256
fe0ad8f287e0f767ad0c0f48ca72a536ad5979d7aabdabd65c089b603c9e9a88

SHA512
b91b2efcb56b9edd063e031397be0e566926fafe41a29211e31b2167706aa36d70ef19a4494475c3a71894cdd1cb8b1dc2b64460f3a4442f012d09b5779b04fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64592.exe

Filesize
468KB

MD5
2014c533e70c9739a0c0a2d0977201fa

SHA1
be93827af0f25e5eb124a0f708a93ea3d75d7d52

SHA256
9594e7f39dec312119c23e9ef1efbee2e12a5c9b18a6bae97814671fc3e0ec14

SHA512
abb4080097774018c4c5d3efa8743d2ce3e8846f70830fe905611da398d202bb244507e7615042ccd60c12aab9524c69bd5178d658962164d94def790ddce0a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7607.exe

Filesize
468KB

MD5
488b97266aac69bd30a656fd04f1f66f

SHA1
7bc1e069b4ef00992a75b3d15e2c80eb0577cf89

SHA256
230fa8abfd75b692db8dd7ad791e4d990d53cdc709ff137ac9bf5c3954ea9dd5

SHA512
a635aebf77cb91c5099762d6fa1afda3f2f510ea00c0bf4db22fb284c3588a0149104e2e9d1e331bcea13113dde329dc7d60a9b4eba42f941892683bd9663dd7

Download Submit
memory/64-235-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/468-326-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/516-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/644-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/736-44-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/836-255-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/876-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1044-39-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1048-246-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1224-288-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1228-290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1356-527-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1428-323-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1448-296-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1468-212-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1496-340-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1592-339-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1676-328-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1692-289-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1776-525-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1792-526-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1924-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1936-97-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2076-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2324-327-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2332-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2380-132-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2440-270-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2576-341-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2592-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2608-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2692-254-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2828-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2896-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2900-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2980-261-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3052-169-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3328-96-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3364-170-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3428-523-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3500-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3516-185-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3600-60-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3676-184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3688-211-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3840-79-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3860-131-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3984-145-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4008-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4052-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4088-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4196-113-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4212-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4276-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4312-524-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4432-529-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4484-297-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4532-220-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4536-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4776-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4796-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4904-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4944-522-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5084-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5088-28-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5176-528-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5204-535-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5252-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5260-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5312-373-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5340-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5360-378-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5476-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5488-540-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5524-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5544-410-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5560-545-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5576-536-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5596-466-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5608-432-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5628-537-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5636-433-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5640-438-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5684-439-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5696-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5768-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5780-442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5816-467-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5860-468-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5900-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5928-470-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5984-472-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6024-547-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6040-471-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6088-473-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15256-2374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15856-2373-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads