65db7d20290c4e60a0f788e9193928018652c1bede58d4b86eea80af5adf2256

Analysis

max time kernel
120s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65db7d20290c4e60a0f788e9193928018652c1bede58d4b86eea80af5adf2256N.exe
Size

468KB
MD5

75e79342a8a722d167357911584b8b40
SHA1

7bc07b12ee0a0e53e942caf94a2230cca16c89f0
SHA256

65db7d20290c4e60a0f788e9193928018652c1bede58d4b86eea80af5adf2256
SHA512

bfdce5dc4e00e66f94cee6dd7d021f703bf839a66988b03a54b0b87fd9cbd50ff9641f0e4ce39ba0c5f99ee5041fddbe906abc4d7db3bf93e7d545fe15074815
SSDEEP

3072:SqktogUbjy8U2bY9Pzsy2fU/Ekhej+plPmHXLVIpOQmGpOcNQOlU:SqmohLU2+Poy2fRuOyOQJkcNQ

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3356	Unicorn-27540.exe
2056	Unicorn-50036.exe
3480	Unicorn-30170.exe
3284	Unicorn-43980.exe
3440	Unicorn-46018.exe
4540	Unicorn-56979.exe
4512	Unicorn-11307.exe
1996	Unicorn-2667.exe
3328	Unicorn-56507.exe
4100	Unicorn-37186.exe
1204	Unicorn-43316.exe
5044	Unicorn-18812.exe
2568	Unicorn-18812.exe
4220	Unicorn-18546.exe
2948	Unicorn-11198.exe
4592	Unicorn-33368.exe
4548	Unicorn-53980.exe
3840	Unicorn-46367.exe
4828	Unicorn-30937.exe
1312	Unicorn-24816.exe
1568	Unicorn-4130.exe
1624	Unicorn-22076.exe
4172	Unicorn-13907.exe
3812	Unicorn-7777.exe
1664	Unicorn-54940.exe
2332	Unicorn-54178.exe
1444	Unicorn-47327.exe
2108	Unicorn-43242.exe
708	Unicorn-23228.exe
892	Unicorn-60731.exe
1964	Unicorn-64260.exe
4296	Unicorn-19506.exe
1352	Unicorn-23036.exe
216	Unicorn-29157.exe
2860	Unicorn-48884.exe
4356	Unicorn-24115.exe
712	Unicorn-37378.exe
1628	Unicorn-37378.exe
3460	Unicorn-59282.exe
4364	Unicorn-48692.exe
2416	Unicorn-24188.exe
2724	Unicorn-24188.exe
5076	Unicorn-28442.exe
1932	Unicorn-43462.exe
3688	Unicorn-27888.exe
1284	Unicorn-16190.exe
1556	Unicorn-57223.exe
3172	Unicorn-13832.exe
1356	Unicorn-1580.exe
1536	Unicorn-5664.exe
1412	Unicorn-48735.exe
2588	Unicorn-29399.exe
3432	Unicorn-54865.exe
3564	Unicorn-42348.exe
4432	Unicorn-22747.exe
1716	Unicorn-36483.exe
5072	Unicorn-42997.exe
2252	Unicorn-2327.exe
3208	Unicorn-9940.exe
2280	Unicorn-23537.exe
524	Unicorn-54355.exe
3752	Unicorn-23345.exe
5000	Unicorn-7008.exe
1180	Unicorn-7008.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4524	15252	WerFault.exe	778
2984	8968	WerFault.exe	635
3420	14212	WerFault.exe	673

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15555.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14948.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33862.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23208.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43779.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-8487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16786.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40849.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21567.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14512.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64429.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47621.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6846.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11668.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65360.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42363.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11883.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25658.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23208.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46499.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3983.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41095.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14123.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60221.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58124.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56507.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28854.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51985.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37378.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31949.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20250.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54631.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33368.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40745.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50863.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59483.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1346.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6623.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27341.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60148.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14526.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55348.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17102.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24115.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
16700	svchost.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	15540	dwm.exe
Token: SeChangeNotifyPrivilege	15540	dwm.exe
Token: 33	15540	dwm.exe
Token: SeIncBasePriorityPrivilege	15540	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
968	65db7d20290c4e60a0f788e9193928018652c1bede58d4b86eea80af5adf2256N.exe
3356	Unicorn-27540.exe
2056	Unicorn-50036.exe
3480	Unicorn-30170.exe
3284	Unicorn-43980.exe
3440	Unicorn-46018.exe
4512	Unicorn-11307.exe
4540	Unicorn-56979.exe
1996	Unicorn-2667.exe
3328	Unicorn-56507.exe
4100	Unicorn-37186.exe
1204	Unicorn-43316.exe
2948	Unicorn-11198.exe
5044	Unicorn-18812.exe
4220	Unicorn-18546.exe
2568	Unicorn-18812.exe
4592	Unicorn-33368.exe
4548	Unicorn-53980.exe
3840	Unicorn-46367.exe
4828	Unicorn-30937.exe
1568	Unicorn-4130.exe
1312	Unicorn-24816.exe
1624	Unicorn-22076.exe
4172	Unicorn-13907.exe
2332	Unicorn-54178.exe
3812	Unicorn-7777.exe
1444	Unicorn-47327.exe
1664	Unicorn-54940.exe
2108	Unicorn-43242.exe
708	Unicorn-23228.exe
892	Unicorn-60731.exe
1964	Unicorn-64260.exe
4296	Unicorn-19506.exe
1352	Unicorn-23036.exe
216	Unicorn-29157.exe
4356	Unicorn-24115.exe
2860	Unicorn-48884.exe
712	Unicorn-37378.exe
4364	Unicorn-48692.exe
1628	Unicorn-37378.exe
2416	Unicorn-24188.exe
3460	Unicorn-59282.exe
2724	Unicorn-24188.exe
5076	Unicorn-28442.exe
1932	Unicorn-43462.exe
3688	Unicorn-27888.exe
1556	Unicorn-57223.exe
1284	Unicorn-16190.exe
3172	Unicorn-13832.exe
1536	Unicorn-5664.exe
1356	Unicorn-1580.exe
2588	Unicorn-29399.exe
3432	Unicorn-54865.exe
1412	Unicorn-48735.exe
3564	Unicorn-42348.exe
1716	Unicorn-36483.exe
4432	Unicorn-22747.exe
5072	Unicorn-42997.exe
2252	Unicorn-2327.exe
3208	Unicorn-9940.exe
2280	Unicorn-23537.exe
524	Unicorn-54355.exe
3752	Unicorn-23345.exe
5000	Unicorn-7008.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 3356	968	65db7d20290c4e60a0f788e9193928018652c1bede58d4b86eea80af5adf2256N.exe	82
PID 968 wrote to memory of 3356	968	65db7d20290c4e60a0f788e9193928018652c1bede58d4b86eea80af5adf2256N.exe	82
PID 968 wrote to memory of 3356	968	65db7d20290c4e60a0f788e9193928018652c1bede58d4b86eea80af5adf2256N.exe	82
PID 3356 wrote to memory of 2056	3356	Unicorn-27540.exe	83
PID 3356 wrote to memory of 2056	3356	Unicorn-27540.exe	83
PID 3356 wrote to memory of 2056	3356	Unicorn-27540.exe	83
PID 968 wrote to memory of 3480	968	65db7d20290c4e60a0f788e9193928018652c1bede58d4b86eea80af5adf2256N.exe	84
PID 968 wrote to memory of 3480	968	65db7d20290c4e60a0f788e9193928018652c1bede58d4b86eea80af5adf2256N.exe	84
PID 968 wrote to memory of 3480	968	65db7d20290c4e60a0f788e9193928018652c1bede58d4b86eea80af5adf2256N.exe	84
PID 3480 wrote to memory of 3284	3480	Unicorn-30170.exe	89
PID 3480 wrote to memory of 3284	3480	Unicorn-30170.exe	89
PID 3480 wrote to memory of 3284	3480	Unicorn-30170.exe	89
PID 968 wrote to memory of 3440	968	65db7d20290c4e60a0f788e9193928018652c1bede58d4b86eea80af5adf2256N.exe	90
PID 968 wrote to memory of 3440	968	65db7d20290c4e60a0f788e9193928018652c1bede58d4b86eea80af5adf2256N.exe	90
PID 968 wrote to memory of 3440	968	65db7d20290c4e60a0f788e9193928018652c1bede58d4b86eea80af5adf2256N.exe	90
PID 3356 wrote to memory of 4540	3356	Unicorn-27540.exe	91
PID 3356 wrote to memory of 4540	3356	Unicorn-27540.exe	91
PID 3356 wrote to memory of 4540	3356	Unicorn-27540.exe	91
PID 2056 wrote to memory of 4512	2056	Unicorn-50036.exe	92
PID 2056 wrote to memory of 4512	2056	Unicorn-50036.exe	92
PID 2056 wrote to memory of 4512	2056	Unicorn-50036.exe	92
PID 3284 wrote to memory of 1996	3284	Unicorn-43980.exe	94
PID 3284 wrote to memory of 1996	3284	Unicorn-43980.exe	94
PID 3284 wrote to memory of 1996	3284	Unicorn-43980.exe	94
PID 3480 wrote to memory of 3328	3480	Unicorn-30170.exe	95
PID 3480 wrote to memory of 3328	3480	Unicorn-30170.exe	95
PID 3480 wrote to memory of 3328	3480	Unicorn-30170.exe	95
PID 3356 wrote to memory of 4100	3356	Unicorn-27540.exe	97
PID 3356 wrote to memory of 4100	3356	Unicorn-27540.exe	97
PID 3356 wrote to memory of 4100	3356	Unicorn-27540.exe	97
PID 4540 wrote to memory of 1204	4540	Unicorn-56979.exe	96
PID 4540 wrote to memory of 1204	4540	Unicorn-56979.exe	96
PID 4540 wrote to memory of 1204	4540	Unicorn-56979.exe	96
PID 3440 wrote to memory of 2568	3440	Unicorn-46018.exe	99
PID 3440 wrote to memory of 2568	3440	Unicorn-46018.exe	99
PID 3440 wrote to memory of 2568	3440	Unicorn-46018.exe	99
PID 4512 wrote to memory of 5044	4512	Unicorn-11307.exe	98
PID 4512 wrote to memory of 5044	4512	Unicorn-11307.exe	98
PID 4512 wrote to memory of 5044	4512	Unicorn-11307.exe	98
PID 968 wrote to memory of 4220	968	65db7d20290c4e60a0f788e9193928018652c1bede58d4b86eea80af5adf2256N.exe	100
PID 968 wrote to memory of 4220	968	65db7d20290c4e60a0f788e9193928018652c1bede58d4b86eea80af5adf2256N.exe	100
PID 968 wrote to memory of 4220	968	65db7d20290c4e60a0f788e9193928018652c1bede58d4b86eea80af5adf2256N.exe	100
PID 2056 wrote to memory of 2948	2056	Unicorn-50036.exe	101
PID 2056 wrote to memory of 2948	2056	Unicorn-50036.exe	101
PID 2056 wrote to memory of 2948	2056	Unicorn-50036.exe	101
PID 1996 wrote to memory of 4592	1996	Unicorn-2667.exe	104
PID 1996 wrote to memory of 4592	1996	Unicorn-2667.exe	104
PID 1996 wrote to memory of 4592	1996	Unicorn-2667.exe	104
PID 3328 wrote to memory of 4548	3328	Unicorn-56507.exe	105
PID 3328 wrote to memory of 4548	3328	Unicorn-56507.exe	105
PID 3328 wrote to memory of 4548	3328	Unicorn-56507.exe	105
PID 3284 wrote to memory of 3840	3284	Unicorn-43980.exe	106
PID 3284 wrote to memory of 3840	3284	Unicorn-43980.exe	106
PID 3284 wrote to memory of 3840	3284	Unicorn-43980.exe	106
PID 3480 wrote to memory of 4828	3480	Unicorn-30170.exe	107
PID 3480 wrote to memory of 4828	3480	Unicorn-30170.exe	107
PID 3480 wrote to memory of 4828	3480	Unicorn-30170.exe	107
PID 4100 wrote to memory of 1312	4100	Unicorn-37186.exe	108
PID 4100 wrote to memory of 1312	4100	Unicorn-37186.exe	108
PID 4100 wrote to memory of 1312	4100	Unicorn-37186.exe	108
PID 3356 wrote to memory of 1568	3356	Unicorn-27540.exe	109
PID 3356 wrote to memory of 1568	3356	Unicorn-27540.exe	109
PID 3356 wrote to memory of 1568	3356	Unicorn-27540.exe	109
PID 2948 wrote to memory of 1624	2948	Unicorn-11198.exe	110

C:\Users\Admin\AppData\Local\Temp\65db7d20290c4e60a0f788e9193928018652c1bede58d4b86eea80af5adf2256N.exe
"C:\Users\Admin\AppData\Local\Temp\65db7d20290c4e60a0f788e9193928018652c1bede58d4b86eea80af5adf2256N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:968
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27540.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27540.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3356
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50036.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50036.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11307.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11307.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18812.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37378.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62768.exe
        7⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1715.exe
        8⤵
        
        PID:7412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36573.exe
        9⤵
        
        PID:12168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25459.exe
        9⤵
        
        PID:15740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43847.exe
        8⤵
        
        PID:12264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-799.exe
        8⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8242.exe
        7⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26854.exe
        8⤵
        
        PID:3984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60452.exe
        8⤵
        
        PID:18616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8487.exe
        7⤵
        
        PID:12432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45882.exe
        7⤵
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5922.exe
        6⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64673.exe
        7⤵
        
        PID:5256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23205.exe
        8⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54631.exe
        9⤵
        
        PID:1644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6811.exe
        8⤵
        
        PID:11080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4942.exe
        8⤵
        
        PID:15272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55929.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55929.exe
        8⤵
        
        PID:15644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34387.exe
        7⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40849.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46071.exe
        8⤵
        
        PID:16020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58839.exe
        7⤵
        
        PID:12144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33630.exe
        7⤵
        
        PID:14484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13427.exe
        6⤵
        
        PID:6836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31425.exe
        7⤵
        
        PID:8400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63080.exe
        7⤵
        
        PID:11940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9514.exe
        7⤵
        
        PID:14524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49459.exe
        6⤵
        
        PID:9604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25372.exe
        6⤵
        
        PID:15392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43242.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37303.exe
        6⤵
        
        PID:4780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22909.exe
        7⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2592.exe
        8⤵
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35509.exe
        9⤵
        
        PID:8744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34299.exe
        9⤵
        
        PID:14172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58907.exe
        9⤵
        
        PID:14544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47232.exe
        9⤵
        
        PID:3544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25658.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:3424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62539.exe
        8⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18212.exe
        8⤵
        
        PID:5388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50568.exe
        7⤵
        
        PID:7968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26348.exe
        8⤵
        
        PID:16368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46203.exe
        7⤵
        
        PID:10696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
        7⤵
        
        PID:14932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14194.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6396.exe
        7⤵
        
        PID:8164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5415.exe
        7⤵
        
        PID:11440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62311.exe
        7⤵
        
        PID:15228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59245.exe
        7⤵
        
        PID:5012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39956.exe
        6⤵
        
        PID:8872
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26978.exe
        6⤵
        
        PID:13284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48715.exe
        6⤵
        
        PID:16344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36483.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49769.exe
        6⤵
        
        PID:4588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38005.exe
        7⤵
        
        PID:6360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42503.exe
        8⤵
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        8⤵
        
        PID:14160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
        8⤵
        
        PID:17536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26359.exe
        7⤵
        
        PID:9404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10990.exe
        7⤵
        
        PID:14560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1876.exe
        7⤵
        
        PID:1436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40671.exe
        6⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43485.exe
        7⤵
        
        PID:8252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5519.exe
        7⤵
        
        PID:13432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17682.exe
        7⤵
        
        PID:13716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47791.exe
        6⤵
        
        PID:10504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39475.exe
        6⤵
        
        PID:18892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16447.exe
        5⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64429.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54631.exe
        7⤵
        
        PID:3160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60096.exe
        6⤵
        
        PID:11008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18212.exe
        6⤵
        
        PID:15708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-398.exe
        5⤵
        
        PID:4568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39503.exe
        5⤵
        
        PID:12108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41708.exe
        5⤵
        
        PID:6040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22076.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24188.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14792.exe
        7⤵
        
        PID:3192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43905.exe
        8⤵
        
        PID:5420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56261.exe
        9⤵
        
        PID:7688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11020.exe
        10⤵
        
        PID:11896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17867.exe
        10⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15555.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14512.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:4340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18243.exe
        8⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58839.exe
        8⤵
        
        PID:12160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45882.exe
        8⤵
        
        PID:4624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24963.exe
        7⤵
        
        PID:5352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43345.exe
        8⤵
        
        PID:8292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54631.exe
        9⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5415.exe
        8⤵
        
        PID:11384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10319.exe
        8⤵
        
        PID:14740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8072.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8072.exe
        8⤵
        
        PID:3824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43603.exe
        7⤵
        
        PID:9052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55680.exe
        7⤵
        
        PID:10992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33630.exe
        7⤵
        
        PID:2856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33987.exe
        6⤵
        
        PID:3256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7252.exe
        7⤵
        
        PID:5808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3708.exe
        8⤵
        
        PID:11784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe
        8⤵
        
        PID:8812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18679.exe
        7⤵
        
        PID:10836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52078.exe
        7⤵
        
        PID:17428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32170.exe
        6⤵
        
        PID:7768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38095.exe
        7⤵
        
        PID:16060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3251.exe
        6⤵
        
        PID:12128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56883.exe
        6⤵
        
        PID:5600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28442.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65337.exe
        6⤵
        
        PID:4640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22415.exe
        7⤵
        
        PID:7120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23065.exe
        8⤵
        
        PID:9476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60148.exe
        8⤵
        
        PID:14412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10858.exe
        8⤵
        
        PID:15292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17682.exe
        8⤵
        
        PID:15852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19586.exe
        7⤵
        
        PID:10032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24403.exe
        7⤵
        
        PID:9184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exe
        6⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47548.exe
        7⤵
        
        PID:9924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44631.exe
        7⤵
        
        PID:16296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49031.exe
        6⤵
        
        PID:9908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33864.exe
        6⤵
        
        PID:13376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17019.exe
        6⤵
        
        PID:14316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55892.exe
        5⤵
        
        PID:5316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26219.exe
        6⤵
        
        PID:7272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47896.exe
        6⤵
        
        PID:13216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36271.exe
        6⤵
        
        PID:16108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58727.exe
        5⤵
        
        PID:7504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28403.exe
        5⤵
        
        PID:11376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29648.exe
        5⤵
        
        PID:16084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7777.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7777.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54865.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49769.exe
        6⤵
        
        PID:3324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13116.exe
        7⤵
        
        PID:6416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13988.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29727.exe
        8⤵
        
        PID:11484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18212.exe
        8⤵
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20250.exe
        7⤵
        
        PID:10052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53900.exe
        7⤵
        
        PID:14128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56107.exe
        7⤵
        
        PID:13984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40786.exe
        7⤵
        
        PID:17696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20443.exe
        6⤵
        
        PID:6780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18701.exe
        7⤵
        
        PID:11092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14611.exe
        7⤵
        
        PID:1924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31671.exe
        7⤵
        
        PID:18524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24246.exe
        6⤵
        
        PID:10736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59675.exe
        7⤵
        
        PID:14372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
        7⤵
        
        PID:2284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44492.exe
        6⤵
        
        PID:14736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
        6⤵
        
        PID:1232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5015.exe
        5⤵
        
        PID:5292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46941.exe
        6⤵
        
        PID:6668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19417.exe
        7⤵
        
        PID:8848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46796.exe
        7⤵
        
        PID:12420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1147.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26359.exe
        6⤵
        
        PID:9396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        6⤵
        
        PID:14092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21567.exe
        6⤵
        
        PID:16120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43115.exe
        5⤵
        
        PID:7596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3184.exe
        6⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41095.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64232.exe
        6⤵
        
        PID:14428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17682.exe
        6⤵
        
        PID:5472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42364.exe
        5⤵
        
        PID:10768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32495.exe
        5⤵
        
        PID:16996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42348.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42348.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11476.exe
        5⤵
        
        PID:4692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38005.exe
        6⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33833.exe
        7⤵
        
        PID:7260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47969.exe
        8⤵
        
        PID:12060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
        8⤵
        
        PID:17524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42363.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39017.exe
        7⤵
        
        PID:12672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28523.exe
        6⤵
        
        PID:400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27573.exe
        7⤵
        
        PID:16728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38231.exe
        7⤵
        
        PID:18860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50007.exe
        6⤵
        
        PID:11960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45882.exe
        6⤵
        
        PID:2912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40671.exe
        5⤵
        
        PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32414.exe
        5⤵
        
        PID:10820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50943.exe
        5⤵
        
        PID:2748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7782.exe
      4⤵
      PID:5204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13116.exe
        5⤵
        
        PID:6400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46085.exe
        6⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43973.exe
        7⤵
        
        PID:11400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15327.exe
        7⤵
        
        PID:15184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26035.exe
        7⤵
        
        PID:13684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34003.exe
        6⤵
        
        PID:11308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52791.exe
        6⤵
        
        PID:14484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24642.exe
        6⤵
        
        PID:5676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28523.exe
        5⤵
        
        PID:8972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50007.exe
        5⤵
        
        PID:11992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18212.exe
        5⤵
        
        PID:2012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18735.exe
      4⤵
      PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
        5⤵
        
        PID:9952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6582.exe
        6⤵
        
        PID:16304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26707.exe
        5⤵
        
        PID:14748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10044.exe
        5⤵
        
        PID:16336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30145.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30145.exe
      4⤵
      PID:10792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4587.exe
      4⤵
      PID:14932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32660.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32660.exe
      4⤵
      PID:15260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49208.exe
      4⤵
      PID:15180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20408.exe
      4⤵
      PID:15420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56979.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56979.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4540
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43316.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43316.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13907.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27888.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52701.exe
        7⤵
        
        PID:876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64673.exe
        8⤵
        
        PID:5980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34217.exe
        9⤵
        
        PID:7976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32593.exe
        10⤵
        
        PID:13476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64492.exe
        10⤵
        
        PID:14644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10474.exe
        10⤵
        
        PID:16748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33862.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33862.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17102.exe
        9⤵
        
        PID:15900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16131.exe
        8⤵
        
        PID:9292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23208.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59364.exe
        7⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47621.exe
        8⤵
        
        PID:9120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1871.exe
        8⤵
        
        PID:12496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11486.exe
        8⤵
        
        PID:14552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe
        8⤵
        
        PID:15880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54895.exe
        7⤵
        
        PID:8220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59188.exe
        7⤵
        
        PID:12712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10503.exe
        7⤵
        
        PID:18992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9099.exe
        6⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10184.exe
        7⤵
        
        PID:1520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55945.exe
        8⤵
        
        PID:8968
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 8968 -s 492
        9⤵
        Program crash
        
        PID:2984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24642.exe
        8⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21995.exe
        7⤵
        
        PID:10328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1375.exe
        7⤵
        
        PID:18696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14526.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14526.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40761.exe
        7⤵
        
        PID:13380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55591.exe
        7⤵
        
        PID:14708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45251.exe
        7⤵
        
        PID:17704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35348.exe
        6⤵
        
        PID:11476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11767.exe
        6⤵
        
        PID:15580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57223.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7584.exe
        6⤵
        
        PID:5052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28685.exe
        7⤵
        
        PID:768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34527.exe
        7⤵
        
        PID:9276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        7⤵
        
        PID:14108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59728.exe
        7⤵
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50348.exe
        7⤵
        
        PID:15312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11123.exe
        6⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60235.exe
        6⤵
        
        PID:10252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50943.exe
        6⤵
        
        PID:2152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47723.exe
        5⤵
        
        PID:3228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30605.exe
        6⤵
        
        PID:6744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42503.exe
        7⤵
        
        PID:9596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        7⤵
        
        PID:14304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1147.exe
        7⤵
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26359.exe
        6⤵
        
        PID:9380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        6⤵
        
        PID:14080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5140.exe
        6⤵
        
        PID:17496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53064.exe
        5⤵
        
        PID:7560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35509.exe
        6⤵
        
        PID:8612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34299.exe
        6⤵
        
        PID:14188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
        6⤵
        
        PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4342.exe
        5⤵
        
        PID:10404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12927.exe
        5⤵
        
        PID:3452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59282.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59282.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28389.exe
        5⤵
        
        PID:3672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61741.exe
        6⤵
        
        PID:6124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43921.exe
        7⤵
        
        PID:8924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46499.exe
        7⤵
        
        PID:13548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10319.exe
        7⤵
        
        PID:14496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2644.exe
        7⤵
        
        PID:6060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26359.exe
        6⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47152.exe
        7⤵
        
        PID:12656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        6⤵
        
        PID:14044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35032.exe
        6⤵
        
        PID:14348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50348.exe
        6⤵
        
        PID:2968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44180.exe
        5⤵
        
        PID:6164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2696.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2696.exe
        6⤵
        
        PID:8804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55348.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17867.exe
        6⤵
        
        PID:8636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42259.exe
        5⤵
        
        PID:8948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55872.exe
        5⤵
        
        PID:11920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49966.exe
        5⤵
        
        PID:732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53588.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53588.exe
      4⤵
      PID:3080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55109.exe
        5⤵
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47761.exe
        6⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63080.exe
        6⤵
        
        PID:13400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17682.exe
        6⤵
        
        PID:5412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8783.exe
        5⤵
        
        PID:9040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39475.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39475.exe
        5⤵
        
        PID:18936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48483.exe
      4⤵
      PID:7572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30375.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30375.exe
      4⤵
      PID:9536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58236.exe
      4⤵
      PID:13712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37186.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37186.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24816.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24188.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55825.exe
        6⤵
        
        PID:404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28301.exe
        7⤵
        
        PID:5496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6588.exe
        8⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18207.exe
        8⤵
        
        PID:12460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40075.exe
        8⤵
        
        PID:2164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41795.exe
        8⤵
        
        PID:1576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50480.exe
        7⤵
        
        PID:9708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        7⤵
        
        PID:14072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46263.exe
        7⤵
        
        PID:13188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exe
        6⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25821.exe
        7⤵
        
        PID:12508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
        7⤵
        
        PID:3748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22518.exe
        6⤵
        
        PID:9284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25964.exe
        6⤵
        
        PID:9436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40811.exe
        5⤵
        
        PID:3268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45213.exe
        6⤵
        
        PID:3000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58721.exe
        7⤵
        
        PID:7512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35577.exe
        8⤵
        
        PID:15240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50355.exe
        8⤵
        
        PID:16972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4455.exe
        7⤵
        
        PID:12068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8058.exe
        7⤵
        
        PID:14464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1876.exe
        7⤵
        
        PID:2684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4211.exe
        6⤵
        
        PID:8748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37947.exe
        6⤵
        
        PID:13248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1876.exe
        6⤵
        
        PID:4304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-354.exe
        5⤵
        
        PID:6328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53013.exe
        6⤵
        
        PID:13416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64492.exe
        6⤵
        
        PID:14288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51315.exe
        6⤵
        
        PID:17220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25452.exe
        5⤵
        
        PID:6448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48831.exe
        5⤵
        
        PID:2744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16190.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11668.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11196.exe
        6⤵
        
        PID:5608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34217.exe
        7⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46115.exe
        7⤵
        
        PID:11912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9811.exe
        7⤵
        
        PID:18544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20250.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53900.exe
        6⤵
        
        PID:12860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34741.exe
        6⤵
        
        PID:15240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56157.exe
        5⤵
        
        PID:7080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14948.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55348.exe
        6⤵
        
        PID:12360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1147.exe
        6⤵
        
        PID:5188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60323.exe
        5⤵
        
        PID:9556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28533.exe
        6⤵
        
        PID:17204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62452.exe
        5⤵
        
        PID:13488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2822.exe
        5⤵
        
        PID:14644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18212.exe
        5⤵
        
        PID:16444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10582.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10582.exe
      4⤵
      PID:5236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13116.exe
        5⤵
        
        PID:6408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10864.exe
        6⤵
        
        PID:9028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18207.exe
        6⤵
        
        PID:12452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58708.exe
        6⤵
        
        PID:15376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46588.exe
        5⤵
        
        PID:9568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        5⤵
        
        PID:14296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37903.exe
        5⤵
        
        PID:16224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43936.exe
      4⤵
      PID:6280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29033.exe
        5⤵
        
        PID:10104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47335.exe
        5⤵
        
        PID:19032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9194.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9194.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:10884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46875.exe
      4⤵
      PID:14644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17780.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17780.exe
      4⤵
      PID:14612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4130.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4130.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48692.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48692.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55825.exe
        5⤵
        
        PID:2924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46837.exe
        6⤵
        
        PID:2608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30029.exe
        7⤵
        
        PID:7160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29801.exe
        8⤵
        
        PID:9676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34210.exe
        9⤵
        
        PID:16240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24642.exe
        8⤵
        
        PID:17584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1051.exe
        7⤵
        
        PID:12300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56883.exe
        7⤵
        
        PID:15860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53884.exe
        6⤵
        
        PID:7580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29290.exe
        6⤵
        
        PID:8800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19794.exe
        7⤵
        
        PID:14584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45075.exe
        7⤵
        
        PID:18932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58518.exe
        6⤵
        
        PID:16172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3043.exe
        5⤵
        
        PID:5812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19313.exe
        6⤵
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18701.exe
        7⤵
        
        PID:10940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46071.exe
        7⤵
        
        PID:15676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
        6⤵
        
        PID:11148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24642.exe
        6⤵
        
        PID:5672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28415.exe
        6⤵
        
        PID:10716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3198.exe
        5⤵
        
        PID:6844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63296.exe
        6⤵
        
        PID:1004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64704.exe
        5⤵
        
        PID:12080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34516.exe
        5⤵
        
        PID:8464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56851.exe
      4⤵
      PID:5260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64429.exe
        5⤵
        
        PID:7528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35509.exe
        6⤵
        
        PID:8864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9795.exe
        6⤵
        
        PID:13760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54631.exe
        6⤵
        
        PID:14136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58944.exe
        5⤵
        
        PID:10416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13402.exe
        5⤵
        
        PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9063.exe
      4⤵
      PID:6600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31273.exe
        5⤵
        
        PID:16800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19474.exe
      4⤵
      PID:11924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36387.exe
      4⤵
      PID:16216
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43462.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43462.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24113.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24113.exe
      4⤵
      PID:2800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64673.exe
        5⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24823.exe
        6⤵
        
        PID:8392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16182.exe
        6⤵
        
        PID:13164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62712.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62712.exe
        6⤵
        
        PID:18684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28907.exe
        5⤵
        
        PID:8264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49239.exe
        5⤵
        
        PID:12736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5960.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5960.exe
        5⤵
        
        PID:3340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59364.exe
      4⤵
      PID:6864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9603.exe
        5⤵
        
        PID:14280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62607.exe
        5⤵
        
        PID:16472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52259.exe
      4⤵
      PID:9576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46768.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46768.exe
      4⤵
      PID:10124
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6623.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6623.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41513.exe
      4⤵
      PID:6548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39837.exe
        5⤵
        
        PID:8916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46499.exe
        5⤵
        
        PID:13572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14403.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14403.exe
        5⤵
        
        PID:14544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50621.exe
        5⤵
        
        PID:10464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26359.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26359.exe
      4⤵
      PID:9412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
      4⤵
      PID:14260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43443.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43443.exe
      4⤵
      PID:18980
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36761.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36761.exe
    3⤵
    PID:7532
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25910.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25910.exe
    3⤵
    PID:8880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54631.exe
      4⤵
      PID:4044
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55483.exe
    3⤵
    PID:5576
- C:\Users\Admin\AppData\Local\Temp\Unicorn-30170.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-30170.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43980.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43980.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2667.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2667.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33368.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23228.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42997.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29925.exe
        8⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19313.exe
        9⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34823.exe
        9⤵
        
        PID:10976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43463.exe
        9⤵
        
        PID:15336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45882.exe
        9⤵
        
        PID:4184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5502.exe
        8⤵
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38768.exe
        8⤵
        
        PID:12784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-902.exe
        8⤵
        
        PID:3400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13210.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13210.exe
        8⤵
        
        PID:444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30671.exe
        7⤵
        
        PID:5612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52369.exe
        8⤵
        
        PID:6764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63796.exe
        8⤵
        
        PID:10876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43620.exe
        8⤵
        
        PID:11744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49966.exe
        8⤵
        
        PID:1216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11750.exe
        7⤵
        
        PID:8016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24056.exe
        7⤵
        
        PID:12016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61160.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61160.exe
        7⤵
        
        PID:16432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2327.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50537.exe
        7⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43625.exe
        8⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42821.exe
        9⤵
        
        PID:10700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18212.exe
        9⤵
        
        PID:5384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5851.exe
        8⤵
        
        PID:10452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45882.exe
        8⤵
        
        PID:1340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26063.exe
        7⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60221.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9514.exe
        8⤵
        
        PID:15812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37843.exe
        7⤵
        
        PID:11356
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46743.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52575.exe
        6⤵
        
        PID:5644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40117.exe
        7⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42695.exe
        7⤵
        
        PID:11816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17486.exe
        7⤵
        
        PID:13660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38036.exe
        6⤵
        
        PID:7764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
        7⤵
        
        PID:816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15390.exe
        6⤵
        
        PID:12136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24327.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60731.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9940.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50537.exe
        7⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60153.exe
        8⤵
        
        PID:7348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11736.exe
        9⤵
        
        PID:9524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:1652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56064.exe
        9⤵
        
        PID:14376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62141.exe
        9⤵
        
        PID:18948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22763.exe
        8⤵
        
        PID:10760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62219.exe
        8⤵
        
        PID:5564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60044.exe
        7⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47739.exe
        7⤵
        
        PID:11412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43672.exe
        7⤵
        
        PID:15008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52273.exe
        7⤵
        
        PID:14932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46650.exe
        7⤵
        
        PID:6068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9867.exe
        6⤵
        
        PID:5788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55877.exe
        7⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
        8⤵
        
        PID:15280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1051.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1051.exe
        7⤵
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56883.exe
        7⤵
        
        PID:5448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39799.exe
        6⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46768.exe
        7⤵
        
        PID:15756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15119.exe
        6⤵
        
        PID:11420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        6⤵
        
        PID:3896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54355.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50345.exe
        6⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7252.exe
        7⤵
        
        PID:6108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16323.exe
        8⤵
        
        PID:10132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62887.exe
        8⤵
        
        PID:4008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58788.exe
        8⤵
        
        PID:15296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11196.exe
        8⤵
        
        PID:15748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18679.exe
        7⤵
        
        PID:10848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25078.exe
        7⤵
        
        PID:14496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18435.exe
        6⤵
        
        PID:7520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60465.exe
        7⤵
        
        PID:14840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62799.exe
        7⤵
        
        PID:3664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18190.exe
        6⤵
        
        PID:11976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        6⤵
        
        PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62332.exe
        5⤵
        
        PID:5880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22519.exe
        6⤵
        
        PID:7952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18190.exe
        6⤵
        
        PID:11964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53875.exe
        5⤵
        
        PID:7464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17682.exe
        6⤵
        
        PID:16284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56224.exe
        5⤵
        
        PID:11900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33348.exe
        5⤵
        
        PID:16380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46367.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46367.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23036.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7008.exe
        6⤵
        Executes dropped EXE
        
        PID:1180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50729.exe
        7⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31949.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6427.exe
        8⤵
        
        PID:10904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        8⤵
        
        PID:15836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63552.exe
        7⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43812.exe
        7⤵
        
        PID:13180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33630.exe
        7⤵
        
        PID:4216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20879.exe
        6⤵
        
        PID:6184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14564.exe
        7⤵
        
        PID:7420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37755.exe
        7⤵
        
        PID:10804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22031.exe
        7⤵
        
        PID:1884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55161.exe
        7⤵
        
        PID:2788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2570.exe
        6⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55872.exe
        6⤵
        
        PID:11776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53183.exe
        6⤵
        
        PID:16100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15539.exe
        5⤵
        
        PID:1052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15472.exe
        6⤵
        
        PID:5400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43817.exe
        7⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47761.exe
        8⤵
        
        PID:4920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34299.exe
        8⤵
        
        PID:13856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62600.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62600.exe
        8⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9446.exe
        7⤵
        
        PID:10632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65244.exe
        7⤵
        
        PID:15332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40339.exe
        7⤵
        
        PID:15340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41606.exe
        7⤵
        
        PID:15636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6183.exe
        6⤵
        
        PID:8152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28242.exe
        7⤵
        
        PID:6288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33438.exe
        7⤵
        
        PID:16268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53603.exe
        6⤵
        
        PID:10336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13402.exe
        6⤵
        
        PID:5340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7562.exe
        5⤵
        
        PID:6828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11736.exe
        6⤵
        
        PID:9856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60148.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9514.exe
        6⤵
        
        PID:15844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58124.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23208.exe
        5⤵
        
        PID:16132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29157.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29157.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23345.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25457.exe
        6⤵
        
        PID:5904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64237.exe
        7⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35509.exe
        8⤵
        
        PID:8832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34299.exe
        8⤵
        
        PID:14136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38102.exe
        8⤵
        
        PID:16248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9446.exe
        7⤵
        
        PID:9272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21186.exe
        7⤵
        
        PID:16208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47792.exe
        6⤵
        
        PID:6880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43620.exe
        6⤵
        
        PID:13308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13627.exe
        6⤵
        
        PID:18664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26203.exe
        5⤵
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64237.exe
        6⤵
        
        PID:8036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7771.exe
        6⤵
        
        PID:11432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2630.exe
        6⤵
        
        PID:4696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18212.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8242.exe
        5⤵
        
        PID:8228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53013.exe
        6⤵
        
        PID:13392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9514.exe
        6⤵
        
        PID:2508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8487.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3983.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55560.exe
      4⤵
      PID:4644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23101.exe
        5⤵
        
        PID:5444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48285.exe
        6⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37201.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37201.exe
        7⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38633.exe
        7⤵
        
        PID:16260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18679.exe
        6⤵
        
        PID:10856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50112.exe
        7⤵
        
        PID:15548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62219.exe
        6⤵
        
        PID:5508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42939.exe
        5⤵
        
        PID:7452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62923.exe
        5⤵
        
        PID:12028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41798.exe
        5⤵
        
        PID:16180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35898.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35898.exe
      4⤵
      PID:6152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56941.exe
        5⤵
        
        PID:6720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56692.exe
        5⤵
        
        PID:11888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58900.exe
        5⤵
        
        PID:16092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49924.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49924.exe
      4⤵
      PID:9972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe
        5⤵
        
        PID:5024
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25729.exe
      4⤵
      PID:13332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47358.exe
      4⤵
      PID:14636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65360.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56507.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56507.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53980.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53980.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64260.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23537.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23537.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29733.exe
        7⤵
        
        PID:5780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19313.exe
        8⤵
        
        PID:7200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19277.exe
        9⤵
        
        PID:11548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64336.exe
        9⤵
        
        PID:15192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1147.exe
        9⤵
        
        PID:13700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26655.exe
        8⤵
        
        PID:10952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17102.exe
        8⤵
        
        PID:3584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55000.exe
        7⤵
        
        PID:6192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40849.exe
        8⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60070.exe
        8⤵
        
        PID:18604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58839.exe
        7⤵
        
        PID:12152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13627.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13627.exe
        7⤵
        
        PID:18672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42731.exe
        6⤵
        
        PID:5868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9416.exe
        7⤵
        
        PID:7064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47761.exe
        8⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63080.exe
        8⤵
        
        PID:14292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46263.exe
        8⤵
        
        PID:14164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38523.exe
        7⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25990.exe
        7⤵
        
        PID:15160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        7⤵
        
        PID:9212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5974.exe
        6⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15104.exe
        7⤵
        
        PID:13268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64492.exe
        7⤵
        
        PID:3336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47231.exe
        7⤵
        
        PID:16356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35156.exe
        6⤵
        
        PID:10096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59675.exe
        7⤵
        
        PID:440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16207.exe
        7⤵
        
        PID:15704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65244.exe
        6⤵
        
        PID:15400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11839.exe
        5⤵
        
        PID:568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39053.exe
        6⤵
        
        PID:6088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19313.exe
        7⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26655.exe
        7⤵
        
        PID:10944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17102.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55000.exe
        6⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11020.exe
        7⤵
        
        PID:11840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe
        7⤵
        
        PID:15796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58839.exe
        6⤵
        
        PID:12120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21570.exe
        6⤵
        
        PID:13680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57811.exe
        5⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27865.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
        7⤵
        
        PID:3248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47076.exe
        6⤵
        
        PID:10920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56676.exe
        6⤵
        
        PID:13512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17102.exe
        6⤵
        
        PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
        5⤵
        
        PID:7960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60029.exe
        6⤵
        
        PID:13296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25850.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25850.exe
        6⤵
        
        PID:16400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15390.exe
        5⤵
        
        PID:12036
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12075.exe
        5⤵
        
        PID:15368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19506.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7008.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39053.exe
        6⤵
        
        PID:6080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57392.exe
        7⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64756.exe
        8⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54434.exe
        8⤵
        
        PID:15480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25206.exe
        7⤵
        
        PID:8652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19307.exe
        7⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28854.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15104.exe
        7⤵
        
        PID:11944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52791.exe
        7⤵
        
        PID:14580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63137.exe
        7⤵
        
        PID:16484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25016.exe
        6⤵
        
        PID:11448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34826.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26971.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7252.exe
        6⤵
        
        PID:3580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35509.exe
        7⤵
        
        PID:8304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34299.exe
        7⤵
        
        PID:14116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37253.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37253.exe
        7⤵
        
        PID:19008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9446.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9446.exe
        6⤵
        
        PID:10352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39396.exe
        6⤵
        
        PID:15216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24642.exe
        6⤵
        
        PID:17576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64844.exe
        5⤵
        
        PID:7364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50523.exe
        5⤵
        
        PID:12704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32379.exe
        5⤵
        
        PID:4384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8662.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8662.exe
      4⤵
      PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24217.exe
        5⤵
        
        PID:5148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51985.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1980.exe
        7⤵
        
        PID:11100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe
        7⤵
        
        PID:15820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22571.exe
        6⤵
        
        PID:11012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23007.exe
        6⤵
        
        PID:18376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42939.exe
        5⤵
        
        PID:7436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22274.exe
        5⤵
        
        PID:11952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33630.exe
        5⤵
        
        PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38508.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38508.exe
      4⤵
      PID:6724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33117.exe
        5⤵
        
        PID:10152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14471.exe
        5⤵
        
        PID:18912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23802.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23802.exe
      4⤵
      PID:9048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57136.exe
        5⤵
        
        PID:19040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45984.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45984.exe
      4⤵
      PID:4352
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30937.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30937.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48884.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31705.exe
        5⤵
        
        PID:784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39053.exe
        6⤵
        
        PID:2208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48285.exe
        7⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42695.exe
        7⤵
        
        PID:11824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14011.exe
        7⤵
        
        PID:18488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18435.exe
        6⤵
        
        PID:8096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18190.exe
        6⤵
        
        PID:11984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12667.exe
        6⤵
        
        PID:18452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60220.exe
        5⤵
        
        PID:5060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48285.exe
        6⤵
        
        PID:2140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64881.exe
        7⤵
        
        PID:13604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17867.exe
        7⤵
        
        PID:5304
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18679.exe
        6⤵
        
        PID:11168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52078.exe
        6⤵
        
        PID:17444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56675.exe
        5⤵
        
        PID:7492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3251.exe
        5⤵
        
        PID:12048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27207.exe
        5⤵
        
        PID:18408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60464.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60464.exe
      4⤵
      PID:4732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26417.exe
        5⤵
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54533.exe
        6⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38139.exe
        7⤵
        
        PID:10480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8856.exe
        8⤵
        
        PID:9728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29062.exe
        7⤵
        
        PID:15168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28342.exe
        7⤵
        
        PID:18396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5851.exe
        6⤵
        
        PID:964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        6⤵
        
        PID:13676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28854.exe
        5⤵
        
        PID:8272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25016.exe
        5⤵
        
        PID:11368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5854.exe
        5⤵
        
        PID:13424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50575.exe
        5⤵
        
        PID:18760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8418.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8418.exe
      4⤵
      PID:1776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31565.exe
        5⤵
        
        PID:7328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3708.exe
        6⤵
        
        PID:11804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11295.exe
        6⤵
        
        PID:14540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50348.exe
        6⤵
        
        PID:4856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34823.exe
        5⤵
        
        PID:10984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17102.exe
        5⤵
        
        PID:5924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54180.exe
      4⤵
      PID:7300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53729.exe
        5⤵
        
        PID:10656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34741.exe
        5⤵
        
        PID:15892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32110.exe
      4⤵
      PID:11636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40471.exe
      4⤵
      PID:16200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24115.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24115.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39873.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39873.exe
      4⤵
      PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39053.exe
        5⤵
        
        PID:6096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51705.exe
        6⤵
        
        PID:9164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9550.exe
        6⤵
        
        PID:13736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39727.exe
        6⤵
        
        PID:17560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29291.exe
        5⤵
        
        PID:9248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        5⤵
        
        PID:14152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37714.exe
        5⤵
        
        PID:14344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63971.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63971.exe
      4⤵
      PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33833.exe
        5⤵
        
        PID:7796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40761.exe
        6⤵
        
        PID:13408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe
        6⤵
        
        PID:3708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30111.exe
        5⤵
        
        PID:12236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52078.exe
        5⤵
        
        PID:17436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48124.exe
      4⤵
      PID:8932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6366.exe
      4⤵
      PID:12012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16235.exe
      4⤵
      PID:12652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26474.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26474.exe
    3⤵
    PID:2060
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12903.exe
      4⤵
      PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35753.exe
        5⤵
        
        PID:8908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46499.exe
        5⤵
        
        PID:13564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35207.exe
        5⤵
        
        PID:7356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48353.exe
        5⤵
        
        PID:18836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40095.exe
      4⤵
      PID:9372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23208.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23208.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54620.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54620.exe
    3⤵
    PID:4704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55789.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55789.exe
      4⤵
      PID:9096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14123.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1147.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1147.exe
      4⤵
      PID:5568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58053.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58053.exe
    3⤵
    PID:9580
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28702.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28702.exe
    3⤵
    PID:14320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43184.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43184.exe
    3⤵
    PID:4464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46018.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46018.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18812.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18812.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54940.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5664.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44341.exe
        6⤵
        
        PID:4908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38005.exe
        7⤵
        
        PID:6296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49453.exe
        8⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26707.exe
        8⤵
        
        PID:14740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34933.exe
        8⤵
        
        PID:14744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20459.exe
        7⤵
        
        PID:9452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62799.exe
        8⤵
        
        PID:2160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45783.exe
        7⤵
        
        PID:16500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24335.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30185.exe
        7⤵
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58788.exe
        7⤵
        
        PID:14504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60013.exe
        7⤵
        
        PID:15148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32414.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32414.exe
        6⤵
        
        PID:10808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11767.exe
        6⤵
        
        PID:15572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25138.exe
        5⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45161.exe
        6⤵
        
        PID:7672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21331.exe
        7⤵
        
        PID:16392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15555.exe
        6⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
        7⤵
        
        PID:1212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12826.exe
        6⤵
        
        PID:15768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14107.exe
        5⤵
        
        PID:8196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44939.exe
        5⤵
        
        PID:10844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48987.exe
        5⤵
        
        PID:14480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8967.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8967.exe
        5⤵
        
        PID:8828
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22747.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
        5⤵
        
        PID:5140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1824.exe
        6⤵
        
        PID:6636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17999.exe
        7⤵
        
        PID:9628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        7⤵
        
        PID:14204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24404.exe
        7⤵
        
        PID:14288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17102.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17102.exe
        7⤵
        
        PID:15804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26359.exe
        6⤵
        
        PID:9420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52503.exe
        6⤵
        
        PID:14100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59728.exe
        6⤵
        
        PID:15328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1147.exe
        6⤵
        
        PID:5380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32938.exe
        5⤵
        
        PID:8256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37009.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37009.exe
        6⤵
        
        PID:7340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63137.exe
        6⤵
        
        PID:16492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59468.exe
        5⤵
        
        PID:10688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40136.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40136.exe
        5⤵
        
        PID:18904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59783.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59783.exe
      4⤵
      PID:5332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38005.exe
        5⤵
        
        PID:6312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18997.exe
        6⤵
        
        PID:13336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17867.exe
        6⤵
        
        PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20459.exe
        5⤵
        
        PID:9448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8346.exe
        5⤵
        
        PID:14404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1147.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43936.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43936.exe
      4⤵
      PID:324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43779.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4759.exe
      4⤵
      PID:16068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47327.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47327.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13832.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13832.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49769.exe
        5⤵
        
        PID:4616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29379.exe
        6⤵
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60029.exe
        7⤵
        
        PID:13264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36293.exe
        7⤵
        
        PID:18652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29290.exe
        6⤵
        
        PID:9668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14011.exe
        6⤵
        
        PID:18496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53359.exe
        5⤵
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48037.exe
        6⤵
        
        PID:15252
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15252 -s 80
        7⤵
        Program crash
        
        PID:4524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62144.exe
        6⤵
        
        PID:15608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25016.exe
        5⤵
        
        PID:11392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45729.exe
        5⤵
        
        PID:4000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17486.exe
        5⤵
        
        PID:9204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25138.exe
      4⤵
      PID:5876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31949.exe
        5⤵
        
        PID:6620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33885.exe
        6⤵
        
        PID:9880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24642.exe
        6⤵
        
        PID:5664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63115.exe
        5⤵
        
        PID:11760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45882.exe
        5⤵
        
        PID:448
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42120.exe
      4⤵
      PID:7980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43035.exe
        5⤵
        
        PID:7552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29543.exe
        5⤵
        
        PID:2528
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15390.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15390.exe
      4⤵
      PID:11664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44747.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44747.exe
      4⤵
      PID:16276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48735.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48735.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33433.exe
      4⤵
      PID:5152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40745.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47621.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57431.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57431.exe
        7⤵
        
        PID:15488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26183.exe
        6⤵
        
        PID:12584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21567.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46396.exe
        5⤵
        
        PID:9796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        5⤵
        
        PID:14212
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 14212 -s 444
        6⤵
        Program crash
        
        PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59728.exe
        5⤵
        
        PID:2920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45075.exe
        5⤵
        
        PID:18924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47880.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47880.exe
      4⤵
      PID:6560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51705.exe
        5⤵
        
        PID:9140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9550.exe
        5⤵
        
        PID:13728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46173.exe
        5⤵
        
        PID:5688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6846.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58368.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58368.exe
      4⤵
      PID:14272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13018.exe
      4⤵
      PID:6024
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-111.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-111.exe
    3⤵
    PID:5344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19313.exe
      4⤵
      PID:7212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49977.exe
        5⤵
        
        PID:12248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21375.exe
        5⤵
        
        PID:16984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50863.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50863.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33471.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33471.exe
      4⤵
      PID:18464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-398.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-398.exe
    3⤵
    PID:8188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27357.exe
      4⤵
      PID:10304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe
      4⤵
      PID:604
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39503.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39503.exe
    3⤵
    PID:12096
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17012.exe
    3⤵
    PID:3344
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18546.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18546.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4220
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37378.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37378.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51741.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51741.exe
      4⤵
      PID:4600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56157.exe
        5⤵
        
        PID:7088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41285.exe
        6⤵
        
        PID:10048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7542.exe
        7⤵
        
        PID:15528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24642.exe
        6⤵
        
        PID:17592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11418.exe
        5⤵
        
        PID:9904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33147.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exe
      4⤵
      PID:6688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28353.exe
        5⤵
        
        PID:8580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20127.exe
        5⤵
        
        PID:13192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50156.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50156.exe
        5⤵
        
        PID:16232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3722.exe
      4⤵
      PID:9984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33864.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33864.exe
      4⤵
      PID:13428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1876.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1876.exe
      4⤵
      PID:64
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58631.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58631.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7112.exe
      4⤵
      PID:5660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46469.exe
        5⤵
        
        PID:7936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47969.exe
        6⤵
        
        PID:13108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10858.exe
        6⤵
        
        PID:1888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59483.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8539.exe
        5⤵
        
        PID:11932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36894.exe
        5⤵
        
        PID:17476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4211.exe
      4⤵
      PID:8792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53899.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53899.exe
      4⤵
      PID:11768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52037.exe
      4⤵
      PID:15724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42016.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42016.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27341.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2306.exe
        5⤵
        
        PID:13240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64492.exe
        5⤵
        
        PID:14848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62343.exe
        5⤵
        
        PID:10612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63080.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63080.exe
      4⤵
      PID:13316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56544.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56544.exe
      4⤵
      PID:16316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16786.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16786.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37624.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37624.exe
    3⤵
    PID:15384
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54178.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54178.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2332
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1580.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1580.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11476.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11476.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64673.exe
        5⤵
        
        PID:5764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55789.exe
        6⤵
        
        PID:9080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7948.exe
        7⤵
        
        PID:14276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44404.exe
        7⤵
        
        PID:14288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36899.exe
        7⤵
        
        PID:15296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10011.exe
        7⤵
        
        PID:13516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5955.exe
        6⤵
        
        PID:12476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe
        6⤵
        
        PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38227.exe
        5⤵
        
        PID:9756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
        5⤵
        
        PID:14056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50348.exe
        5⤵
        
        PID:4344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59364.exe
      4⤵
      PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33973.exe
        5⤵
        
        PID:9508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58516.exe
        6⤵
        
        PID:15828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42851.exe
        5⤵
        
        PID:14176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45443.exe
        5⤵
        
        PID:17464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17858.exe
      4⤵
      PID:9552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14211.exe
      4⤵
      PID:14360
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43251.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43251.exe
      4⤵
      PID:10284
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62384.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62384.exe
    3⤵
    PID:5276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38005.exe
      4⤵
      PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46085.exe
        5⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58715.exe
        6⤵
        
        PID:16076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50340.exe
        5⤵
        
        PID:10876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37807.exe
        5⤵
        
        PID:14744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35207.exe
        5⤵
        
        PID:2656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1036.exe
        5⤵
        
        PID:19204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28523.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28523.exe
      4⤵
      PID:8960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29778.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29778.exe
      4⤵
      PID:13096
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8058.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8058.exe
      4⤵
      PID:15252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18212.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18212.exe
      4⤵
      PID:16452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38071.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38071.exe
    3⤵
    PID:6196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54631.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54631.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13420
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38280.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38280.exe
    3⤵
    PID:10828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19730.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19730.exe
    3⤵
    PID:15160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11883.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11883.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:15648
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29399.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29399.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2588
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57937.exe
    3⤵
    PID:5132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38005.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38005.exe
      4⤵
      PID:6320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6588.exe
        5⤵
        
        PID:9008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46499.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62219.exe
        5⤵
        
        PID:15352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50480.exe
      4⤵
      PID:9716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56587.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46263.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46263.exe
      4⤵
      PID:3548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28086.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28086.exe
    3⤵
    PID:7780
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1346.exe
      4⤵
      PID:3608
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24056.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24056.exe
    3⤵
    PID:12004
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36463.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36463.exe
    3⤵
    PID:880
- C:\Users\Admin\AppData\Local\Temp\Unicorn-61597.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-61597.exe
  2⤵
  PID:5308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34689.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34689.exe
    3⤵
    PID:6888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52857.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52857.exe
      4⤵
      PID:8368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24211.exe
      4⤵
      PID:11128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16723.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16723.exe
      4⤵
      PID:14276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54903.exe
      4⤵
      PID:14292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2299.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2299.exe
      4⤵
      PID:16464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55524.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55524.exe
    3⤵
    PID:9956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27998.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27998.exe
    3⤵
    PID:13460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62252.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62252.exe
    3⤵
    PID:10188
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19314.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19314.exe
  2⤵
  PID:7540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48161.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48161.exe
    3⤵
    PID:13200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57424.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57424.exe
    3⤵
    PID:14488
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14095.exe
    3⤵
    PID:4708
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20575.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20575.exe
  2⤵
  PID:7408
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14643.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14643.exe
  2⤵
  PID:1000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 8968 -ip 8968
1⤵
PID:4884

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:15540

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
- Suspicious behavior: AddClipboardFormatListener
PID:16700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11198.exe

Filesize
468KB

MD5
c93f3994a8aa1834626bb1fda524edd3

SHA1
3aadcabcdd866a1b2f2f32f86695f304663f0ddb

SHA256
80d8355993a89c3591a358ce704c7aee41d79163b079b1ba897e956bac49ee74

SHA512
be8be26ac203885b4f03650a1ca98096c378bdd061247b088f5253413cd9bd91e69f55ab0ddf7ed9522bf8c627a0f2080a56de40aae2a2785c28995182a09a5f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11307.exe

Filesize
468KB

MD5
305276bb73336dc54b77b25bde9a000a

SHA1
7b81c0de6029695b9a899b41e6eccadcbe1521c4

SHA256
7bf90c9b4e697a4df8536fb89f8cb088596a11139d3c8405e030e8b191162eb1

SHA512
9cc7c3df12ac7c808ec3e71fafc76a09ae223a5fde579367a7aaa047fd6b8d8ea562185503da1949a6ac7e7b5df1c2157022a000852d188eb86bbb8a17470ec2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13907.exe

Filesize
468KB

MD5
fee8c425959061eeb9281f40b47b99d9

SHA1
ac6f5d474853c9647aa2014dac30d34a55526a87

SHA256
03b8101a59f094ee38d7a808dadc3a45f607876a6e3fbde968251fa3af8ac5aa

SHA512
7145fb7d44d57ba9599b0655b46a2babd625568f6c497f6c793d78115171b6719c4c30cfede419368447e14cab357ff98ec3baf6f78946f87c95c07d7e251141

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18546.exe

Filesize
468KB

MD5
76631348ac3fda587d93126f09216ac6

SHA1
bc6538f5099a1812f0e1cf2f8932b91a16029069

SHA256
a3c190dc91a5b1382bd68b7ba4fafb27927a590418db79be23d7a3e2bf728702

SHA512
8db5fac2abb37d7fbc06fd0aaf89e6a404ee2add1b1ed3f2d7a5ad626f33724ca4c503ce1591225003c1e6b86bea33f143eb48da7d19cdb551e6728ba7e755ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18812.exe

Filesize
468KB

MD5
b28445992d53ad31b41f02ff11e3de3e

SHA1
ef01695dee0f753255c17ab7bae66c073846960b

SHA256
c0b25983e6c3d1fe9a8237a79e1354d18262a8ed6970e665c0b16a62f12255c3

SHA512
66befd9c6f2ec9d01af9af96c098b9b2e63817720e2966a23abe2a2b22c626ceac7a99d20eeedb771a04936a179fa17906586f3a5e718d67c3a8f5640b85b09f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22076.exe

Filesize
468KB

MD5
626570b5ec0ff19e81afc1e080e043e1

SHA1
85f338fd76a86eea82e5128e19154f18d559ee7d

SHA256
242c638c6fefa7ee0b56573a3acbdab9c9879e98dee7b53e53c9a2a52852078c

SHA512
524bdd5edb108814d4ecf7d46016382cf417f513edc27656a9e9230137591a405601556537ec938d4ea8e48f7eb5b7fc9d6c52cdd2f4f3a4e48165820a1bd204

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23228.exe

Filesize
468KB

MD5
554af0f4e19b6bd787d19d02cc202962

SHA1
d230de8ca30de7286f8e24d30c35f52c8a945713

SHA256
2fb9d76ae4a8c4c5fd1d395e640f9282d4265cfbe7bb9fe41439fa82e7dbc174

SHA512
977eb0848cf7843855f055e69f7e6f568370509566e068187a31a58fcfc030e290b71f187a37e8355bdc1333c7cb962f343c1a710f3aec76dead8fdf7c9c98ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-24816.exe

Filesize
468KB

MD5
565be34dfadfb83b95c5f3480b71cfe6

SHA1
8578197927ebf3e556edc25ecfd073d004f2ac95

SHA256
63299f1ac42f0e2ab6ba57383ed8ec80c0f34af0652a1b58d42b0c0a0ad58213

SHA512
654389a36c7733812e0b4a8a757be6b4827eac9dacab3ac540f1d888bfee3658c8b803ae8d233f8030b2e7551a837e66465f08f6819eeaac3ca32195f5476b98

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2667.exe

Filesize
468KB

MD5
188b9664b79c50cd1f3eff831a7706db

SHA1
5e836e974ea26376fd1a795f724373eebdb43a22

SHA256
5c71fc5abba2689b04f6cf42cf90c22b8a41512b800520f3b72ba89ead135cc4

SHA512
70b579948c76b965234c8a6ae3abb22ef489025ec9e5133ef5b9a51628b9381ab06c563f53aff8da12c4d079dd8868d518ef1d7daaf3e54dfbf6256ab470e027

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27540.exe

Filesize
468KB

MD5
f3ab162639fb6064239ef8f79374bc4f

SHA1
569c22687f61d8ce8fed2d3ff46b2d27ce57df16

SHA256
8fc6375dcb7b166f0ce675d507c38b559af94cfd332e23598d8d5bec502518da

SHA512
4b19491c8ca5b85fa3078f5f9160b04e083ccf0f1c08141a4854ef90965a85684d31e86866790c9d3bd8cbf6ad632cc4417af1760dc033236aadd180dc1500e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30170.exe

Filesize
468KB

MD5
3de668d6c0a628cba899be8acf576b03

SHA1
8cf9b2fad37b65ccde91fcd4e4598c098c5eafe2

SHA256
397eba1b78f70b6a5951d45c6a86cbbcf770ee12fa5d4cdf211c1adff0cd072b

SHA512
34665c2f2b6b03e95c7831d6114465bd2b9962913c733fc35d1851d806098f5ad79c0b4e06fa623fc008bad13d8102098f460ef14a20e1d4750e373660149f84

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30937.exe

Filesize
468KB

MD5
afdcb9d10170aa147e5c689376e575ae

SHA1
28e18f2d97eb37efd00bf903ed99fb85daf791b2

SHA256
fc6fe58fa701f978d39d7644b0b863c574b6429b0d484c6243972afc691dcd34

SHA512
66721c71e2b287e9bc942ba4efce3aa80ee051f70e152ca2a7fb2aecdcdb217f1e4bff5b4b80a6f71b32cc684b91a004c376970ca69fef4eadcf1656111f2a76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33368.exe

Filesize
468KB

MD5
77c421b9c2b7aeba2fa68ee7217b076b

SHA1
a2e91b6d61f392edb4763b1b6245afc1af5f182e

SHA256
dca0c93b5ce492df6919dc4b564b40a356351dc1f0f6ad78794ba4f820fcf418

SHA512
5a8fd5d164d31864cc92d9548228e35c6b5d287fde9796562ae940f9734f6d05119a192bbb7c5695f33c6a06c9af9fc8520e280f58d6c423f8c4871ee3f5c214

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-37186.exe

Filesize
468KB

MD5
7597541a437dac20001e690e16434e0c

SHA1
51c2abf9427414c1e19b662f2581cd9e31d6c157

SHA256
45c978ce6a8698a594a546f950aaeb2cb0194ffb09c746a98105fa05a5d54c05

SHA512
956314e6d7871a9e3a9fb5921f6b43582f1cc1cdde10d6e978887a255351b5a892863a5902befb9eb594de378b88c537aca5909771621adb7101f9a4d8be8efc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38005.exe

Filesize
468KB

MD5
55f82f456fda6d137c37cccab61f8602

SHA1
c3447987ccd8c94cfd680ee5a046deb5d0426840

SHA256
cfb779b2df7cd3e0a555aeefe52d7feb0553fbf59294c97d808f962f48be6e43

SHA512
f5fef947fcaeba265f741ea87009444b129ad2be74195f494590b586b014a51addda14a647ba86454ea79ced04e403e2ca5625cf51645c49c69c578460188c79

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4130.exe

Filesize
468KB

MD5
0a6ef53c2ae5199fa39744000a408f48

SHA1
5ecfad5999e68f15e54520a1c710a3dfe06756b7

SHA256
33b8adef65ac1c9b3d186786413c81334fbd11fe6c4d7eb59119e01cc111a69c

SHA512
ea5d9b7334ff52e9e659695e22f96d6a16428651862980fa48b42bfc6480d596452499c092f624b2f940c6fda5f04f0e6290acfbf63903156000d1122a7900ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43242.exe

Filesize
468KB

MD5
be916c2746b7f18f7fc89b17897e8e31

SHA1
8b2628e82e3f6cd928c55796ac04f2fd1b676040

SHA256
2ad776eb2a23e89b2f87dcb07ea88eac6f1cb3268c33fe3b99f5cbc1559d1c22

SHA512
6778f3da05319a6d17f3eabf2636462cb6313e177a58f1ea3c1c98589a071f8f44fb02ebee4c0e368150ba89d56cd23f0a559218bc6378d425b100db8abcd058

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43316.exe

Filesize
468KB

MD5
b07d058973ab751c0f952af4bf6e6d46

SHA1
0add4db40155c468bc3a50f3a74d7d3fecdcc411

SHA256
68db585f4b28efd77bbe649f427fac3c4d286c45f7b55272263ebcfcbdcc1e4a

SHA512
f9d0252b6d98ad0858c81c1b72985bb17badfcc99f5aad2502a93d65530f047668b5a1a4ffe08fd9b16260412b8cc4bff0a85992977747f9fbf2e97642d45765

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43980.exe

Filesize
468KB

MD5
45f942fc3214b84c9a089095e27ca234

SHA1
7bacf9d6b8233d83534923dbfa2ec36bed38ac10

SHA256
f2368bc287ae2a8359d674a8b33434eeb34940904d41c28e2c9f5ce25a2bb8c3

SHA512
2906a120632bdd14352310bdfd1e7b7c54f1c04c7b66bc8016f3060f0cdb3aecdb49215044dd3a060199e8678ea8b33f8e85084d1fa6463329ace25645509d32

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46018.exe

Filesize
468KB

MD5
1d81a8a6704108b059406c1dea8e6bd5

SHA1
0f3996bfcb079d125ce7a09dd9118bc4df5aee6b

SHA256
24cdd240825a0ea65b929d45f1efb51449000f0b77fdf806afb931e106edefac

SHA512
b27df609e8a4f540c658d6e5708ffa9fb135ba3c971cfdd987fbc30912107cc928dc9558e93bf3ad4b0d64ef2fe75a53d4cc61c78a273c99ed3cc0737392f18e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46367.exe

Filesize
468KB

MD5
5eec0e010fcbdf16aed60914df0a8416

SHA1
45c998418f8aeb1b09c0a842dc51bf56e93d1852

SHA256
07a61d2646f9cc695a16e393b26bd82984dfffcaf0d7451bb473a7a289a2baad

SHA512
74f9f2d0e4fc1feffa96faf78d83f38d9faa296b1857e86a751babbf423e7233b11efeb1d94b4d7e9526f4c5424a24c12a8cbf8332eb0e509a1c0c971d0091ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47327.exe

Filesize
468KB

MD5
d8668cb324980657214acf42a50cad7c

SHA1
777642cfff8191821c69f0783854ee3e910c461d

SHA256
464dbf1b9468ece15f5931149877ea963c034cac21fa8e705785d60edadf6b4d

SHA512
bba70a99671dc3018cc443e03012f8f44638ba57bfc3aef63997d162b16531110839041c67657b02f7a832e4ef1e3de5f1b06118037735ac348c8274283b8b78

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50036.exe

Filesize
468KB

MD5
8f8b0272cc782eaa20b6d05c616ace56

SHA1
849ebcac8d6ff20205d303d97abf13cd10875afc

SHA256
95368f1cdd5912bd0bd96731d969763ab712a497f566a9dc65014a33301d0082

SHA512
275a844d1305f5d37f731e0f31d5dc69f3e8ea6f5ae310cb8c9f9ea22d6f4084111ff25184eb8b8c7e528fe8c1003814609731a35e7f3c5d42ce058c49d7bd2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53980.exe

Filesize
468KB

MD5
761b9dbcfcd30023e6d4c1d588d6aa97

SHA1
67a04721072c93e13454953f3f00dd306f919c16

SHA256
c2080ad720740cec91a973ae8850832be12037706e925b0fd69df34f7666d4a7

SHA512
0ef7bcc32dc30a4c71085fddd1405a45754c5557c712d5929eb2854626ad22e9aa28003251704ea5f82f7371abd1fdc6a0a3795a7cf29a878e3ed2052430a105

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54178.exe

Filesize
468KB

MD5
83953a3a2c3174ef388d41b423458177

SHA1
85af23f60c0b32e6fb21170385ef4cc1bff591d6

SHA256
9a087b7bc4e34c51f9c350d1f1d559d13369b2dcf7dd0b4cd9b597f9a3cf856a

SHA512
6e4bb4959c121738469ab20481a9b07cc6d5a406e3f361b29c90b63dd4040ade4e651ca737cb1a7a71aa0cbc01f6ce8b985538bcc81d65a4ce1387f6b19be5c6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54940.exe

Filesize
468KB

MD5
1b6ddb44cc7f564eb43c3d1d440dc654

SHA1
9d81a246cc362509526e985e819f03fc489b07d0

SHA256
1f39561a05b67ca1ed0b3451166a2021b5610c68b9ecb25be2baee56706a24a2

SHA512
5bab2995f4f0fe0b148dd7631fc00265f24939bf90c76f01ed1daf5a6005060a677076a671145ea32db19ca9e46e5afc5c229290f7d7e6c8cc6aa466b0fc1349

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56507.exe

Filesize
468KB

MD5
2f25f6e319d8477842d59e5934a6be61

SHA1
62e5d1db14f293ab28eb7cb598fe590bcc15da34

SHA256
d630013e8612784d096c933ececad618ecb13bb3db847bfaab10346b36b3f5e9

SHA512
d4fa14df838da5e7425c8e8d02a4992c2a61b5e7cb4ceb120aa4f9b086cac836a89846bfcd6d576ae0b8a63d88a6c7d1b5e84f83166dfdcb9fc980d41881c626

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56979.exe

Filesize
468KB

MD5
4fe430d34ecc2f4d1af9dc19567bc285

SHA1
bbd41ee38130d578c77cd45f482ca5145321005e

SHA256
1c132350f231e4734ff96674fa6bd46ebd5de451d3e32b198b2ea7f30a637dd2

SHA512
abcf51fee3c52bb9febf1d82f9ae2a4bb937c79d93eaee0445970d32dfbfd840c4d8664c95eecf70949c7d482b5492e8e222cfc606382a4acbb5f58d2e157251

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60731.exe

Filesize
468KB

MD5
fb9aca8372029ef2ab5f8d86f63a012e

SHA1
db5926079c3fd461adad614626adf4e000be447e

SHA256
799b95e03672cb5e1b3e0f7bfb0ff6fb486f1af5d4a737506e8702da1bf81200

SHA512
96c8066baa819252c29f441d8c84c6f71bc85bd3f41eaf5fd64cd65d369cb55260a1c5922614111c346901a5b7a31b30ff576e6442e66aab7563d0a273111374

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64260.exe

Filesize
468KB

MD5
de0548dc1345a318ba8932d668a9c928

SHA1
51f687f512680a788747c1090dc16dc2db0dd882

SHA256
2202f104879e2b1bfb85f5c4ab6a7ccefe3dd8f0b94e664ef2752022e4b2a2b2

SHA512
d681ddc6629d8124e8dbac82088587f16cb5e20cdb6f7f7fb8225200b3498d57fbc34791c88d06cc92870a4f6a31c949e95f7262d76a9bff471cfa22b03624df

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7777.exe

Filesize
468KB

MD5
3186a47c23eb9d4f26c55ea0ad2cda85

SHA1
b950c3dd92c7f6f8ca410e39a534066a72cacb0d

SHA256
93ae37cfbb7d2096701263e68ad5bcd80c3902c9f3c1f148c7e8614030dffc46

SHA512
242224d27894ea1d8f8ad5cb5b33c6befdd26c46b0322410fe4ff03117c71f3f646fa8ae5defb5ac8cb29366795ff967e9bbc391da7ad5fe0b5d17085470c92c

Download Submit
memory/216-234-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/524-366-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/568-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/708-206-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/712-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/784-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/876-474-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/892-214-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/968-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1052-422-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1204-87-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1284-287-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1312-141-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1352-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1356-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1412-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1444-187-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1536-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1556-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1568-144-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1624-153-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1664-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1908-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1932-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1964-223-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1996-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2056-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2060-433-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2108-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2180-517-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2252-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2280-361-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2332-185-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2568-88-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2588-330-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2648-475-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2724-266-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2800-461-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2860-243-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2924-421-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2948-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3080-531-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3172-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3192-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3208-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3228-570-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3268-516-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3284-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3328-61-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3356-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3432-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3440-33-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3460-261-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3480-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3564-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3672-446-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3688-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3752-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3812-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3840-125-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4100-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4172-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4220-90-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4296-224-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4356-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4364-267-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4432-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4512-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4528-434-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4540-44-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4548-118-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4592-110-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4600-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4616-532-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4644-420-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4692-515-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4732-413-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4780-460-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4828-131-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4892-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4908-530-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5000-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5052-473-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5072-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5076-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5104-514-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5132-535-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5152-538-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5204-539-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5224-540-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5236-541-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5264-542-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5276-543-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5292-544-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5332-568-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5344-569-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13416-3436-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14260-2659-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/14288-2702-0x00007FFEEFF50000-0x00007FFEEFFA9000-memory.dmp

Filesize
356KB

Download
memory/15328-3186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads