6fe8b76bac1a7db0c0b905ac9c02b7ae0d7bd8350e74123319c261d91d76ce12

Analysis

max time kernel
120s
max time network
101s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 03:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6fe8b76bac1a7db0c0b905ac9c02b7ae0d7bd8350e74123319c261d91d76ce12N.exe
Size

468KB
MD5

2b85c42b4a2c0d9c6db2abd6eef88af0
SHA1

45cb60ccec80c7d35125f57f2b19b4d67da170fe
SHA256

6fe8b76bac1a7db0c0b905ac9c02b7ae0d7bd8350e74123319c261d91d76ce12
SHA512

b24d71806234d8e876def7b0a1295a6f763050027d03de58a368dbfdd419d141a984103fb9a6864b87aea2819fbad7e3fe3a217d991ebf48f4d8e31d487a6344
SSDEEP

3072:tug/ogWwzf8u2bYo8zrjBfr/9mu8TcpjPmHevVGT2/X3b1+++FlI:tugocku2L83jBfKQNC2/Hx+++

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3952	Unicorn-62205.exe
684	Unicorn-29645.exe
1420	Unicorn-26307.exe
4152	Unicorn-6323.exe
212	Unicorn-33117.exe
3204	Unicorn-11527.exe
3196	Unicorn-46189.exe
2312	Unicorn-8455.exe
4544	Unicorn-45037.exe
2708	Unicorn-58228.exe
2320	Unicorn-13433.exe
4804	Unicorn-31124.exe
2524	Unicorn-62541.exe
3964	Unicorn-62733.exe
3608	Unicorn-62468.exe
3540	Unicorn-59204.exe
748	Unicorn-17565.exe
1168	Unicorn-14035.exe
2572	Unicorn-1036.exe
3364	Unicorn-1036.exe
1336	Unicorn-844.exe
4232	Unicorn-24778.exe
3064	Unicorn-61320.exe
3164	Unicorn-47585.exe
3668	Unicorn-12188.exe
1596	Unicorn-58052.exe
2844	Unicorn-19706.exe
348	Unicorn-10391.exe
4324	Unicorn-51117.exe
2904	Unicorn-956.exe
3036	Unicorn-956.exe
1620	Unicorn-18554.exe
1268	Unicorn-65460.exe
3672	Unicorn-46139.exe
1736	Unicorn-61899.exe
2044	Unicorn-38045.exe
1272	Unicorn-17795.exe
3240	Unicorn-53229.exe
2500	Unicorn-19715.exe
4688	Unicorn-4028.exe
2512	Unicorn-23245.exe
3956	Unicorn-60820.exe
1556	Unicorn-17306.exe
4912	Unicorn-39581.exe
3200	Unicorn-19907.exe
2316	Unicorn-23172.exe
1320	Unicorn-23245.exe
1804	Unicorn-32093.exe
4272	Unicorn-28563.exe
1052	Unicorn-31517.exe
3056	Unicorn-10119.exe
1424	Unicorn-10586.exe
4748	Unicorn-65341.exe
2096	Unicorn-22301.exe
4288	Unicorn-7417.exe
3424	Unicorn-2435.exe
4508	Unicorn-5580.exe
4308	Unicorn-5580.exe
3100	Unicorn-6649.exe
1972	Unicorn-52788.exe
3532	Unicorn-7116.exe
1588	Unicorn-986.exe
3320	Unicorn-6732.exe
2000	Unicorn-35875.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
12708	5900	WerFault.exe	273
16372	12820	WerFault.exe	632

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7459.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24544.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39284.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59803.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63181.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29444.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32534.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40442.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8266.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61402.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17644.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11257.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6010.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56004.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65364.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31149.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61899.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20995.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48264.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46270.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25814.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23529.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45645.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39562.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48995.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-956.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9891.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48413.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55411.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26349.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10890.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14252.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10524.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23578.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20729.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17565.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24778.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60116.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26099.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23687.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29395.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59197.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56660.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46068.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31283.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28679.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-803.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40851.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15404.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26611.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16186.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39357.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55115.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4189.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	1376	dwm.exe
Token: SeChangeNotifyPrivilege	1376	dwm.exe
Token: 33	1376	dwm.exe
Token: SeIncBasePriorityPrivilege	1376	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1524	6fe8b76bac1a7db0c0b905ac9c02b7ae0d7bd8350e74123319c261d91d76ce12N.exe
3952	Unicorn-62205.exe
1420	Unicorn-26307.exe
4152	Unicorn-6323.exe
212	Unicorn-33117.exe
3204	Unicorn-11527.exe
3196	Unicorn-46189.exe
2312	Unicorn-8455.exe
4544	Unicorn-45037.exe
2708	Unicorn-58228.exe
2320	Unicorn-13433.exe
4804	Unicorn-31124.exe
2524	Unicorn-62541.exe
3608	Unicorn-62468.exe
3540	Unicorn-59204.exe
3964	Unicorn-62733.exe
748	Unicorn-17565.exe
1168	Unicorn-14035.exe
3364	Unicorn-1036.exe
2572	Unicorn-1036.exe
4232	Unicorn-24778.exe
3064	Unicorn-61320.exe
1336	Unicorn-844.exe
3164	Unicorn-47585.exe
3668	Unicorn-12188.exe
1596	Unicorn-58052.exe
2844	Unicorn-19706.exe
4324	Unicorn-51117.exe
348	Unicorn-10391.exe
3036	Unicorn-956.exe
2904	Unicorn-956.exe
1620	Unicorn-18554.exe
1268	Unicorn-65460.exe
3672	Unicorn-46139.exe
2044	Unicorn-38045.exe
1736	Unicorn-61899.exe
1272	Unicorn-17795.exe
4688	Unicorn-4028.exe
3240	Unicorn-53229.exe
1320	Unicorn-23245.exe
3200	Unicorn-19907.exe
3956	Unicorn-60820.exe
2512	Unicorn-23245.exe
2500	Unicorn-19715.exe
4912	Unicorn-39581.exe
2316	Unicorn-23172.exe
1556	Unicorn-17306.exe
1804	Unicorn-32093.exe
4272	Unicorn-28563.exe
1052	Unicorn-31517.exe
3056	Unicorn-10119.exe
1424	Unicorn-10586.exe
4748	Unicorn-65341.exe
4288	Unicorn-7417.exe
2096	Unicorn-22301.exe
3424	Unicorn-2435.exe
4508	Unicorn-5580.exe
4308	Unicorn-5580.exe
3100	Unicorn-6649.exe
1972	Unicorn-52788.exe
1588	Unicorn-986.exe
3532	Unicorn-7116.exe
2000	Unicorn-35875.exe
1180	Unicorn-55741.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 3952	1524	6fe8b76bac1a7db0c0b905ac9c02b7ae0d7bd8350e74123319c261d91d76ce12N.exe	82
PID 1524 wrote to memory of 3952	1524	6fe8b76bac1a7db0c0b905ac9c02b7ae0d7bd8350e74123319c261d91d76ce12N.exe	82
PID 1524 wrote to memory of 3952	1524	6fe8b76bac1a7db0c0b905ac9c02b7ae0d7bd8350e74123319c261d91d76ce12N.exe	82
PID 3952 wrote to memory of 684	3952	Unicorn-62205.exe	87
PID 3952 wrote to memory of 684	3952	Unicorn-62205.exe	87
PID 3952 wrote to memory of 684	3952	Unicorn-62205.exe	87
PID 1524 wrote to memory of 1420	1524	6fe8b76bac1a7db0c0b905ac9c02b7ae0d7bd8350e74123319c261d91d76ce12N.exe	88
PID 1524 wrote to memory of 1420	1524	6fe8b76bac1a7db0c0b905ac9c02b7ae0d7bd8350e74123319c261d91d76ce12N.exe	88
PID 1524 wrote to memory of 1420	1524	6fe8b76bac1a7db0c0b905ac9c02b7ae0d7bd8350e74123319c261d91d76ce12N.exe	88
PID 3952 wrote to memory of 4152	3952	Unicorn-62205.exe	90
PID 3952 wrote to memory of 4152	3952	Unicorn-62205.exe	90
PID 3952 wrote to memory of 4152	3952	Unicorn-62205.exe	90
PID 1420 wrote to memory of 212	1420	Unicorn-26307.exe	91
PID 1420 wrote to memory of 212	1420	Unicorn-26307.exe	91
PID 1420 wrote to memory of 212	1420	Unicorn-26307.exe	91
PID 1524 wrote to memory of 3204	1524	6fe8b76bac1a7db0c0b905ac9c02b7ae0d7bd8350e74123319c261d91d76ce12N.exe	92
PID 1524 wrote to memory of 3204	1524	6fe8b76bac1a7db0c0b905ac9c02b7ae0d7bd8350e74123319c261d91d76ce12N.exe	92
PID 1524 wrote to memory of 3204	1524	6fe8b76bac1a7db0c0b905ac9c02b7ae0d7bd8350e74123319c261d91d76ce12N.exe	92
PID 4152 wrote to memory of 3196	4152	Unicorn-6323.exe	95
PID 4152 wrote to memory of 3196	4152	Unicorn-6323.exe	95
PID 4152 wrote to memory of 3196	4152	Unicorn-6323.exe	95
PID 3952 wrote to memory of 2312	3952	Unicorn-62205.exe	96
PID 3952 wrote to memory of 2312	3952	Unicorn-62205.exe	96
PID 3952 wrote to memory of 2312	3952	Unicorn-62205.exe	96
PID 212 wrote to memory of 4544	212	Unicorn-33117.exe	97
PID 212 wrote to memory of 4544	212	Unicorn-33117.exe	97
PID 212 wrote to memory of 4544	212	Unicorn-33117.exe	97
PID 1420 wrote to memory of 2708	1420	Unicorn-26307.exe	98
PID 1420 wrote to memory of 2708	1420	Unicorn-26307.exe	98
PID 1420 wrote to memory of 2708	1420	Unicorn-26307.exe	98
PID 3204 wrote to memory of 2320	3204	Unicorn-11527.exe	99
PID 3204 wrote to memory of 2320	3204	Unicorn-11527.exe	99
PID 3204 wrote to memory of 2320	3204	Unicorn-11527.exe	99
PID 1524 wrote to memory of 4804	1524	6fe8b76bac1a7db0c0b905ac9c02b7ae0d7bd8350e74123319c261d91d76ce12N.exe	100
PID 1524 wrote to memory of 4804	1524	6fe8b76bac1a7db0c0b905ac9c02b7ae0d7bd8350e74123319c261d91d76ce12N.exe	100
PID 1524 wrote to memory of 4804	1524	6fe8b76bac1a7db0c0b905ac9c02b7ae0d7bd8350e74123319c261d91d76ce12N.exe	100
PID 3196 wrote to memory of 2524	3196	Unicorn-46189.exe	101
PID 3196 wrote to memory of 2524	3196	Unicorn-46189.exe	101
PID 3196 wrote to memory of 2524	3196	Unicorn-46189.exe	101
PID 2312 wrote to memory of 3964	2312	Unicorn-8455.exe	102
PID 2312 wrote to memory of 3964	2312	Unicorn-8455.exe	102
PID 2312 wrote to memory of 3964	2312	Unicorn-8455.exe	102
PID 3952 wrote to memory of 3608	3952	Unicorn-62205.exe	104
PID 3952 wrote to memory of 3608	3952	Unicorn-62205.exe	104
PID 3952 wrote to memory of 3608	3952	Unicorn-62205.exe	104
PID 4152 wrote to memory of 3540	4152	Unicorn-6323.exe	103
PID 4152 wrote to memory of 3540	4152	Unicorn-6323.exe	103
PID 4152 wrote to memory of 3540	4152	Unicorn-6323.exe	103
PID 4544 wrote to memory of 748	4544	Unicorn-45037.exe	105
PID 4544 wrote to memory of 748	4544	Unicorn-45037.exe	105
PID 4544 wrote to memory of 748	4544	Unicorn-45037.exe	105
PID 212 wrote to memory of 1168	212	Unicorn-33117.exe	106
PID 212 wrote to memory of 1168	212	Unicorn-33117.exe	106
PID 212 wrote to memory of 1168	212	Unicorn-33117.exe	106
PID 4804 wrote to memory of 2572	4804	Unicorn-31124.exe	108
PID 4804 wrote to memory of 2572	4804	Unicorn-31124.exe	108
PID 4804 wrote to memory of 2572	4804	Unicorn-31124.exe	108
PID 2708 wrote to memory of 3364	2708	Unicorn-58228.exe	109
PID 2708 wrote to memory of 3364	2708	Unicorn-58228.exe	109
PID 2708 wrote to memory of 3364	2708	Unicorn-58228.exe	109
PID 1524 wrote to memory of 4232	1524	6fe8b76bac1a7db0c0b905ac9c02b7ae0d7bd8350e74123319c261d91d76ce12N.exe	112
PID 1524 wrote to memory of 4232	1524	6fe8b76bac1a7db0c0b905ac9c02b7ae0d7bd8350e74123319c261d91d76ce12N.exe	112
PID 1524 wrote to memory of 4232	1524	6fe8b76bac1a7db0c0b905ac9c02b7ae0d7bd8350e74123319c261d91d76ce12N.exe	112
PID 2320 wrote to memory of 1336	2320	Unicorn-13433.exe	107

C:\Users\Admin\AppData\Local\Temp\6fe8b76bac1a7db0c0b905ac9c02b7ae0d7bd8350e74123319c261d91d76ce12N.exe
"C:\Users\Admin\AppData\Local\Temp\6fe8b76bac1a7db0c0b905ac9c02b7ae0d7bd8350e74123319c261d91d76ce12N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-62205.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-62205.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29645.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29645.exe
    3⤵
    - Executes dropped EXE
    PID:684
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6323.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6323.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46189.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62541.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12188.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32093.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16291.exe
        8⤵
        
        PID:4504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31469.exe
        9⤵
        
        PID:7336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2707.exe
        9⤵
        
        PID:10440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        9⤵
        
        PID:14948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
        9⤵
        
        PID:5532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14499.exe
        8⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53259.exe
        8⤵
        
        PID:11924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26098.exe
        8⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63612.exe
        8⤵
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48180.exe
        7⤵
        
        PID:5476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61341.exe
        8⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
        9⤵
        
        PID:10040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
        9⤵
        
        PID:3548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exe
        9⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21059.exe
        8⤵
        
        PID:10016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1482.exe
        8⤵
        
        PID:13724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64947.exe
        8⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14265.exe
        8⤵
        
        PID:6680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7082.exe
        7⤵
        
        PID:6848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22692.exe
        7⤵
        
        PID:10204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
        7⤵
        
        PID:14856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14083.exe
        7⤵
        
        PID:7624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28563.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16291.exe
        7⤵
        
        PID:4944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6684.exe
        8⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27213.exe
        9⤵
        
        PID:13156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43075.exe
        8⤵
        
        PID:11260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31469.exe
        8⤵
        
        PID:12712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
        8⤵
        
        PID:16076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14394.exe
        7⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25780.exe
        7⤵
        
        PID:11416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55514.exe
        7⤵
        
        PID:1632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30210.exe
        7⤵
        
        PID:8764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61915.exe
        6⤵
        
        PID:5524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42739.exe
        7⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48264.exe
        7⤵
        
        PID:11208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        7⤵
        
        PID:14844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20729.exe
        7⤵
        
        PID:6760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12947.exe
        6⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13642.exe
        6⤵
        
        PID:10464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26934.exe
        6⤵
        
        PID:15232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31596.exe
        6⤵
        
        PID:9104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58052.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31517.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65492.exe
        7⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        8⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13859.exe
        8⤵
        
        PID:10652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        8⤵
        
        PID:14868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42780.exe
        8⤵
        
        PID:17168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53979.exe
        7⤵
        
        PID:7268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3388.exe
        8⤵
        
        PID:12816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32482.exe
        8⤵
        
        PID:17268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63636.exe
        7⤵
        
        PID:11464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29437.exe
        7⤵
        
        PID:14716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43026.exe
        7⤵
        
        PID:17056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48180.exe
        6⤵
        
        PID:5492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9683.exe
        7⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14543.exe
        8⤵
        
        PID:16028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48035.exe
        8⤵
        
        PID:6172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18601.exe
        8⤵
        
        PID:9460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48264.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        7⤵
        
        PID:14876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21113.exe
        7⤵
        
        PID:2240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7082.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7082.exe
        6⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22692.exe
        6⤵
        
        PID:9384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
        6⤵
        
        PID:4448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20146.exe
        6⤵
        
        PID:6652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10119.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16291.exe
        6⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64250.exe
        7⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31456.exe
        7⤵
        
        PID:10720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        7⤵
        
        PID:13664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60652.exe
        7⤵
        
        PID:7408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55048.exe
        6⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57099.exe
        6⤵
        
        PID:12312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22258.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49580.exe
        6⤵
        
        PID:10896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2243.exe
        5⤵
        
        PID:5556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15404.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3036.exe
        7⤵
        
        PID:7692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9356.exe
        8⤵
        
        PID:12612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54996.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40209.exe
        7⤵
        
        PID:16052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32467.exe
        7⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27202.exe
        7⤵
        
        PID:9124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33347.exe
        6⤵
        
        PID:8224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56251.exe
        6⤵
        
        PID:12296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15938.exe
        6⤵
        
        PID:5396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26818.exe
        6⤵
        
        PID:8240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35991.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35991.exe
        5⤵
        
        PID:6228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25149.exe
        6⤵
        
        PID:10008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        6⤵
        
        PID:64
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49546.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49546.exe
        6⤵
        
        PID:9176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31603.exe
        5⤵
        
        PID:10228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34205.exe
        5⤵
        
        PID:13628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65074.exe
        5⤵
        
        PID:16400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59204.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59204.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51117.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7417.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25773.exe
        7⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44733.exe
        8⤵
        
        PID:6852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27853.exe
        9⤵
        
        PID:9956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
        9⤵
        
        PID:12788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exe
        9⤵
        
        PID:1732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8563.exe
        8⤵
        
        PID:10468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42780.exe
        8⤵
        
        PID:17072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54852.exe
        7⤵
        
        PID:8100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25290.exe
        7⤵
        
        PID:11428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38103.exe
        7⤵
        
        PID:14752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20729.exe
        7⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1210.exe
        6⤵
        
        PID:6884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
        7⤵
        
        PID:10112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
        7⤵
        
        PID:13620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51796.exe
        6⤵
        
        PID:9520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14058.exe
        6⤵
        
        PID:13480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9378.exe
        6⤵
        
        PID:6300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65148.exe
        6⤵
        
        PID:11036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52788.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61709.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61709.exe
        6⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13980.exe
        7⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63325.exe
        8⤵
        
        PID:10436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        8⤵
        
        PID:14456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe
        8⤵
        
        PID:3076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63060.exe
        7⤵
        
        PID:10680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        7⤵
        
        PID:14900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52083.exe
        7⤵
        
        PID:17208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40243.exe
        6⤵
        
        PID:1324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10490.exe
        6⤵
        
        PID:11620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38103.exe
        6⤵
        
        PID:14728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20729.exe
        6⤵
        
        PID:6288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56555.exe
        5⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10275.exe
        6⤵
        
        PID:7232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53371.exe
        6⤵
        
        PID:12860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29203.exe
        6⤵
        
        PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44401.exe
        5⤵
        
        PID:8828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59403.exe
        5⤵
        
        PID:12440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55507.exe
        5⤵
        
        PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63612.exe
        5⤵
        
        PID:8112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46139.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55741.exe
        5⤵
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61050.exe
        6⤵
        
        PID:5948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38189.exe
        7⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25885.exe
        8⤵
        
        PID:13168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10178.exe
        8⤵
        
        PID:12820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40851.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55115.exe
        7⤵
        
        PID:13408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29203.exe
        7⤵
        
        PID:16388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2963.exe
        6⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25357.exe
        7⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
        7⤵
        
        PID:3460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23913.exe
        7⤵
        
        PID:6964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65259.exe
        6⤵
        
        PID:10560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37335.exe
        6⤵
        
        PID:14536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9593.exe
        6⤵
        
        PID:1912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2835.exe
        5⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15324.exe
        6⤵
        
        PID:7316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43429.exe
        7⤵
        
        PID:9232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51908.exe
        6⤵
        
        PID:10376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        6⤵
        
        PID:14924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39284.exe
        6⤵
        
        PID:7256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14499.exe
        5⤵
        
        PID:8184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53259.exe
        5⤵
        
        PID:12040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9394.exe
        5⤵
        
        PID:7492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25108.exe
      4⤵
      PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47994.exe
        5⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42563.exe
        6⤵
        
        PID:9028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38379.exe
        6⤵
        
        PID:13140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39284.exe
        6⤵
        
        PID:7216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9891.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27994.exe
        5⤵
        
        PID:10340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64563.exe
        5⤵
        
        PID:3188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        5⤵
        
        PID:10848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3123.exe
      4⤵
      PID:6528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41853.exe
      4⤵
      PID:10636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22469.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22469.exe
      4⤵
      PID:14976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17082.exe
      4⤵
      PID:17232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8455.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8455.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62733.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5580.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42685.exe
        7⤵
        
        PID:5748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15404.exe
        8⤵
        
        PID:5464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10524.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28851.exe
        9⤵
        
        PID:11708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32237.exe
        9⤵
        
        PID:14708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
        9⤵
        
        PID:5448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56980.exe
        8⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62779.exe
        8⤵
        
        PID:12420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64371.exe
        8⤵
        
        PID:3524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14898.exe
        8⤵
        
        PID:10992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5539.exe
        7⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48413.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51364.exe
        8⤵
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11417.exe
        8⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3283.exe
        7⤵
        
        PID:10876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
        7⤵
        
        PID:14996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42066.exe
        7⤵
        
        PID:7372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18979.exe
        6⤵
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22637.exe
        7⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26464.exe
        7⤵
        
        PID:10732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        7⤵
        
        PID:14836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2690.exe
        7⤵
        
        PID:17064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45448.exe
        6⤵
        
        PID:8068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7331.exe
        6⤵
        
        PID:12068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20029.exe
        6⤵
        
        PID:15580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26882.exe
        6⤵
        
        PID:17244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5507.exe
        5⤵
        
        PID:4480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12835.exe
        6⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32829.exe
        7⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53268.exe
        7⤵
        
        PID:12056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39166.exe
        7⤵
        
        PID:15648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2690.exe
        7⤵
        
        PID:17024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4794.exe
        6⤵
        
        PID:8860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35012.exe
        6⤵
        
        PID:12512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22457.exe
        6⤵
        
        PID:1504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34050.exe
        6⤵
        
        PID:9536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60011.exe
        5⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10524.exe
        6⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60333.exe
        7⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
        7⤵
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe
        7⤵
        
        PID:216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41155.exe
        6⤵
        
        PID:11232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        6⤵
        
        PID:15064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
        6⤵
        
        PID:7088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11043.exe
        5⤵
        
        PID:8772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6362.exe
        5⤵
        
        PID:11540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39362.exe
        5⤵
        
        PID:628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-379.exe
        5⤵
        
        PID:16988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10586.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16291.exe
        5⤵
        
        PID:3648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39357.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58836.exe
        6⤵
        
        PID:11292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31469.exe
        6⤵
        
        PID:15352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2498.exe
        6⤵
        
        PID:1288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14394.exe
        5⤵
        
        PID:8472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32708.exe
        5⤵
        
        PID:11544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22073.exe
        5⤵
        
        PID:3684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34050.exe
        5⤵
        
        PID:11052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10890.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23405.exe
        5⤵
        
        PID:7904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43459.exe
        5⤵
        
        PID:9292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        5⤵
        
        PID:14908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46307.exe
        5⤵
        
        PID:5172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60404.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60404.exe
      4⤵
      PID:8408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17644.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17409.exe
      4⤵
      PID:672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62468.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62468.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19706.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19706.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65341.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2508.exe
        6⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34621.exe
        7⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49373.exe
        8⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20995.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43130.exe
        8⤵
        
        PID:14964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5826.exe
        8⤵
        
        PID:10252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32003.exe
        7⤵
        
        PID:9412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17242.exe
        7⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
        7⤵
        
        PID:4712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59739.exe
        6⤵
        
        PID:7428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1628.exe
        7⤵
        
        PID:10700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61402.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21731.exe
        6⤵
        
        PID:10544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
        6⤵
        
        PID:15004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9586.exe
        6⤵
        
        PID:16732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31651.exe
        5⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14252.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36669.exe
        7⤵
        
        PID:8316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4938.exe
        7⤵
        
        PID:13064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49571.exe
        7⤵
        
        PID:1248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62698.exe
        7⤵
        
        PID:8660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16819.exe
        6⤵
        
        PID:7780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4938.exe
        6⤵
        
        PID:13088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44700.exe
        6⤵
        
        PID:9152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21194.exe
        5⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36669.exe
        6⤵
        
        PID:8324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4938.exe
        6⤵
        
        PID:13056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49379.exe
        6⤵
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50586.exe
        6⤵
        
        PID:9540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37956.exe
        5⤵
        
        PID:9352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20887.exe
        5⤵
        
        PID:12492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40130.exe
        5⤵
        
        PID:16344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51116.exe
        5⤵
        
        PID:9544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2435.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2435.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25773.exe
        5⤵
        
        PID:5828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12140.exe
        6⤵
        
        PID:6776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44189.exe
        7⤵
        
        PID:9408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
        7⤵
        
        PID:3696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exe
        7⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55460.exe
        6⤵
        
        PID:8252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54347.exe
        6⤵
        
        PID:13880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2690.exe
        6⤵
        
        PID:17032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42547.exe
        5⤵
        
        PID:6648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17005.exe
        6⤵
        
        PID:11596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe
        6⤵
        
        PID:14680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40442.exe
        6⤵
        
        PID:6508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-106.exe
        5⤵
        
        PID:10384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        5⤵
        
        PID:14636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20729.exe
        5⤵
        
        PID:6132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16570.exe
      4⤵
      PID:5640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13212.exe
        5⤵
        
        PID:7244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45645.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18502.exe
        6⤵
        
        PID:14648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40371.exe
        6⤵
        
        PID:10224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65364.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        5⤵
        
        PID:14820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39284.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9875.exe
      4⤵
      PID:7220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39787.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39787.exe
      4⤵
      PID:11716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12902.exe
      4⤵
      PID:14692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31149.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10391.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10391.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22301.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22301.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42685.exe
        5⤵
        
        PID:5740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28477.exe
        6⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48909.exe
        7⤵
        
        PID:11808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56567.exe
        7⤵
        
        PID:15104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56778.exe
        7⤵
        
        PID:6304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21059.exe
        6⤵
        
        PID:8676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11290.exe
        6⤵
        
        PID:14012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12674.exe
        6⤵
        
        PID:6856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36683.exe
        5⤵
        
        PID:7368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48452.exe
        5⤵
        
        PID:11724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29437.exe
        5⤵
        
        PID:14744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4578.exe
        5⤵
        
        PID:1408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41184.exe
      4⤵
      PID:5932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24253.exe
        5⤵
        
        PID:6608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36669.exe
        6⤵
        
        PID:8356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4938.exe
        6⤵
        
        PID:13112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16898.exe
        6⤵
        
        PID:2636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48858.exe
        6⤵
        
        PID:10972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-291.exe
        5⤵
        
        PID:8452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56251.exe
        5⤵
        
        PID:4824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15938.exe
        5⤵
        
        PID:5268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29122.exe
        5⤵
        
        PID:8728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62811.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62811.exe
      4⤵
      PID:7164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53133.exe
        5⤵
        
        PID:10812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        5⤵
        
        PID:14444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56778.exe
        5⤵
        
        PID:6468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56612.exe
      4⤵
      PID:10096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51547.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51547.exe
      4⤵
      PID:13232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4002.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4002.exe
      4⤵
      PID:16420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13939.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13939.exe
    3⤵
    PID:760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63245.exe
      4⤵
      PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57338.exe
        5⤵
        
        PID:7996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37019.exe
        5⤵
        
        PID:11164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64371.exe
        5⤵
        
        PID:1136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62698.exe
        5⤵
        
        PID:10332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-467.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-467.exe
      4⤵
      PID:8388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38280.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38280.exe
      4⤵
      PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48295.exe
      4⤵
      PID:14780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37065.exe
      4⤵
      PID:1460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55629.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55629.exe
    3⤵
    PID:6076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25357.exe
      4⤵
      PID:9512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
      4⤵
      PID:12304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23721.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23721.exe
      4⤵
      PID:7016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33282.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33282.exe
    3⤵
    PID:3292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17707.exe
    3⤵
    PID:13036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29851.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29851.exe
    3⤵
    PID:8696
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26307.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26307.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33117.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33117.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45037.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17565.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6649.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28269.exe
        8⤵
        
        PID:5836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-604.exe
        9⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16109.exe
        10⤵
        
        PID:7456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50772.exe
        10⤵
        
        PID:11940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4189.exe
        10⤵
        
        PID:14632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52083.exe
        10⤵
        
        PID:17228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8266.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46932.exe
        9⤵
        
        PID:12820
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 12820 -s 452
        10⤵
        Program crash
        
        PID:16372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20537.exe
        9⤵
        
        PID:16440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41667.exe
        8⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34794.exe
        8⤵
        
        PID:9944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56740.exe
        8⤵
        
        PID:13760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20921.exe
        8⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21667.exe
        7⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22637.exe
        8⤵
        
        PID:7532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36064.exe
        8⤵
        
        PID:10632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        8⤵
        
        PID:14884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14499.exe
        7⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53259.exe
        7⤵
        
        PID:11936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9186.exe
        7⤵
        
        PID:5756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35875.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35773.exe
        7⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13859.exe
        8⤵
        
        PID:10660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        8⤵
        
        PID:15336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
        8⤵
        
        PID:5720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23715.exe
        7⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42587.exe
        7⤵
        
        PID:11684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38103.exe
        7⤵
        
        PID:14700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37065.exe
        7⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57899.exe
        6⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
        7⤵
        
        PID:9500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
        7⤵
        
        PID:11560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exe
        7⤵
        
        PID:6040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65444.exe
        6⤵
        
        PID:9348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15018.exe
        6⤵
        
        PID:13544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18347.exe
        6⤵
        
        PID:8712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65460.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5580.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26349.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15404.exe
        8⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26227.exe
        9⤵
        
        PID:9040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23578.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:10540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52083.exe
        9⤵
        
        PID:17100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27488.exe
        8⤵
        
        PID:8972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47316.exe
        8⤵
        
        PID:12752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11826.exe
        8⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41475.exe
        7⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1820.exe
        8⤵
        
        PID:10548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
        8⤵
        
        PID:13768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40442.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34794.exe
        7⤵
        
        PID:9900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16186.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4194.exe
        7⤵
        
        PID:6552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18979.exe
        6⤵
        
        PID:5652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        7⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34528.exe
        7⤵
        
        PID:11200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        7⤵
        
        PID:15028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29203.exe
        7⤵
        
        PID:16428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44484.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57675.exe
        6⤵
        
        PID:11528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23602.exe
        6⤵
        
        PID:13580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-986.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55949.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8796.exe
        7⤵
        
        PID:8144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44996.exe
        7⤵
        
        PID:11392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32237.exe
        7⤵
        
        PID:14736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62643.exe
        7⤵
        
        PID:4280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22771.exe
        6⤵
        
        PID:8640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28679.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15170.exe
        6⤵
        
        PID:15572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56084.exe
        5⤵
        
        PID:6752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
        6⤵
        
        PID:9736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
        6⤵
        
        PID:2088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe
        6⤵
        
        PID:6520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26602.exe
        5⤵
        
        PID:9436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63444.exe
        5⤵
        
        PID:13448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10123.exe
        5⤵
        
        PID:7644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14035.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14035.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18554.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6732.exe
        6⤵
        Executes dropped EXE
        
        PID:3320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12835.exe
        7⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4764.exe
        8⤵
        
        PID:7820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53844.exe
        8⤵
        
        PID:12212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7837.exe
        8⤵
        
        PID:16168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48803.exe
        8⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50586.exe
        8⤵
        
        PID:11132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57259.exe
        7⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62116.exe
        7⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40138.exe
        7⤵
        
        PID:2256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48850.exe
        7⤵
        
        PID:17180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44164.exe
        6⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25149.exe
        7⤵
        
        PID:10000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        7⤵
        
        PID:12840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56266.exe
        7⤵
        
        PID:17008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7882.exe
        6⤵
        
        PID:8636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52708.exe
        6⤵
        
        PID:2912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26697.exe
        6⤵
        
        PID:17088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21075.exe
        5⤵
        
        PID:1368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63453.exe
        6⤵
        
        PID:4484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52781.exe
        7⤵
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45731.exe
        7⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65498.exe
        7⤵
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16243.exe
        6⤵
        
        PID:8656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23578.exe
        6⤵
        
        PID:12344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17282.exe
        6⤵
        
        PID:6596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46227.exe
        6⤵
        
        PID:9064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61188.exe
        5⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65261.exe
        6⤵
        
        PID:11928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62067.exe
        6⤵
        
        PID:5800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57659.exe
        5⤵
        
        PID:10624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26934.exe
        5⤵
        
        PID:14936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55340.exe
        5⤵
        
        PID:7788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61899.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55741.exe
        5⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61050.exe
        6⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21853.exe
        7⤵
        
        PID:4284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25357.exe
        8⤵
        
        PID:8888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:14140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46218.exe
        8⤵
        
        PID:16992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22019.exe
        7⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5255.exe
        7⤵
        
        PID:13504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29203.exe
        7⤵
        
        PID:7040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52164.exe
        6⤵
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49800.exe
        6⤵
        
        PID:10752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        6⤵
        
        PID:1440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43418.exe
        6⤵
        
        PID:17012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21667.exe
        5⤵
        
        PID:5700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59149.exe
        6⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53268.exe
        6⤵
        
        PID:10788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42170.exe
        6⤵
        
        PID:916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35484.exe
        6⤵
        
        PID:7472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37659.exe
        5⤵
        
        PID:8800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34436.exe
        5⤵
        
        PID:10348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39562.exe
        5⤵
        
        PID:11844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30786.exe
        5⤵
        
        PID:8508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8387.exe
      4⤵
      PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57594.exe
        5⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63181.exe
        6⤵
        
        PID:4888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13859.exe
        6⤵
        
        PID:10668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        6⤵
        
        PID:14916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38619.exe
        5⤵
        
        PID:8704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-803.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39562.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30786.exe
        5⤵
        
        PID:7412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55099.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55099.exe
      4⤵
      PID:5588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3036.exe
        5⤵
        
        PID:7696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54996.exe
        5⤵
        
        PID:12148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40209.exe
        5⤵
        
        PID:16220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2098.exe
        5⤵
        
        PID:3728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62698.exe
        5⤵
        
        PID:9448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29475.exe
      4⤵
      PID:9240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21308.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21308.exe
      4⤵
      PID:11484
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32977.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32977.exe
      4⤵
      PID:5164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58228.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58228.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4028.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11257.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59076.exe
        7⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26656.exe
        8⤵
        
        PID:15560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19683.exe
        8⤵
        
        PID:7664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48264.exe
        7⤵
        
        PID:11192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        7⤵
        
        PID:14788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9593.exe
        7⤵
        
        PID:7776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58884.exe
        6⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6939.exe
        7⤵
        
        PID:16964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32970.exe
        6⤵
        
        PID:9936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
        6⤵
        
        PID:14812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20729.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46068.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46068.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65373.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60026.exe
        7⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53268.exe
        7⤵
        
        PID:12084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22829.exe
        7⤵
        
        PID:15592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
        7⤵
        
        PID:5400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24800.exe
        6⤵
        
        PID:8820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44715.exe
        6⤵
        
        PID:12204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64371.exe
        6⤵
        
        PID:14604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34249.exe
        6⤵
        
        PID:11108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56171.exe
        5⤵
        
        PID:6564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10348.exe
        6⤵
        
        PID:8536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6179.exe
        6⤵
        
        PID:11488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9497.exe
        6⤵
        
        PID:4628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40227.exe
        6⤵
        
        PID:17216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8547.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8547.exe
        5⤵
        
        PID:10020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38267.exe
        5⤵
        
        PID:12808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30978.exe
        5⤵
        
        PID:8116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19715.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16541.exe
        5⤵
        
        PID:3408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24621.exe
        6⤵
        
        PID:6052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16685.exe
        7⤵
        
        PID:7916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53268.exe
        7⤵
        
        PID:12076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64371.exe
        7⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26818.exe
        7⤵
        
        PID:10244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59284.exe
        6⤵
        
        PID:8992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60667.exe
        6⤵
        
        PID:11456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64371.exe
        6⤵
        
        PID:3596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
        6⤵
        
        PID:8624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54932.exe
        5⤵
        
        PID:7108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36669.exe
        6⤵
        
        PID:8332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4938.exe
        6⤵
        
        PID:13048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32659.exe
        6⤵
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50586.exe
        6⤵
        
        PID:9548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63803.exe
        5⤵
        
        PID:7912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61924.exe
        5⤵
        
        PID:13308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52890.exe
        5⤵
        
        PID:17220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59803.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59803.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14060.exe
        5⤵
        
        PID:5212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7260.exe
        6⤵
        
        PID:7952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28000.exe
        6⤵
        
        PID:10884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31469.exe
        6⤵
        
        PID:13552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
        6⤵
        
        PID:6920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-467.exe
        5⤵
        
        PID:8396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19914.exe
        5⤵
        
        PID:11476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64371.exe
        5⤵
        
        PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43923.exe
        5⤵
        
        PID:8168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60116.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
        5⤵
        
        PID:9496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
        5⤵
        
        PID:13488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe
        5⤵
        
        PID:6136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64475.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64475.exe
      4⤵
      PID:9924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47683.exe
      4⤵
      PID:13740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60284.exe
      4⤵
      PID:15552
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40941.exe
        5⤵
        
        PID:3008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49037.exe
        6⤵
        
        PID:6024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8812.exe
        7⤵
        
        PID:10048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        7⤵
        
        PID:12548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33418.exe
        7⤵
        
        PID:7400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36035.exe
        6⤵
        
        PID:9852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23687.exe
        6⤵
        
        PID:12668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16130.exe
        6⤵
        
        PID:1156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50586.exe
        6⤵
        
        PID:9236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26099.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
        6⤵
        
        PID:8008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
        6⤵
        
        PID:2544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46410.exe
        6⤵
        
        PID:17076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34794.exe
        5⤵
        
        PID:9948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28278.exe
        5⤵
        
        PID:15040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38236.exe
        5⤵
        
        PID:7264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23955.exe
      4⤵
      PID:3220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46541.exe
        5⤵
        
        PID:5536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36669.exe
        6⤵
        
        PID:8284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4938.exe
        6⤵
        
        PID:13120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16898.exe
        6⤵
        
        PID:6944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45843.exe
        6⤵
        
        PID:10784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35075.exe
        5⤵
        
        PID:9256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23687.exe
        5⤵
        
        PID:12616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16898.exe
        5⤵
        
        PID:5152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53675.exe
      4⤵
      PID:6096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38541.exe
        5⤵
        
        PID:11904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58487.exe
        5⤵
        
        PID:15960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe
        5⤵
        
        PID:16292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40660.exe
      4⤵
      PID:10104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31546.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31546.exe
      4⤵
      PID:13648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42050.exe
      4⤵
      PID:16028
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23172.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23172.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9996.exe
      4⤵
      PID:2504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62493.exe
        5⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60893.exe
        6⤵
        
        PID:9092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32515.exe
        6⤵
        
        PID:12360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9113.exe
        6⤵
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18355.exe
        5⤵
        
        PID:9340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23687.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29203.exe
        5⤵
        
        PID:16408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7459.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53389.exe
        5⤵
        
        PID:8424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4554.exe
        5⤵
        
        PID:13192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34771.exe
        5⤵
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46362.exe
        5⤵
        
        PID:9476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24394.exe
      4⤵
      PID:7176
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29444.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60314.exe
      4⤵
      PID:3928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57003.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57003.exe
    3⤵
    PID:5128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14060.exe
      4⤵
      PID:1760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45885.exe
        5⤵
        
        PID:7208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65364.exe
        5⤵
        
        PID:10856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        5⤵
        
        PID:15080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62643.exe
        5⤵
        
        PID:2648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56004.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56004.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64891.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64891.exe
      4⤵
      PID:11864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59447.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59447.exe
      4⤵
      PID:14620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20729.exe
      4⤵
      PID:14932
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51060.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51060.exe
    3⤵
    PID:5444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36669.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36669.exe
      4⤵
      PID:8300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42992.exe
        5⤵
        
        PID:14660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4938.exe
      4⤵
      PID:13096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-562.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-562.exe
      4⤵
      PID:16364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
      4⤵
      PID:8196
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29821.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29821.exe
    3⤵
    PID:9360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65424.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65424.exe
    3⤵
    PID:12480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-938.exe
    3⤵
    PID:17000
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11527.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11527.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13433.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13433.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-844.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-844.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39581.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10764.exe
        6⤵
        
        PID:2780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40765.exe
        7⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21293.exe
        8⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22624.exe
        8⤵
        
        PID:12180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48227.exe
        8⤵
        
        PID:15612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
        8⤵
        
        PID:7712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60244.exe
        7⤵
        
        PID:9168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30420.exe
        7⤵
        
        PID:13860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41674.exe
        7⤵
        
        PID:6580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5539.exe
        6⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15164.exe
        7⤵
        
        PID:8156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34835.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34835.exe
        7⤵
        
        PID:13412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45434.exe
        7⤵
        
        PID:3052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55411.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2707.exe
        6⤵
        
        PID:10916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43470.exe
        6⤵
        
        PID:15056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4194.exe
        6⤵
        
        PID:6232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62212.exe
        5⤵
        
        PID:3872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15404.exe
        6⤵
        
        PID:6120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36669.exe
        7⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4938.exe
        7⤵
        
        PID:13104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33427.exe
        7⤵
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26818.exe
        7⤵
        
        PID:6380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16819.exe
        6⤵
        
        PID:9312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25498.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
        6⤵
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6010.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40660.exe
        5⤵
        
        PID:10068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15210.exe
        5⤵
        
        PID:13692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57619.exe
        5⤵
        
        PID:116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19907.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19907.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12025.exe
        5⤵
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24429.exe
        6⤵
        
        PID:5896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7260.exe
        7⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38541.exe
        8⤵
        
        PID:11896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10265.exe
        8⤵
        
        PID:13596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8514.exe
        8⤵
        
        PID:9580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28000.exe
        7⤵
        
        PID:10748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31469.exe
        7⤵
        
        PID:13876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
        7⤵
        
        PID:5704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-467.exe
        6⤵
        
        PID:8380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2234.exe
        6⤵
        
        PID:12248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13702.exe
        6⤵
        
        PID:16180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56666.exe
        6⤵
        
        PID:5356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12587.exe
        6⤵
        
        PID:9324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54740.exe
        5⤵
        
        PID:7076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50637.exe
        6⤵
        
        PID:10888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        6⤵
        
        PID:15012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe
        6⤵
        
        PID:6524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29594.exe
        5⤵
        
        PID:9792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40212.exe
        5⤵
        
        PID:13640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26105.exe
        5⤵
        
        PID:940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32514.exe
        5⤵
        
        PID:10512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52683.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52683.exe
      4⤵
      PID:4740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15404.exe
        5⤵
        
        PID:5736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-156.exe
        6⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53268.exe
        6⤵
        
        PID:12092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39166.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39166.exe
        6⤵
        
        PID:15656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29203.exe
        6⤵
        
        PID:16448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56596.exe
        5⤵
        
        PID:8876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11466.exe
        5⤵
        
        PID:10516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31891.exe
        5⤵
        
        PID:4424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27202.exe
        5⤵
        
        PID:8532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10915.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10915.exe
      4⤵
      PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25149.exe
        5⤵
        
        PID:10060
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5900 -s 640
        5⤵
        Program crash
        
        PID:12708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31994.exe
      4⤵
      PID:9964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64212.exe
      4⤵
      PID:13684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54316.exe
      4⤵
      PID:1332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47585.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47585.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23245.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8652.exe
        5⤵
        
        PID:4084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21549.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21549.exe
        6⤵
        
        PID:5344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26285.exe
        7⤵
        
        PID:7852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21856.exe
        7⤵
        
        PID:12024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6493.exe
        7⤵
        
        PID:15616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29779.exe
        7⤵
        
        PID:3856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56596.exe
        6⤵
        
        PID:8868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29146.exe
        6⤵
        
        PID:12500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47459.exe
        6⤵
        
        PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63956.exe
        5⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6316.exe
        6⤵
        
        PID:9980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27523.exe
        6⤵
        
        PID:12728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52867.exe
        6⤵
        
        PID:10152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59579.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59579.exe
        5⤵
        
        PID:9400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60212.exe
        5⤵
        
        PID:13784
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53594.exe
        5⤵
        
        PID:15088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4931.exe
      4⤵
      PID:5012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63453.exe
        5⤵
        
        PID:752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43139.exe
        6⤵
        
        PID:6684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56059.exe
        6⤵
        
        PID:13300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1906.exe
        6⤵
        
        PID:5796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46227.exe
        6⤵
        
        PID:10564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42755.exe
        5⤵
        
        PID:8892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27994.exe
        5⤵
        
        PID:9480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48227.exe
        5⤵
        
        PID:2520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47322.exe
        5⤵
        
        PID:8768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54251.exe
      4⤵
      PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36669.exe
        5⤵
        
        PID:8308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4938.exe
        5⤵
        
        PID:13080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34771.exe
        5⤵
        
        PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15417.exe
        5⤵
        
        PID:9076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63700.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63700.exe
      4⤵
      PID:9184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53259.exe
      4⤵
      PID:13292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27349.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27349.exe
      4⤵
      PID:8796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17306.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17306.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9996.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9996.exe
      4⤵
      PID:3496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51533.exe
        5⤵
        
        PID:6452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34400.exe
        6⤵
        
        PID:8436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10419.exe
        6⤵
        
        PID:13176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8233.exe
        6⤵
        
        PID:5628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46162.exe
        6⤵
        
        PID:10324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63508.exe
        5⤵
        
        PID:8124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64507.exe
        5⤵
        
        PID:11960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10054.exe
        5⤵
        
        PID:15092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20729.exe
        5⤵
        
        PID:6476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49076.exe
      4⤵
      PID:5804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36045.exe
        5⤵
        
        PID:12396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11138.exe
        5⤵
        
        PID:1600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50122.exe
        5⤵
        
        PID:8816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3658.exe
      4⤵
      PID:9000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25044.exe
      4⤵
      PID:14148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37065.exe
      4⤵
      PID:6164
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-131.exe
    3⤵
    PID:2588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45044.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45044.exe
      4⤵
      PID:7288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50637.exe
        5⤵
        
        PID:10736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        5⤵
        
        PID:14988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23913.exe
        5⤵
        
        PID:6824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48648.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48648.exe
      4⤵
      PID:11140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52135.exe
      4⤵
      PID:14804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58602.exe
      4⤵
      PID:7236
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36954.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36954.exe
    3⤵
    PID:6928
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59764.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59764.exe
    3⤵
    PID:10840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44000.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44000.exe
    3⤵
    PID:14760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31889.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31889.exe
    3⤵
    PID:10136
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31124.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31124.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38045.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7116.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61050.exe
        6⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56461.exe
        7⤵
        
        PID:7932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28000.exe
        7⤵
        
        PID:10644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31469.exe
        7⤵
        
        PID:12708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64276.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64276.exe
        6⤵
        
        PID:7620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18378.exe
        6⤵
        
        PID:12196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13702.exe
        6⤵
        
        PID:16208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22073.exe
        6⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46162.exe
        6⤵
        
        PID:10320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36576.exe
        5⤵
        
        PID:5620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31469.exe
        6⤵
        
        PID:7328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2707.exe
        6⤵
        
        PID:10448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        6⤵
        
        PID:15048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
        6⤵
        
        PID:5292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14499.exe
        5⤵
        
        PID:9212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53259.exe
        5⤵
        
        PID:12328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42242.exe
        5⤵
        
        PID:5508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4931.exe
      4⤵
      PID:3836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14444.exe
        5⤵
        
        PID:2196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48205.exe
        6⤵
        
        PID:7828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34627.exe
        6⤵
        
        PID:11976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5533.exe
        6⤵
        
        PID:15264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
        6⤵
        
        PID:6216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44100.exe
        5⤵
        
        PID:9192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34634.exe
        5⤵
        
        PID:13272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20530.exe
        5⤵
        
        PID:6392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36872.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36872.exe
      4⤵
      PID:7092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25149.exe
        5⤵
        
        PID:9992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27331.exe
        5⤵
        
        PID:12640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60106.exe
        5⤵
        
        PID:9264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35460.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35460.exe
      4⤵
      PID:9708
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46731.exe
      4⤵
      PID:13496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17579.exe
      4⤵
      PID:17156
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17795.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17795.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9612.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9612.exe
      4⤵
      PID:4760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53370.exe
        5⤵
        
        PID:5324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-275.exe
        6⤵
        
        PID:8512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25882.exe
        6⤵
        
        PID:12144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15170.exe
        6⤵
        
        PID:5016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64234.exe
        6⤵
        
        PID:10940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16803.exe
        5⤵
        
        PID:8368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53355.exe
        5⤵
        
        PID:11240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15170.exe
        5⤵
        
        PID:16124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13881.exe
        5⤵
        
        PID:10268
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31283.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24173.exe
        5⤵
        
        PID:7884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10403.exe
        5⤵
        
        PID:7892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
        5⤵
        
        PID:5716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31306.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31306.exe
      4⤵
      PID:7844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41841.exe
      4⤵
      PID:12232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5037.exe
      4⤵
      PID:16188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56659.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56659.exe
      4⤵
      PID:1284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51116.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51116.exe
      4⤵
      PID:11060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18474.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18474.exe
    3⤵
    PID:1956
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58362.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58362.exe
      4⤵
      PID:5992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37437.exe
        5⤵
        
        PID:7868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23859.exe
        5⤵
        
        PID:12264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7837.exe
        5⤵
        
        PID:16196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34387.exe
        5⤵
        
        PID:6316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31561.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31561.exe
        5⤵
        
        PID:11044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17203.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17203.exe
      4⤵
      PID:8260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30420.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30420.exe
      4⤵
      PID:13868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7849.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7849.exe
      4⤵
      PID:16336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32322.exe
      4⤵
      PID:10804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27060.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27060.exe
    3⤵
    PID:7156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54877.exe
      4⤵
      PID:11880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25814.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25814.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45434.exe
      4⤵
      PID:5856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35484.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35484.exe
      4⤵
      PID:9016
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26794.exe
    3⤵
    PID:9604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30195.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30195.exe
    3⤵
    PID:13512
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37212.exe
    3⤵
    PID:6996
- C:\Users\Admin\AppData\Local\Temp\Unicorn-24778.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-24778.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4232
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53229.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10764.exe
      4⤵
      PID:2348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49914.exe
        5⤵
        
        PID:5816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36669.exe
        6⤵
        
        PID:8348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24544.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42430.exe
        6⤵
        
        PID:14656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
        6⤵
        
        PID:3820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18355.exe
        5⤵
        
        PID:9368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23687.exe
        5⤵
        
        PID:12520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48995.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26976.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26976.exe
      4⤵
      PID:6892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
        5⤵
        
        PID:9488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58484.exe
        5⤵
        
        PID:13520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23529.exe
        5⤵
        
        PID:3612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34794.exe
      4⤵
      PID:9972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23876.exe
      4⤵
      PID:13700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60314.exe
      4⤵
      PID:15672
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62212.exe
    3⤵
    PID:2864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7916.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7916.exe
      4⤵
      PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8636.exe
        5⤵
        
        PID:9892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
        5⤵
        
        PID:11152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46218.exe
        5⤵
        
        PID:6912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15667.exe
      4⤵
      PID:9424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17242.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17242.exe
      4⤵
      PID:13464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15938.exe
      4⤵
      PID:15788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27202.exe
      4⤵
      PID:8628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-67.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-67.exe
    3⤵
    PID:7420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13642.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13642.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26934.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26934.exe
    3⤵
    PID:15020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21259.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21259.exe
    3⤵
    PID:5408
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60820.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60820.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59197.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59197.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14060.exe
      4⤵
      PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27053.exe
        5⤵
        
        PID:7416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1628.exe
        6⤵
        
        PID:10604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32534.exe
        6⤵
        
        PID:15072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57610.exe
        6⤵
        
        PID:8264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51332.exe
        5⤵
        
        PID:10488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46270.exe
        5⤵
        
        PID:14892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19602.exe
        5⤵
        
        PID:17044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34394.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34394.exe
      4⤵
      PID:10196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30596.exe
      4⤵
      PID:12868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19506.exe
      4⤵
      PID:8272
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56660.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56660.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45149.exe
      4⤵
      PID:10416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41379.exe
      4⤵
      PID:13436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39866.exe
      4⤵
      PID:3184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50939.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50939.exe
    3⤵
    PID:9876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65387.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65387.exe
    3⤵
    PID:13368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35970.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35970.exe
    3⤵
    PID:10148
- C:\Users\Admin\AppData\Local\Temp\Unicorn-50413.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-50413.exe
  2⤵
  PID:224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16173.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16173.exe
    3⤵
    PID:5884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32445.exe
      4⤵
      PID:7572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50772.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50772.exe
      4⤵
      PID:11948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56444.exe
        5⤵
        
        PID:9620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4189.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4189.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29395.exe
      4⤵
      PID:4292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26611.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26611.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47316.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47316.exe
    3⤵
    PID:12412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30618.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30618.exe
    3⤵
    PID:7524
- C:\Users\Admin\AppData\Local\Temp\Unicorn-48706.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-48706.exe
  2⤵
  PID:6480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36669.exe
    3⤵
    PID:8292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4938.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4938.exe
    3⤵
    PID:13072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16130.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16130.exe
    3⤵
    PID:5728
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60796.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60796.exe
  2⤵
  PID:7496
- C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-31123.exe
  2⤵
  PID:13260
- C:\Users\Admin\AppData\Local\Temp\Unicorn-9498.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-9498.exe
  2⤵
  PID:17196

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5900 -ip 5900
1⤵
PID:12640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 12820 -ip 12820
1⤵
PID:16332

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:1376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe

Filesize
468KB

MD5
cc6961cf45927b2cfa6fde51d9afaaed

SHA1
2caf3f462294da463f57b95e979fc374e0728c36

SHA256
1abdca4f57be8c8f6c4648e93243d075b94f8209fdecd8d936c0074ccc4b96f9

SHA512
8768ac721ba8a3b8b407771752c84b9c8f48dc68d0c896fe1b59bcd3921dcaa5b0b92f78e952c0d4be6eff3403d868bd291cebaa24beb191f03c8da79de4006e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10391.exe

Filesize
468KB

MD5
7f0ab8a9ac16bb10e504876d2cae2f72

SHA1
4c005f35b0f68217115d11ff199005c4d437ad47

SHA256
11920ac0fcb09cfe6560ed4a9a8c431c642ae460574e530a5a4a7c3166b4233f

SHA512
8ea5605dc8058cf4d575daaa5c7bfd068837e88a9b43c78a9eff29447ff699d5d50bc87cd5b0b4e5f3607bb68cd34b659d3a91b6ae96adcaf4158bfef7f38c51

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11527.exe

Filesize
468KB

MD5
e410085db181d0bf2212ed625514da6b

SHA1
7bfe8d1038f12ea6f0864f6ba5527fe4a60947a5

SHA256
8e93330c84ffc3f22cb1bbdf520f68360fee0263bd35118b6fa552cc70e44f5d

SHA512
66f4dd57bd41788f37ea6ed53c9d1bf8bc6bd93653c932d1396f148debc2750362c235dac2c51578830a357bfe10e3613f34d791f444bcc235989fdca774a7e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11706.exe

Filesize
468KB

MD5
afa943cba8fcd5eb322a2bfb1235e3ae

SHA1
3a4668cf37d100c2c16b7145e737e370e4df8978

SHA256
76e54e0d5e0135dca67ae08d61908e6c5018b5c0c24be063cfec3d2d659e174b

SHA512
acf86fa9c709641dac112aae73ddc2c956714dc28ef4c9770c686bbb357c1af0eea0504c4fdeec4d6d67eed484efa30b12c9166747be565219460808bec2ccee

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12188.exe

Filesize
468KB

MD5
7dd305ee740acfe7d00633ea0aa2d942

SHA1
ca19a98acb42285a4dd96d550db0284971ccacd4

SHA256
ca97880ea480f697e01845232af1c712540d0f44b603ffda292f821915c7c7e3

SHA512
a947fa62228d4c31edc585e6e647fb8ff28345233397ef7bfa27484d68a09416570621473dfab9d6151344a3194b8885625f28a46a0bc6b84862c776ad468276

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13433.exe

Filesize
468KB

MD5
ae14993d0ef04004acbf13b1febccac0

SHA1
a5c13ef47f3a112ea51eb25819fe52a65f40c10d

SHA256
1203de2dd0682bd781025018e954924d17d7a55ccb776a0589e3e77f9bacc2c4

SHA512
08614f8c704ff0a4166acb98c400e487b5fe0b8269eac76e0b93388ba9f411a59c9092150074f34cb9ceaab8f03834582f9c896ff5d7b7679ac96c2c59ccdb96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14035.exe

Filesize
468KB

MD5
12ce2ddac2032dad4e66d63204902694

SHA1
48d4fd2046aef57b956023afb1837bf993807bd1

SHA256
bcc6074446c29985322cb79fcb6016655f00807f01db4241408a3297dbe8d795

SHA512
a8d9fb5e8def55a8c999c8ad20235a7d2b8a375e8e461bc4bdc5dd8c00f2194a014aab90ab988be3e63853a1bb05b91081573e8453c0bb04d6932cb236317a96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17565.exe

Filesize
468KB

MD5
a9d82fa02c96a72fd8b6837059f72fde

SHA1
db9be8dcc5faddae43bff1376c48ac8c759a8fd9

SHA256
75b03fd181a5058559641f10a96ed1a0df9eef52e2acc71bd0a98a497a373cc6

SHA512
e4a2f5871d38436ecbfeb546ba91e7b184dd51d696d4a9c82ae270d031d7224980457f02a6d7a6706aaa1a46058cee45da7e0a6ac0eedf66c7a55c77959844a1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18554.exe

Filesize
468KB

MD5
880f36be7024acbc66e6753acbf3b6ee

SHA1
bd6759ba79465808146f253707de0c90eac1336d

SHA256
5eddab03f00a0e9e09d338607dd974ec17d31589ae2ecef31bb6840ea56ed6f7

SHA512
e73c70843869bd0221a164d97b0e65ec31b976bc204f9bea3473c3c32d12f148d3ca9831e7cc747d6845f04a81502942c67881997a676f349377e074eed24daf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19706.exe

Filesize
468KB

MD5
646c23b1e864f87c67654022b165051a

SHA1
8682af927114af273171b0db2f56f54d06dda5d9

SHA256
32898e5ea340f6c003e4b37864088c608bd357c08057a5d7aa3cce5bc8c6461e

SHA512
2a521550dd93b301e202b33d9c30802583fa483cccdbb7d1557e3e54113bc4e8caee2d3cc4e04d7ff5e27dfa1fede2eb7463178a9844655818207574813c48ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24778.exe

Filesize
468KB

MD5
547871487efb96f9d45e0e1fef3f6b0d

SHA1
4299cf9bf7cbcd8baef2053fc642bed630a9b7f2

SHA256
90ce5367d830dd19f489d06307f7f64eb4ad6bed56ea571f3ad1c18da10e927a

SHA512
c642b2879ea0e7a887f86316f656978c8c74fbcbaaffe4ca33b8d82c3313cb449cef2f27117a240c32e3a2ab1fa8210f39f30771037c940bd3d8e1294c33a70b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26307.exe

Filesize
468KB

MD5
35cb7e1d232cafb4b007e4895c876b70

SHA1
fde8f4aa9fafbf8b95275f040003a32b565ef708

SHA256
68c07617a11c2302e02805795590e0824ccd881a48677f8ed03abed9eba01893

SHA512
fb904cafe1a04c52ef61290c8120df2154e077460b43ef0e27416c3acd2a9cf091b309b9abdcec730395f4ae9a8802c0acb58c32656951f59bd14e047f7b6330

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29645.exe

Filesize
468KB

MD5
aebf653f891591075ea90c9397fe3c23

SHA1
fbc8d092f5686d5e0c6d9063a8b465ba39cbc945

SHA256
6085102bfac391b9fab13ead5da1c9dcc6c134ee26d85af7f7fc3d0059ed117f

SHA512
e115021aebd25f6d4da7496b2b6b541f2c87a3038c9075c99584313532b6dea7945dbaafa1f872970eb6595b2578dbacb74d806549017a23899400f45e3a5782

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31124.exe

Filesize
468KB

MD5
c0080c2ceed29afa87fa967c0e1a3dc9

SHA1
7225b46b38f58a9f6496d86cdd6efe1ae97ba8ce

SHA256
e47a4160c23cba2d91757da254646e6bacbb76108c8370f8c3811aea05f17619

SHA512
6fb6f7f35052f2c4ac79f287cf1ce84001d3611c44d597c8e8a25a1ce8bdcc20d24387040ef18e6581e2d395093f5f047855f328874d3023f50baadeadafc0dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33117.exe

Filesize
468KB

MD5
0717f6aaf83da33548fbc9d1500ded53

SHA1
1ff73a6e254bd61b9f68b108d072f9eeb6644060

SHA256
91b1cd126ba135914a86093d1307c7b030859390ad14df7dbad534d7e6ef0ffc

SHA512
7cebdb3a82ef5ba71a1c25879db3d2f8133ad72ede317dcd41c028fec2098fa9eb0414b44d32bcf57ebeb8a892f8a233081487e500b84c04e8eb96e3b88fc9d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45037.exe

Filesize
468KB

MD5
9f97c08b7a94ef088fd62c22594f9b31

SHA1
b4c60c365c9b02b67b67e59038ff1dc0a08fc56d

SHA256
c9ce967d7f53d6469ffe7138e883115b5c56e3aa82a51da31170e0401afc73bb

SHA512
34482b356c75d069585efec739ca781ac9a178f641f06da04c17f59dd249f2bb1684523de9363a3217c07ddc45eabea61aa46c98b46971cc9fea505f6aa6e166

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46189.exe

Filesize
468KB

MD5
a6c41418890dffd63e3268d6734421fc

SHA1
990f87d1eb2d3bc0d0cb42d8f5db3ff1e43f1ac0

SHA256
1b2736836b58110d322efa2190500ead1f9f1d2125cf4f3fb0d3a60118166709

SHA512
36916a7c8032f92054cf8e7bf1ca73b815b80debc657b3f7295149403603477828e089b09f0e3d8042811b94bd28d56c1d57bfcce1c39f2c5940125d0ae65f8b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47585.exe

Filesize
468KB

MD5
7b3fcccd2aa62103b1f536f9189aa384

SHA1
b803c05d1a9a3d688b7adeb1b7a48859ed448140

SHA256
32ebd249685fd5eee3cdad4aab072e8fd54b92521753c795352314b24f67077f

SHA512
df8c526c0bd1d9a452aeec74c992d83985edcfb79d418721c54684c804ec801ecf389a791d3a7ee6aa313929cab9740b900d6f98b05675d27baaad8264dad88e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51117.exe

Filesize
468KB

MD5
f25370f7210ac1b999287d753cbb2cf8

SHA1
ddd5a799dc5965bc711d948c0519ea86e65a2f70

SHA256
43ce8914f12f53d5f4c3cd90502bf47c05f5ba1f09a9277229048ea80086be6d

SHA512
660685832bdd42896ef3fa031c5ec5e0b0543d6f430a6ba2bcbf906a490a7e2c7d2afa400886346a0339d422ccc73d5e516e0e5d712ad5d0f4dc4ecaed49b05e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5539.exe

Filesize
468KB

MD5
26b1ad0de58c5f3f6a36fc96e2ba35d4

SHA1
bcbb84a8c045c8c5e882074b57e6165fa79a379b

SHA256
7ed0bb740520ae02237d2ac4976b765210ed6bac765dc142f198bd5da99f8b47

SHA512
317495092c652475271ee27ccb4a3a3fd5b544aa82296b842c45e37b13e87224bef8a19a94098c579fb2f76a0231641bb148b885e25b11e465186b5b9117ce27

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58052.exe

Filesize
468KB

MD5
2b0f6eb93945c872c8558ba3656b2e67

SHA1
a0b69147005d9e121a853107cd310379d2e05bb1

SHA256
a08676c3a9d2da87a49c9765487ed3f2fb567f06fd81cba89530cc17a44b0b95

SHA512
10015345ee55f3a585746c2aea92d3022a3b661d4119a3624cca2dac80cda6d1c21539ff9b8b0754dbd61cb881bb2a9bf3cf514d34e36afe77545c21ee22b45a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58228.exe

Filesize
468KB

MD5
ddde7a0386d5c7bec32f83558e02bd80

SHA1
4860edb2c7b7890135f95206c08b84834b04f702

SHA256
baa9c8acf59214b0b6a3ab16a108accc9746604354bba7523420814df181ab53

SHA512
743e943b0fe67aa3df2b4c8178a6c7e4ce379ff5228771eb9286ea4f666a3fab0984220a66a443bf0af22f9ceaac538872e336ec872a6c8918643311e5212582

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59204.exe

Filesize
468KB

MD5
c50d61fc3f46db4b5e6dc012846d1463

SHA1
9969daf736dd83870a97d8d94e5d366bafa396af

SHA256
73585c8f67f92b94ff52024a2292792e6d49171c586e3fc9a2763e05fde04097

SHA512
71aa721d29f3d5f769d4b1f7b12b0cd2d1f3911358551635aeaea33dbea48606e871ac3d7714601426c2cf1a74f9cdcb5dc0695a86d09eed98693d5532f96bc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61320.exe

Filesize
468KB

MD5
86e205843b882f91720df640acc5303b

SHA1
2f331050196118e110e909972628e75ec46843a6

SHA256
fa15f72d1a8f490529befc8767c54fafdcfacb6237b3e1832b80a853996c86c5

SHA512
79c1af204ab48ab0e9d51713e55f37481ad97a4bc58802e8b6d4e4ea4746c02c71b83b52426c31beeb500f7a90fe81dffacee7794a6080e4014bf0a9961d7532

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62205.exe

Filesize
468KB

MD5
caa6dd8cf353673c34e1d0935b051a17

SHA1
f93290d9942b781685c677caf140f9b27d3b86cd

SHA256
5a7da77dde45f7d4bf571e30dc7f7a199f0875ca2737b04b76544ed17495076d

SHA512
e276a950876ff94de4276fe5cf1dabb1dfe98a326ab68024d1a21a8b417467fec56dec6d35b68d751db4308b274ccd111ab83429ea3c1f00da92fea5e0e814c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62468.exe

Filesize
468KB

MD5
2b08db7db895b24ac2e7320644161152

SHA1
dde6576f7baa5cc598f5e9e28d9bfb932b9ba955

SHA256
7ee3e362278c4ab06acb4e295bb453aef1d6303edc83ed0e4b0d09752781fb1f

SHA512
6fb0b3e225cbc0fa3d4af8006bdd0921bba907e60541024b220500266d9dbacdb5c5824c37801e3a3db4de50fd24e572210bc37793ef60ddab3acf45d63bbba9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62541.exe

Filesize
468KB

MD5
985bfc11d231fd4cdabbd341204cfbd1

SHA1
b9ba23407ba3c03af2a98536dff33e701167085b

SHA256
f767653940d5c3ea1c654c39d9811c0527282da529aae208d34c77302855a978

SHA512
5bc7c60d505fe7ea41f0ac0921a114112421186edd57da75b008c118f458a1f7b1363c6251c465159a63f31d930d42c75b0721fc0ab0b68b0332a1c18334325e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62733.exe

Filesize
468KB

MD5
7888162111780ba20c529d5c7cae205f

SHA1
25dd4297ed6f8f03bd95c18190a8ea56c855b4c1

SHA256
b90e81566a7f44b39464e0fc27e49b97d74ce33a312cba9bbf65a759f90a2edd

SHA512
96cde71fa04d698e48bfda2585793bb8fa9900053589d86bf2254f44e904a26e369b5d95cb4692199082aeef50919e96e8aca4901fab552b258fafd71b4cfc25

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6323.exe

Filesize
468KB

MD5
013877ae82492fd38e4b522d54347105

SHA1
3e11d21bd7c38dd0153cd909c230a6982b390c68

SHA256
ef0a618527db1fbfb86cc11705ebc0dc767f075726e3144d3dd730462a21a8cf

SHA512
a15c832770830a5bc46bc315980895fdd23ea65b4534f4e6dc9f94b52a7137076f15097b9440b4d217371b67a6f95ff243c25ff04fbe8adc1550389735e7ce0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-65460.exe

Filesize
468KB

MD5
2db7341ec5cd8239f63ef110ba570362

SHA1
5ddd06ec4e26dd9040a313734162eedf9d6e2032

SHA256
24cb45a08a84c7c105a49633f25cc15c64aa0da11bc8336685758bf373ea2396

SHA512
2b15f770cc83a9693138a5bdc401a3b883036804d85983af6322c1b9e1531e4acb910560db0ed28f1a74012f926148476282a3319f390fdc0a1d8a4bc370fb5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-844.exe

Filesize
468KB

MD5
8acb0fad745f27ac243a16fc379bcf28

SHA1
baf091b9ff4f05288f85a1962d31960c6e02c7d3

SHA256
d1690379d352ce65ba3090b51817e330c12e80806f19f8ab5ff36fc3e5c5335a

SHA512
5a8cc81125b0a81420e9cac78107bea426457b589b38360b3b3c111e3d124eaaa5094d0824a4d35be94c1b2c1e6a502a13988cfbd0038beaa33e224652dbd95b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8455.exe

Filesize
468KB

MD5
c3bde7ac38ffcece506abb6bfccfb0df

SHA1
1b0c2e9c8bc090b2eef71d22c6024428486ed91a

SHA256
6d02f4728d2adf4726a3bb04d3cf76ca728dd263b49467d81949d649d2d0af9b

SHA512
5e57a45e7bdb6d22f49f9d2fc734130e2523c000a91b3346946c54b32b7c69e631001a3ed03444b222b8c16fb8db38863bbb9c90c84f3c88d4a88e36070871bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-956.exe

Filesize
468KB

MD5
e9e5f25b1c2435593b7b713761ee150d

SHA1
4e492fa92c1315752ca78a4e017050bdd7ef8f57

SHA256
ee4ea675fb883c9a1f57b7ff0f535bd1bf4e7b5016234c67aef0da5d9213a15c

SHA512
197c56f78ba3096aa1537974be1c6bc333f2b01bcac83f83e11c5f42bcfd3f8d858607fa88981f33967448722e6d03bfa6ac9777eab9565f3153de3fb372bf17

Download Submit
memory/212-34-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/224-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/348-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/684-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/684-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/748-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/760-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1052-310-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1168-125-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1180-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1268-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1272-242-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1320-278-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1336-146-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1368-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1420-20-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1424-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1524-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1556-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1588-377-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1596-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1620-220-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1684-461-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1736-235-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1804-298-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1956-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1972-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2000-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2044-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2096-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2312-53-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2316-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2320-77-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2500-263-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2512-265-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2524-90-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2572-144-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2588-477-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2708-72-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2780-442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2844-184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2864-475-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2896-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2904-209-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3008-439-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3056-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3064-151-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3088-460-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3100-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3164-152-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3196-47-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3200-277-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3204-40-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3220-458-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3240-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3320-390-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3364-145-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3408-476-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3424-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3496-480-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3532-365-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3540-107-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3608-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3664-392-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3668-169-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3672-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3836-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3844-478-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3952-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3956-266-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3964-105-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4084-425-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4152-26-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4232-147-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4272-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4288-331-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4324-196-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4384-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4480-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4508-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4544-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4688-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4736-421-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4740-463-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4748-321-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4760-394-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4804-80-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4912-274-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5128-479-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5136-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5476-565-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5492-566-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5516-568-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5524-573-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5548-574-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5556-575-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads