46700f7fbefde5b9513df9fe145baac4b553911d5a1bfd75529f5daedfcf5124

Analysis

max time kernel
149s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 20:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46700f7fbefde5b9513df9fe145baac4b553911d5a1bfd75529f5daedfcf5124.exe
Size

468KB
MD5

b39e006102356758afef9e27515c1fc4
SHA1

4f58b47a25d0a601ce9da30580382de8cd1ec2b8
SHA256

46700f7fbefde5b9513df9fe145baac4b553911d5a1bfd75529f5daedfcf5124
SHA512

9f4295b3ff1e905388962f4c05ad56469cf05dc9c5cd7f8f9298c4ba11bc9fdb0d33ac466fb368d65efbebf9933427a79ca379b4fd6b46ad7f3495341d07eaa5
SSDEEP

3072:ibzXogIdIq5UnbYHPztjcG8/KCtvP3pkhmHewVhXSeP8mCuuGQlc:ib7owuUnoPJjcGcZ0OSeEVuuG

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3876	Unicorn-4893.exe
2316	Unicorn-16160.exe
4316	Unicorn-35188.exe
4832	Unicorn-23342.exe
920	Unicorn-52022.exe
1336	Unicorn-64374.exe
1324	Unicorn-9698.exe
3460	Unicorn-35340.exe
2664	Unicorn-19558.exe
3784	Unicorn-19004.exe
212	Unicorn-22823.exe
1676	Unicorn-61982.exe
2908	Unicorn-20950.exe
1680	Unicorn-14819.exe
1512	Unicorn-1084.exe
2628	Unicorn-10233.exe
4428	Unicorn-49128.exe
3696	Unicorn-29262.exe
512	Unicorn-32691.exe
2224	Unicorn-38822.exe
2868	Unicorn-27124.exe
4032	Unicorn-42144.exe
5008	Unicorn-51074.exe
2584	Unicorn-15998.exe
1580	Unicorn-33346.exe
884	Unicorn-47082.exe
3624	Unicorn-6704.exe
4824	Unicorn-42906.exe
2136	Unicorn-42906.exe
2940	Unicorn-8095.exe
2088	Unicorn-5163.exe
3340	Unicorn-59003.exe
1416	Unicorn-38582.exe
4800	Unicorn-62532.exe
2768	Unicorn-22054.exe
4992	Unicorn-46004.exe
5084	Unicorn-11861.exe
2848	Unicorn-28106.exe
1228	Unicorn-42304.exe
232	Unicorn-19746.exe
2780	Unicorn-2018.exe
4856	Unicorn-15753.exe
4916	Unicorn-36087.exe
1744	Unicorn-22460.exe
4720	Unicorn-15276.exe
4616	Unicorn-44826.exe
3428	Unicorn-48910.exe
4000	Unicorn-59216.exe
2660	Unicorn-32574.exe
2392	Unicorn-39350.exe
4384	Unicorn-48910.exe
1964	Unicorn-28490.exe
4224	Unicorn-36658.exe
1912	Unicorn-1582.exe
2176	Unicorn-1847.exe
4124	Unicorn-61717.exe
740	Unicorn-46507.exe
3140	Unicorn-40642.exe
1300	Unicorn-26906.exe
624	Unicorn-34904.exe
3540	Unicorn-26736.exe
3068	Unicorn-36226.exe
4780	Unicorn-47732.exe
1596	Unicorn-1224.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
16320	6572	WerFault.exe	257
17228	4448	WerFault.exe	776
14540	6796	WerFault.exe	848

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34206.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61818.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63391.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36226.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54530.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49001.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19405.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55497.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49128.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9459.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53406.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32041.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24461.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57133.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28291.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31972.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44462.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17409.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4893.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35269.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54127.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39047.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36957.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30340.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37418.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61004.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40642.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46016.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5804.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41107.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34317.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29941.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22167.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3557.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6183.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38263.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1777.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16682.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64513.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49236.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24916.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3666.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7122.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30569.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33703.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40428.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47259.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26716.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7641.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43456.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26801.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20262.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37865.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54050.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57942.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	3952	dwm.exe
Token: SeChangeNotifyPrivilege	3952	dwm.exe
Token: 33	3952	dwm.exe
Token: SeIncBasePriorityPrivilege	3952	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4952	46700f7fbefde5b9513df9fe145baac4b553911d5a1bfd75529f5daedfcf5124.exe
3876	Unicorn-4893.exe
4316	Unicorn-35188.exe
2316	Unicorn-16160.exe
4832	Unicorn-23342.exe
920	Unicorn-52022.exe
1336	Unicorn-64374.exe
1324	Unicorn-9698.exe
3460	Unicorn-35340.exe
2664	Unicorn-19558.exe
3784	Unicorn-19004.exe
212	Unicorn-22823.exe
1676	Unicorn-61982.exe
1680	Unicorn-14819.exe
2908	Unicorn-20950.exe
1512	Unicorn-1084.exe
2628	Unicorn-10233.exe
4428	Unicorn-49128.exe
3696	Unicorn-29262.exe
512	Unicorn-32691.exe
2940	Unicorn-8095.exe
4032	Unicorn-42144.exe
2868	Unicorn-27124.exe
2584	Unicorn-15998.exe
5008	Unicorn-51074.exe
3624	Unicorn-6704.exe
2136	Unicorn-42906.exe
4824	Unicorn-42906.exe
2224	Unicorn-38822.exe
1580	Unicorn-33346.exe
884	Unicorn-47082.exe
2088	Unicorn-5163.exe
3340	Unicorn-59003.exe
1416	Unicorn-38582.exe
4800	Unicorn-62532.exe
2768	Unicorn-22054.exe
4992	Unicorn-46004.exe
5084	Unicorn-11861.exe
2848	Unicorn-28106.exe
1228	Unicorn-42304.exe
232	Unicorn-19746.exe
2780	Unicorn-2018.exe
4856	Unicorn-15753.exe
4916	Unicorn-36087.exe
1744	Unicorn-22460.exe
4720	Unicorn-15276.exe
4616	Unicorn-44826.exe
3428	Unicorn-48910.exe
4000	Unicorn-59216.exe
1912	Unicorn-1582.exe
2660	Unicorn-32574.exe
1964	Unicorn-28490.exe
2392	Unicorn-39350.exe
4124	Unicorn-61717.exe
2176	Unicorn-1847.exe
4384	Unicorn-48910.exe
1300	Unicorn-26906.exe
740	Unicorn-46507.exe
4224	Unicorn-36658.exe
3140	Unicorn-40642.exe
624	Unicorn-34904.exe
3540	Unicorn-26736.exe
3068	Unicorn-36226.exe
2892	Unicorn-47732.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 3876	4952	46700f7fbefde5b9513df9fe145baac4b553911d5a1bfd75529f5daedfcf5124.exe	82
PID 4952 wrote to memory of 3876	4952	46700f7fbefde5b9513df9fe145baac4b553911d5a1bfd75529f5daedfcf5124.exe	82
PID 4952 wrote to memory of 3876	4952	46700f7fbefde5b9513df9fe145baac4b553911d5a1bfd75529f5daedfcf5124.exe	82
PID 3876 wrote to memory of 2316	3876	Unicorn-4893.exe	83
PID 3876 wrote to memory of 2316	3876	Unicorn-4893.exe	83
PID 3876 wrote to memory of 2316	3876	Unicorn-4893.exe	83
PID 4952 wrote to memory of 4316	4952	46700f7fbefde5b9513df9fe145baac4b553911d5a1bfd75529f5daedfcf5124.exe	84
PID 4952 wrote to memory of 4316	4952	46700f7fbefde5b9513df9fe145baac4b553911d5a1bfd75529f5daedfcf5124.exe	84
PID 4952 wrote to memory of 4316	4952	46700f7fbefde5b9513df9fe145baac4b553911d5a1bfd75529f5daedfcf5124.exe	84
PID 4316 wrote to memory of 4832	4316	Unicorn-35188.exe	85
PID 4316 wrote to memory of 4832	4316	Unicorn-35188.exe	85
PID 4316 wrote to memory of 4832	4316	Unicorn-35188.exe	85
PID 2316 wrote to memory of 1336	2316	Unicorn-16160.exe	87
PID 2316 wrote to memory of 1336	2316	Unicorn-16160.exe	87
PID 2316 wrote to memory of 1336	2316	Unicorn-16160.exe	87
PID 4952 wrote to memory of 920	4952	46700f7fbefde5b9513df9fe145baac4b553911d5a1bfd75529f5daedfcf5124.exe	86
PID 4952 wrote to memory of 920	4952	46700f7fbefde5b9513df9fe145baac4b553911d5a1bfd75529f5daedfcf5124.exe	86
PID 4952 wrote to memory of 920	4952	46700f7fbefde5b9513df9fe145baac4b553911d5a1bfd75529f5daedfcf5124.exe	86
PID 3876 wrote to memory of 1324	3876	Unicorn-4893.exe	88
PID 3876 wrote to memory of 1324	3876	Unicorn-4893.exe	88
PID 3876 wrote to memory of 1324	3876	Unicorn-4893.exe	88
PID 4832 wrote to memory of 3460	4832	Unicorn-23342.exe	91
PID 4832 wrote to memory of 3460	4832	Unicorn-23342.exe	91
PID 4832 wrote to memory of 3460	4832	Unicorn-23342.exe	91
PID 4316 wrote to memory of 2664	4316	Unicorn-35188.exe	92
PID 4316 wrote to memory of 2664	4316	Unicorn-35188.exe	92
PID 4316 wrote to memory of 2664	4316	Unicorn-35188.exe	92
PID 920 wrote to memory of 3784	920	Unicorn-52022.exe	93
PID 920 wrote to memory of 3784	920	Unicorn-52022.exe	93
PID 920 wrote to memory of 3784	920	Unicorn-52022.exe	93
PID 4952 wrote to memory of 212	4952	46700f7fbefde5b9513df9fe145baac4b553911d5a1bfd75529f5daedfcf5124.exe	94
PID 4952 wrote to memory of 212	4952	46700f7fbefde5b9513df9fe145baac4b553911d5a1bfd75529f5daedfcf5124.exe	94
PID 4952 wrote to memory of 212	4952	46700f7fbefde5b9513df9fe145baac4b553911d5a1bfd75529f5daedfcf5124.exe	94
PID 1336 wrote to memory of 1676	1336	Unicorn-64374.exe	95
PID 1336 wrote to memory of 1676	1336	Unicorn-64374.exe	95
PID 1336 wrote to memory of 1676	1336	Unicorn-64374.exe	95
PID 1324 wrote to memory of 2908	1324	Unicorn-9698.exe	97
PID 1324 wrote to memory of 2908	1324	Unicorn-9698.exe	97
PID 1324 wrote to memory of 2908	1324	Unicorn-9698.exe	97
PID 3876 wrote to memory of 1680	3876	Unicorn-4893.exe	98
PID 3876 wrote to memory of 1680	3876	Unicorn-4893.exe	98
PID 3876 wrote to memory of 1680	3876	Unicorn-4893.exe	98
PID 2316 wrote to memory of 1512	2316	Unicorn-16160.exe	96
PID 2316 wrote to memory of 1512	2316	Unicorn-16160.exe	96
PID 2316 wrote to memory of 1512	2316	Unicorn-16160.exe	96
PID 3460 wrote to memory of 2628	3460	Unicorn-35340.exe	102
PID 3460 wrote to memory of 2628	3460	Unicorn-35340.exe	102
PID 3460 wrote to memory of 2628	3460	Unicorn-35340.exe	102
PID 2664 wrote to memory of 4428	2664	Unicorn-19558.exe	103
PID 2664 wrote to memory of 4428	2664	Unicorn-19558.exe	103
PID 2664 wrote to memory of 4428	2664	Unicorn-19558.exe	103
PID 4832 wrote to memory of 3696	4832	Unicorn-23342.exe	104
PID 4832 wrote to memory of 3696	4832	Unicorn-23342.exe	104
PID 4832 wrote to memory of 3696	4832	Unicorn-23342.exe	104
PID 4316 wrote to memory of 512	4316	Unicorn-35188.exe	105
PID 4316 wrote to memory of 512	4316	Unicorn-35188.exe	105
PID 4316 wrote to memory of 512	4316	Unicorn-35188.exe	105
PID 3784 wrote to memory of 2224	3784	Unicorn-19004.exe	106
PID 3784 wrote to memory of 2224	3784	Unicorn-19004.exe	106
PID 3784 wrote to memory of 2224	3784	Unicorn-19004.exe	106
PID 920 wrote to memory of 2868	920	Unicorn-52022.exe	110
PID 920 wrote to memory of 2868	920	Unicorn-52022.exe	110
PID 920 wrote to memory of 2868	920	Unicorn-52022.exe	110
PID 4952 wrote to memory of 4032	4952	46700f7fbefde5b9513df9fe145baac4b553911d5a1bfd75529f5daedfcf5124.exe	111

C:\Users\Admin\AppData\Local\Temp\46700f7fbefde5b9513df9fe145baac4b553911d5a1bfd75529f5daedfcf5124.exe
"C:\Users\Admin\AppData\Local\Temp\46700f7fbefde5b9513df9fe145baac4b553911d5a1bfd75529f5daedfcf5124.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Users\Admin\AppData\Local\Temp\Unicorn-4893.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-4893.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3876
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16160.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16160.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64374.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61982.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59003.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34904.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1196.exe
        8⤵
        
        PID:5488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60796.exe
        9⤵
        
        PID:8440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29376.exe
        10⤵
        
        PID:388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39223.exe
        9⤵
        
        PID:10036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1291.exe
        9⤵
        
        PID:7516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11019.exe
        8⤵
        
        PID:6628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22694.exe
        8⤵
        
        PID:12060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7641.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22095.exe
        8⤵
        
        PID:1648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48020.exe
        7⤵
        
        PID:5408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38477.exe
        8⤵
        
        PID:7320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5820.exe
        9⤵
        
        PID:13044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43230.exe
        9⤵
        
        PID:11696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24335.exe
        8⤵
        
        PID:10924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57133.exe
        8⤵
        
        PID:1064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28291.exe
        8⤵
        
        PID:11420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8994.exe
        7⤵
        
        PID:8432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38674.exe
        7⤵
        
        PID:10572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64513.exe
        7⤵
        
        PID:14172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55145.exe
        7⤵
        
        PID:10060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23319.exe
        6⤵
        
        PID:2824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26534.exe
        7⤵
        
        PID:6464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-96.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-96.exe
        8⤵
        
        PID:8924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6183.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:13016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49322.exe
        8⤵
        
        PID:1420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36957.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23158.exe
        7⤵
        
        PID:9680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38307.exe
        7⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52545.exe
        7⤵
        
        PID:6684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3139.exe
        7⤵
        
        PID:17308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14143.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14143.exe
        6⤵
        
        PID:5540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61035.exe
        7⤵
        
        PID:8120
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35660.exe
        8⤵
        
        PID:17044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe
        7⤵
        
        PID:10864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1776.exe
        7⤵
        
        PID:4828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35421.exe
        7⤵
        
        PID:10012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24668.exe
        6⤵
        
        PID:8264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52368.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52368.exe
        6⤵
        
        PID:12128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34317.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24535.exe
        6⤵
        
        PID:7956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33346.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1847.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40091.exe
        7⤵
        
        PID:5556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        8⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4818.exe
        9⤵
        
        PID:8568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33655.exe
        9⤵
        
        PID:12216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12373.exe
        9⤵
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22375.exe
        9⤵
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9203.exe
        8⤵
        
        PID:8204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52783.exe
        8⤵
        
        PID:12812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3272.exe
        8⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10172.exe
        7⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34206.exe
        7⤵
        
        PID:11604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
        7⤵
        
        PID:14816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52545.exe
        7⤵
        
        PID:6656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52532.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:17016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36531.exe
        7⤵
        
        PID:8184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18305.exe
        7⤵
        
        PID:10932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7932.exe
        7⤵
        
        PID:15196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24207.exe
        7⤵
        
        PID:12420
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4910.exe
        6⤵
        
        PID:8344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16115.exe
        6⤵
        
        PID:12164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
        6⤵
        
        PID:15100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11206.exe
        6⤵
        
        PID:10084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47659.exe
        5⤵
        
        PID:3924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6022.exe
        6⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35177.exe
        7⤵
        
        PID:13400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25550.exe
        7⤵
        
        PID:7456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16682.exe
        6⤵
        
        PID:15308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32700.exe
        6⤵
        
        PID:16248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59697.exe
        5⤵
        
        PID:7272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41101.exe
        5⤵
        
        PID:11168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56299.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56299.exe
        5⤵
        
        PID:14360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29683.exe
        5⤵
        
        PID:9912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1084.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1084.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51074.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32574.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13256.exe
        7⤵
        
        PID:5584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32447.exe
        8⤵
        
        PID:7124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe
        8⤵
        
        PID:10804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3272.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3272.exe
        8⤵
        
        PID:1092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28291.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11019.exe
        7⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22694.exe
        7⤵
        
        PID:12052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7641.exe
        7⤵
        
        PID:14252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22095.exe
        7⤵
        
        PID:7524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60080.exe
        6⤵
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22525.exe
        7⤵
        
        PID:7888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39109.exe
        7⤵
        
        PID:11752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        7⤵
        
        PID:14364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24347.exe
        7⤵
        
        PID:9464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31900.exe
        6⤵
        
        PID:8732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28944.exe
        6⤵
        
        PID:11968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12664.exe
        6⤵
        
        PID:7520
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26906.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42854.exe
        6⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54455.exe
        7⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26801.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8959.exe
        8⤵
        
        PID:12036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        8⤵
        
        PID:15204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33283.exe
        8⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12327.exe
        7⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18994.exe
        7⤵
        
        PID:12856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65301.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20507.exe
        7⤵
        
        PID:16452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35741.exe
        6⤵
        
        PID:7020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33703.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16053.exe
        7⤵
        
        PID:12160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14397.exe
        7⤵
        
        PID:5196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18252.exe
        6⤵
        
        PID:10156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4953.exe
        6⤵
        
        PID:14088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30569.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27930.exe
        5⤵
        
        PID:5352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14574.exe
        6⤵
        
        PID:7076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24985.exe
        7⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14180.exe
        8⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32348.exe
        8⤵
        
        PID:10352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14543.exe
        7⤵
        
        PID:12484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-121.exe
        7⤵
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16344.exe
        7⤵
        
        PID:11152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        6⤵
        
        PID:9516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        6⤵
        
        PID:13588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33781.exe
        6⤵
        
        PID:6180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10715.exe
        6⤵
        
        PID:16760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36266.exe
        5⤵
        
        PID:8168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29240.exe
        5⤵
        
        PID:10944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47977.exe
        5⤵
        
        PID:14932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30602.exe
        5⤵
        
        PID:7732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47082.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47082.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48910.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20296.exe
        6⤵
        
        PID:5216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49001.exe
        7⤵
        
        PID:6504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27112.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27112.exe
        8⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        7⤵
        
        PID:9672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        7⤵
        
        PID:13572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26293.exe
        7⤵
        
        PID:10000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19405.exe
        6⤵
        
        PID:5248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52203.exe
        7⤵
        
        PID:9296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17257.exe
        7⤵
        
        PID:13316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26841.exe
        7⤵
        
        PID:11216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39057.exe
        6⤵
        
        PID:10332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21097.exe
        6⤵
        
        PID:12888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23963.exe
        6⤵
        
        PID:1148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35684.exe
        6⤵
        
        PID:11928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57942.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9888.exe
        6⤵
        
        PID:6748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe
        6⤵
        
        PID:10852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57133.exe
        6⤵
        
        PID:1096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17532.exe
        6⤵
        
        PID:17324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
        5⤵
        
        PID:8412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63562.exe
        5⤵
        
        PID:11372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54015.exe
        5⤵
        
        PID:15740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1284.exe
        5⤵
        
        PID:8580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46507.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46507.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exe
        5⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18659.exe
        6⤵
        
        PID:7100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48093.exe
        7⤵
        
        PID:11032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16053.exe
        7⤵
        
        PID:13504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29555.exe
        7⤵
        
        PID:10052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        6⤵
        
        PID:9532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20262.exe
        6⤵
        
        PID:7656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30671.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30671.exe
        5⤵
        
        PID:7604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50807.exe
        6⤵
        
        PID:11528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22851.exe
        6⤵
        
        PID:14856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39286.exe
        6⤵
        
        PID:7408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33794.exe
        5⤵
        
        PID:11112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        5⤵
        
        PID:13492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54000.exe
        5⤵
        
        PID:7544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51740.exe
      4⤵
      PID:6356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1056.exe
        5⤵
        
        PID:9312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17257.exe
        5⤵
        
        PID:13324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14397.exe
        5⤵
        
        PID:7564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29605.exe
      4⤵
      PID:8212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9330.exe
      4⤵
      PID:13384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16180.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16180.exe
      4⤵
      PID:11224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9698.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9698.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20950.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20950.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42906.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48910.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25701.exe
        7⤵
        
        PID:5468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6022.exe
        8⤵
        
        PID:6620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51575.exe
        9⤵
        
        PID:12016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49209.exe
        9⤵
        
        PID:15680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43344.exe
        9⤵
        
        PID:11836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        8⤵
        
        PID:9556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12598.exe
        8⤵
        
        PID:15300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41932.exe
        8⤵
        
        PID:9092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18035.exe
        7⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46749.exe
        8⤵
        
        PID:8684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48752.exe
        8⤵
        
        PID:14164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20349.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20349.exe
        8⤵
        
        PID:5372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60885.exe
        8⤵
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60437.exe
        7⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        7⤵
        
        PID:13480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56714.exe
        7⤵
        
        PID:6832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37713.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37713.exe
        6⤵
        
        PID:5392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1720.exe
        7⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49567.exe
        8⤵
        
        PID:13276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46931.exe
        8⤵
        
        PID:11048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47278.exe
        7⤵
        
        PID:11808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57133.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17409.exe
        7⤵
        
        PID:11348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
        6⤵
        
        PID:8368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12031.exe
        6⤵
        
        PID:12116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
        6⤵
        
        PID:15012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58461.exe
        6⤵
        
        PID:1204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39350.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exe
        6⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        7⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56863.exe
        8⤵
        
        PID:9752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12981.exe
        8⤵
        
        PID:13728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27417.exe
        8⤵
        
        PID:10636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        7⤵
        
        PID:9540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        7⤵
        
        PID:14100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65379.exe
        7⤵
        
        PID:16176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60822.exe
        6⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50158.exe
        6⤵
        
        PID:10280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        6⤵
        
        PID:13516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9182.exe
        6⤵
        
        PID:5884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8209.exe
        6⤵
        
        PID:12708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        5⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5804.exe
        6⤵
        
        PID:7008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe
        6⤵
        
        PID:10844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1776.exe
        6⤵
        
        PID:15236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30569.exe
        6⤵
        
        PID:8984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31814.exe
        5⤵
        
        PID:8668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57760.exe
        5⤵
        
        PID:13060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48422.exe
        5⤵
        
        PID:16336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61946.exe
        5⤵
        
        PID:12080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6704.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59216.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48308.exe
        6⤵
        
        PID:5176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6022.exe
        7⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        7⤵
        
        PID:9604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55032.exe
        8⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        7⤵
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14922.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14922.exe
        7⤵
        
        PID:6476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59428.exe
        7⤵
        
        PID:7672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65098.exe
        6⤵
        
        PID:6016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40428.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64513.exe
        6⤵
        
        PID:15172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58461.exe
        6⤵
        
        PID:1528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28393.exe
        5⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7584.exe
        6⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37683.exe
        7⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25103.exe
        7⤵
        
        PID:10168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18238.exe
        7⤵
        
        PID:1028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17409.exe
        7⤵
        
        PID:11380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-459.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-459.exe
        6⤵
        
        PID:8164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2658.exe
        6⤵
        
        PID:12968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60641.exe
        6⤵
        
        PID:16352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17409.exe
        6⤵
        
        PID:11332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2606.exe
        5⤵
        
        PID:6908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17393.exe
        6⤵
        
        PID:9232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19395.exe
        6⤵
        
        PID:13000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38902.exe
        6⤵
        
        PID:8272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38508.exe
        5⤵
        
        PID:9976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32468.exe
        5⤵
        
        PID:13948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64989.exe
        5⤵
        
        PID:6376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54094.exe
        5⤵
        
        PID:16800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40642.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1196.exe
        5⤵
        
        PID:5496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63391.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4901.exe
        7⤵
        
        PID:10400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54127.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23657.exe
        7⤵
        
        PID:8628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54704.exe
        6⤵
        
        PID:9428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48124.exe
        6⤵
        
        PID:13464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54384.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54384.exe
        6⤵
        
        PID:10420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19405.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39759.exe
        6⤵
        
        PID:9484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27371.exe
        6⤵
        
        PID:13524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48632.exe
        6⤵
        
        PID:7316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8389.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8389.exe
        6⤵
        
        PID:7688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59093.exe
        5⤵
        
        PID:10452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1829.exe
        5⤵
        
        PID:14860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3543.exe
        5⤵
        
        PID:6672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18938.exe
        5⤵
        
        PID:17100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57314.exe
      4⤵
      PID:5384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36531.exe
        5⤵
        
        PID:6272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62421.exe
        6⤵
        
        PID:12572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6614.exe
        6⤵
        
        PID:5020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18839.exe
        6⤵
        
        PID:12196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        5⤵
        
        PID:10928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18238.exe
        5⤵
        
        PID:4156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16039.exe
        5⤵
        
        PID:11284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28752.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28752.exe
      4⤵
      PID:8292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56452.exe
      4⤵
      PID:12148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65043.exe
      4⤵
      PID:1804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4717.exe
      4⤵
      PID:6088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2340.exe
      4⤵
      PID:13240
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14819.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14819.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1680
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8095.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28106.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43456.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43456.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22001.exe
        7⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24113.exe
        8⤵
        
        PID:7040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63303.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63303.exe
        9⤵
        
        PID:8500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46640.exe
        9⤵
        
        PID:13260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43100.exe
        9⤵
        
        PID:15724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42987.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42987.exe
        9⤵
        
        PID:12604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17947.exe
        8⤵
        
        PID:9388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        8⤵
        
        PID:13888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62063.exe
        8⤵
        
        PID:15992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2004.exe
        7⤵
        
        PID:2416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34206.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64513.exe
        7⤵
        
        PID:15180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58461.exe
        7⤵
        
        PID:8280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60080.exe
        6⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-350.exe
        7⤵
        
        PID:6556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47278.exe
        7⤵
        
        PID:11816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59271.exe
        7⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48621.exe
        6⤵
        
        PID:9076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62000.exe
        6⤵
        
        PID:12644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65373.exe
        6⤵
        
        PID:16368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21935.exe
        6⤵
        
        PID:14480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34472.exe
        5⤵
        
        PID:2624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56619.exe
        6⤵
        
        PID:6068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1720.exe
        7⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        7⤵
        
        PID:10600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1776.exe
        7⤵
        
        PID:15248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1596.exe
        7⤵
        
        PID:9164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17817.exe
        6⤵
        
        PID:8332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56126.exe
        6⤵
        
        PID:12192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33501.exe
        6⤵
        
        PID:15956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56105.exe
        6⤵
        
        PID:11924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        5⤵
        
        PID:5732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20771.exe
        6⤵
        
        PID:6984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63189.exe
        7⤵
        
        PID:13048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43064.exe
        7⤵
        
        PID:4332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8959.exe
        6⤵
        
        PID:12008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        6⤵
        
        PID:15188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18124.exe
        6⤵
        
        PID:9360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9369.exe
        5⤵
        
        PID:8988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55473.exe
        5⤵
        
        PID:12452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52288.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52288.exe
        5⤵
        
        PID:2396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29185.exe
        5⤵
        
        PID:14468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2018.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19336.exe
        5⤵
        
        PID:1000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49001.exe
        6⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23615.exe
        7⤵
        
        PID:9268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13173.exe
        7⤵
        
        PID:12496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31117.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31117.exe
        7⤵
        
        PID:6676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        6⤵
        
        PID:9564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        6⤵
        
        PID:13904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65109.exe
        6⤵
        
        PID:820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28483.exe
        6⤵
        
        PID:16600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58300.exe
        5⤵
        
        PID:3884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41679.exe
        6⤵
        
        PID:9416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16053.exe
        6⤵
        
        PID:13880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56198.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56198.exe
        6⤵
        
        PID:11184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40428.exe
        5⤵
        
        PID:11384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
        5⤵
        
        PID:14880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24916.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3653.exe
        5⤵
        
        PID:14460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15151.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15151.exe
      4⤵
      PID:4892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10132.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10132.exe
        5⤵
        
        PID:2648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40615.exe
        6⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44715.exe
        7⤵
        
        PID:13364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42462.exe
        7⤵
        
        PID:8448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe
        6⤵
        
        PID:10796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1776.exe
        6⤵
        
        PID:3980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18124.exe
        6⤵
        
        PID:8760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21901.exe
        5⤵
        
        PID:8360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32808.exe
        5⤵
        
        PID:10812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7641.exe
        5⤵
        
        PID:14200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49236.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35524.exe
      4⤵
      PID:6236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3796.exe
        5⤵
        
        PID:8840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2758.exe
        6⤵
        
        PID:12832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39670.exe
        6⤵
        
        PID:3636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43344.exe
        6⤵
        
        PID:3436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14543.exe
        5⤵
        
        PID:12468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53406.exe
        5⤵
        
        PID:4940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21990.exe
        5⤵
        
        PID:11164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24990.exe
      4⤵
      PID:8508
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13795.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13795.exe
      4⤵
      PID:13164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38884.exe
      4⤵
      PID:6772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-275.exe
      4⤵
      PID:16996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15998.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15998.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19746.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54338.exe
        5⤵
        
        PID:3388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29951.exe
        6⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47797.exe
        7⤵
        
        PID:8604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43962.exe
        7⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2067.exe
        7⤵
        
        PID:13920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49209.exe
        7⤵
        
        PID:10340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16795.exe
        6⤵
        
        PID:8612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60375.exe
        6⤵
        
        PID:13252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19608.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19608.exe
        6⤵
        
        PID:16312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59018.exe
        6⤵
        
        PID:11940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
        5⤵
        
        PID:5980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40428.exe
        5⤵
        
        PID:11504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64513.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37464.exe
        5⤵
        
        PID:7444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65199.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65199.exe
      4⤵
      PID:60
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32115.exe
        5⤵
        
        PID:6080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5830.exe
        6⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29578.exe
        7⤵
        
        PID:4640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        6⤵
        
        PID:9648
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        6⤵
        
        PID:13924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32323.exe
        6⤵
        
        PID:10020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62270.exe
        5⤵
        
        PID:8832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53335.exe
        5⤵
        
        PID:12636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6787.exe
        5⤵
        
        PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14473.exe
        5⤵
        
        PID:17072
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41527.exe
      4⤵
      PID:2156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59473.exe
        5⤵
        
        PID:7340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14605.exe
        5⤵
        
        PID:11596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        5⤵
        
        PID:14832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20262.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9177.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9177.exe
      4⤵
      PID:8704
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30200.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30200.exe
      4⤵
      PID:12396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4073.exe
      4⤵
      PID:16200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61536.exe
      4⤵
      PID:17296
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36087.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36087.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37810.exe
      4⤵
      PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24113.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24113.exe
        5⤵
        
        PID:7032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe
        6⤵
        
        PID:12348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53677.exe
        6⤵
        
        PID:4988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44522.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44522.exe
        6⤵
        
        PID:9228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14439.exe
        5⤵
        
        PID:9780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26716.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59271.exe
        5⤵
        
        PID:1428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56304.exe
        5⤵
        
        PID:11280
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52654.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52654.exe
      4⤵
      PID:7580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33794.exe
      4⤵
      PID:11208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56266.exe
      4⤵
      PID:4624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9459.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9459.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26542.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26542.exe
    3⤵
    PID:752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58731.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58731.exe
      4⤵
      PID:6324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58425.exe
        5⤵
        
        PID:9248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11227.exe
        5⤵
        
        PID:12328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47070.exe
        5⤵
        
        PID:9052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18139.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18139.exe
      4⤵
      PID:6420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23812.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23812.exe
      4⤵
      PID:12440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45536.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45536.exe
      4⤵
      PID:948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51483.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51483.exe
    3⤵
    PID:6568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56583.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56583.exe
      4⤵
      PID:13132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51923.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51923.exe
      4⤵
      PID:15692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16125.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16125.exe
      4⤵
      PID:11008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-674.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-674.exe
    3⤵
    PID:9952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6133.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6133.exe
    3⤵
    PID:13960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2596.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2596.exe
    3⤵
    PID:3272
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35188.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35188.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23342.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23342.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35340.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10233.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5163.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26736.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52151.exe
        8⤵
        
        PID:5616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4076.exe
        9⤵
        
        PID:6264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8980.exe
        10⤵
        
        PID:12736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60568.exe
        10⤵
        
        PID:16280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56800.exe
        10⤵
        
        PID:16020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10739.exe
        9⤵
        
        PID:9944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35269.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6064.exe
        9⤵
        
        PID:11236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16665.exe
        8⤵
        
        PID:4420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3260.exe
        8⤵
        
        PID:10564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7641.exe
        8⤵
        
        PID:14228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40152.exe
        8⤵
        
        PID:10560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2711.exe
        7⤵
        
        PID:5956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36531.exe
        8⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14605.exe
        8⤵
        
        PID:11676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48965.exe
        8⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24207.exe
        8⤵
        
        PID:4320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
        7⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43377.exe
        7⤵
        
        PID:13228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39524.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39524.exe
        7⤵
        
        PID:16280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52750.exe
        7⤵
        
        PID:11500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36226.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:3068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30361.exe
        7⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13972.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13972.exe
        8⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe
        8⤵
        
        PID:10868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7932.exe
        8⤵
        
        PID:15364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7226.exe
        8⤵
        
        PID:17304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28123.exe
        7⤵
        
        PID:2020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22694.exe
        7⤵
        
        PID:12044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7641.exe
        7⤵
        
        PID:13936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44462.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2248.exe
        6⤵
        
        PID:5848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5804.exe
        7⤵
        
        PID:7224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe
        7⤵
        
        PID:10984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5986.exe
        7⤵
        
        PID:4448
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 464
        8⤵
        Program crash
        
        PID:17228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3595.exe
        7⤵
        
        PID:12696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37418.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58789.exe
        6⤵
        
        PID:12096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47977.exe
        6⤵
        
        PID:13028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24493.exe
        6⤵
        
        PID:4492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54353.exe
        6⤵
        
        PID:12200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38582.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47732.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13256.exe
        7⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52893.exe
        8⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57657.exe
        9⤵
        
        PID:8176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39047.exe
        9⤵
        
        PID:12824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28133.exe
        9⤵
        
        PID:5096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12260.exe
        9⤵
        
        PID:12576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        8⤵
        
        PID:9632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48124.exe
        8⤵
        
        PID:13344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41338.exe
        8⤵
        
        PID:10588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34179.exe
        7⤵
        
        PID:7372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63521.exe
        8⤵
        
        PID:16084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12722.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12722.exe
        8⤵
        
        PID:9996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40428.exe
        7⤵
        
        PID:11492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
        7⤵
        
        PID:14028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41932.exe
        7⤵
        
        PID:9208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54050.exe
        6⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34969.exe
        7⤵
        
        PID:7696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10826.exe
        7⤵
        
        PID:12816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24461.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46291.exe
        6⤵
        
        PID:8716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42566.exe
        6⤵
        
        PID:11460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52353.exe
        6⤵
        
        PID:4284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53326.exe
        6⤵
        
        PID:8584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60076.exe
        5⤵
        
        PID:4348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7584.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7584.exe
        6⤵
        
        PID:6336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52945.exe
        7⤵
        
        PID:11412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53578.exe
        7⤵
        
        PID:15140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44252.exe
        7⤵
        
        PID:16292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18139.exe
        6⤵
        
        PID:7712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33130.exe
        6⤵
        
        PID:12104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30875.exe
        6⤵
        
        PID:3344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4747.exe
        6⤵
        
        PID:17060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8471.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8471.exe
        5⤵
        
        PID:6800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21674.exe
        5⤵
        
        PID:9920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15933.exe
        5⤵
        
        PID:13976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57244.exe
        5⤵
        
        PID:7504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29262.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46004.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37618.exe
        6⤵
        
        PID:2852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42421.exe
        7⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58684.exe
        8⤵
        
        PID:7636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33794.exe
        8⤵
        
        PID:11200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35654.exe
        8⤵
        
        PID:13996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48354.exe
        8⤵
        
        PID:10056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62270.exe
        7⤵
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46729.exe
        7⤵
        
        PID:11096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23281.exe
        7⤵
        
        PID:15480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55988.exe
        7⤵
        
        PID:4716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58710.exe
        6⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36531.exe
        7⤵
        
        PID:5240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe
        7⤵
        
        PID:10820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59271.exe
        7⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17409.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
        6⤵
        
        PID:8392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53771.exe
        7⤵
        
        PID:2560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44704.exe
        6⤵
        
        PID:10104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64513.exe
        6⤵
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41932.exe
        6⤵
        
        PID:7156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1224.exe
        5⤵
        Executes dropped EXE
        
        PID:1596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21425.exe
        6⤵
        
        PID:5624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34803.exe
        7⤵
        
        PID:6284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52203.exe
        8⤵
        
        PID:9284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17257.exe
        8⤵
        
        PID:12204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46084.exe
        8⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32529.exe
        7⤵
        
        PID:9832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21070.exe
        7⤵
        
        PID:13868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57211.exe
        7⤵
        
        PID:16364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16665.exe
        6⤵
        
        PID:7160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15512.exe
        6⤵
        
        PID:10788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7641.exe
        6⤵
        
        PID:14948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48468.exe
        6⤵
        
        PID:1536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52597.exe
        6⤵
        
        PID:12608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8278.exe
        5⤵
        
        PID:5900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20771.exe
        6⤵
        
        PID:7624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8959.exe
        6⤵
        
        PID:12020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50989.exe
        6⤵
        
        PID:7660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48264.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48264.exe
        5⤵
        
        PID:9024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55473.exe
        5⤵
        
        PID:12460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-949.exe
        5⤵
        
        PID:7752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11861.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-669.exe
        5⤵
        
        PID:2652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13832.exe
        6⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22167.exe
        7⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        7⤵
        
        PID:9548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        7⤵
        
        PID:13896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9084.exe
        7⤵
        
        PID:7448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38263.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27071.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27071.exe
        7⤵
        
        PID:11992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49686.exe
        7⤵
        
        PID:16172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51538.exe
        7⤵
        
        PID:10780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33794.exe
        6⤵
        
        PID:11120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
        6⤵
        
        PID:14080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51374.exe
        6⤵
        
        PID:6188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60080.exe
        5⤵
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57465.exe
        6⤵
        
        PID:8644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53246.exe
        6⤵
        
        PID:12864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12373.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36957.exe
        6⤵
        
        PID:10196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8164.exe
        5⤵
        
        PID:9120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6577.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6577.exe
        5⤵
        
        PID:12796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32131.exe
        5⤵
        
        PID:5064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44236.exe
        5⤵
        
        PID:13004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41245.exe
      4⤵
      PID:208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11647.exe
        5⤵
        
        PID:1628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20771.exe
        6⤵
        
        PID:7000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8959.exe
        6⤵
        
        PID:12028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        6⤵
        
        PID:15196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37865.exe
        6⤵
        
        PID:7512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42399.exe
        5⤵
        
        PID:9008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-620.exe
        6⤵
        
        PID:13032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-392.exe
        6⤵
        
        PID:5224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31091.exe
        6⤵
        
        PID:11728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64138.exe
        5⤵
        
        PID:12444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29986.exe
        5⤵
        
        PID:4288
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59548.exe
        5⤵
        
        PID:11520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1586.exe
      4⤵
      PID:5596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3666.exe
        5⤵
        
        PID:7328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe
        5⤵
        
        PID:10828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20184.exe
        5⤵
        
        PID:1360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5925.exe
        5⤵
        
        PID:16640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14163.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14163.exe
      4⤵
      PID:8520
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47259.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47259.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8256
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18816.exe
      4⤵
      PID:13560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22402.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22402.exe
      4⤵
      PID:8480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19558.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19558.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49128.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49128.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62532.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56092.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56092.exe
        6⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9172.exe
        7⤵
        
        PID:5676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49385.exe
        8⤵
        
        PID:7060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21285.exe
        9⤵
        
        PID:9716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27371.exe
        9⤵
        
        PID:13468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18481.exe
        9⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14439.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14439.exe
        8⤵
        
        PID:9772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26716.exe
        8⤵
        
        PID:13748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53127.exe
        8⤵
        
        PID:2472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61398.exe
        7⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33794.exe
        7⤵
        
        PID:11192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35654.exe
        7⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62552.exe
        7⤵
        
        PID:10008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48020.exe
        6⤵
        
        PID:5136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5804.exe
        7⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41653.exe
        8⤵
        
        PID:12924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37532.exe
        8⤵
        
        PID:13476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20209.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20209.exe
        8⤵
        
        PID:11268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14605.exe
        7⤵
        
        PID:11588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36587.exe
        7⤵
        
        PID:14892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45535.exe
        7⤵
        
        PID:11064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
        6⤵
        
        PID:8424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44704.exe
        6⤵
        
        PID:11272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
        6⤵
        
        PID:14876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7122.exe
        6⤵
        
        PID:4708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58593.exe
        5⤵
        
        PID:3396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63391.exe
        6⤵
        
        PID:6632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50372.exe
        7⤵
        
        PID:13828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        6⤵
        
        PID:9504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26506.exe
        7⤵
        
        PID:16608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        6⤵
        
        PID:13580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63355.exe
        6⤵
        
        PID:13080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17409.exe
        6⤵
        
        PID:10584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52191.exe
        5⤵
        
        PID:7196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41845.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41845.exe
        6⤵
        
        PID:12500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29265.exe
        6⤵
        
        PID:15956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4667.exe
        6⤵
        
        PID:10892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38316.exe
        5⤵
        
        PID:9724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6402.exe
        5⤵
        
        PID:14204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46016.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22054.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22054.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47732.exe
        5⤵
        Executes dropped EXE
        
        PID:4780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54865.exe
        6⤵
        
        PID:5712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9888.exe
        7⤵
        
        PID:7052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18305.exe
        7⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1776.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1776.exe
        7⤵
        
        PID:15264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62255.exe
        7⤵
        
        PID:11296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28123.exe
        6⤵
        
        PID:8144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22694.exe
        6⤵
        
        PID:12068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7641.exe
        6⤵
        
        PID:15124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46216.exe
        6⤵
        
        PID:8196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36151.exe
        5⤵
        
        PID:6032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36531.exe
        6⤵
        
        PID:7228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55062.exe
        6⤵
        
        PID:8136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5986.exe
        6⤵
        
        PID:1472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59018.exe
        6⤵
        
        PID:11256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
        5⤵
        
        PID:8404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44704.exe
        5⤵
        
        PID:6176
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
        5⤵
        
        PID:15216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34070.exe
        5⤵
        
        PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49242.exe
        5⤵
        
        PID:12332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64160.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64160.exe
      4⤵
      PID:4996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54673.exe
        5⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22167.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        6⤵
        
        PID:9524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        6⤵
        
        PID:13620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61103.exe
        6⤵
        
        PID:9892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38263.exe
        5⤵
        
        PID:7392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55393.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55393.exe
        5⤵
        
        PID:10612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1829.exe
        5⤵
        
        PID:14836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24731.exe
        5⤵
        
        PID:6160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55633.exe
        5⤵
        
        PID:3292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28726.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28726.exe
      4⤵
      PID:5132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50729.exe
        5⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42063.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42063.exe
        6⤵
        
        PID:9880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53578.exe
        6⤵
        
        PID:15148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61268.exe
        6⤵
        
        PID:9896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18305.exe
        5⤵
        
        PID:10408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58569.exe
        5⤵
        
        PID:13564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14346.exe
        5⤵
        
        PID:16172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33527.exe
        5⤵
        
        PID:16908
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32836.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32836.exe
      4⤵
      PID:8352
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56452.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56452.exe
      4⤵
      PID:12140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34317.exe
      4⤵
      PID:14992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1095.exe
      4⤵
      PID:7788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32691.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32691.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44826.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54530.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49001.exe
        6⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24985.exe
        7⤵
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14543.exe
        7⤵
        
        PID:12364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18595.exe
        7⤵
        
        PID:3044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32873.exe
        7⤵
        
        PID:12512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        6⤵
        
        PID:9612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51904.exe
        6⤵
        
        PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19405.exe
        5⤵
        
        PID:5988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56955.exe
        5⤵
        
        PID:10148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-677.exe
        5⤵
        
        PID:14276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45536.exe
        5⤵
        
        PID:2228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28442.exe
      4⤵
      PID:5164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44917.exe
        5⤵
        
        PID:6572
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6572 -s 724
        6⤵
        Program crash
        
        PID:16320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        5⤵
        
        PID:9624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12598.exe
        5⤵
        
        PID:15316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58461.exe
        5⤵
        
        PID:7132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13296.exe
      4⤵
      PID:7172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24580.exe
      4⤵
      PID:10532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39233.exe
      4⤵
      PID:13148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49076.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49076.exe
      4⤵
      PID:8564
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1582.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1582.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9364.exe
      4⤵
      PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50755.exe
        5⤵
        
        PID:7012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41207.exe
        6⤵
        
        PID:13712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46163.exe
        6⤵
        
        PID:9512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61502.exe
        5⤵
        
        PID:9736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55497.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3656.exe
        5⤵
        
        PID:5548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62910.exe
        5⤵
        
        PID:12724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32041.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32041.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26480.exe
        5⤵
        
        PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62473.exe
        5⤵
        
        PID:16652
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33794.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33794.exe
      4⤵
      PID:11100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64434.exe
      4⤵
      PID:13536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15987.exe
      4⤵
      PID:4372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4740.exe
      4⤵
      PID:16972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24144.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24144.exe
    3⤵
    PID:5456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16495.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16495.exe
      4⤵
      PID:7464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
        5⤵
        
        PID:7424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14605.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14605.exe
      4⤵
      PID:11572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5986.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5986.exe
      4⤵
      PID:15620
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45429.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45429.exe
    3⤵
    PID:8688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28785.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28785.exe
    3⤵
    PID:12292
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63741.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63741.exe
    3⤵
    PID:15752
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26984.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26984.exe
    3⤵
    PID:15960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46524.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46524.exe
    3⤵
    PID:17184
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52022.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52022.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19004.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19004.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38822.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38822.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28490.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1196.exe
        6⤵
        
        PID:5480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27813.exe
        7⤵
        
        PID:6496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41129.exe
        8⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39047.exe
        8⤵
        
        PID:12872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53406.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2146.exe
        8⤵
        
        PID:11668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        7⤵
        
        PID:9588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16682.exe
        7⤵
        
        PID:15324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25980.exe
        7⤵
        
        PID:11232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19405.exe
        6⤵
        
        PID:5244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64751.exe
        7⤵
        
        PID:13020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31310.exe
        7⤵
        
        PID:5284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55020.exe
        7⤵
        
        PID:11552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50158.exe
        6⤵
        
        PID:10260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26988.exe
        6⤵
        
        PID:13332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60407.exe
        6⤵
        
        PID:10132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9125.exe
        5⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5804.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40797.exe
        6⤵
        
        PID:1240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52220.exe
        6⤵
        
        PID:11352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
        5⤵
        
        PID:8376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44704.exe
        5⤵
        
        PID:10916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33786.exe
        5⤵
        
        PID:15112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32010.exe
        5⤵
        
        PID:16284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61717.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34061.exe
        5⤵
        
        PID:5360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13998.exe
        6⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39183.exe
        7⤵
        
        PID:8452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39047.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34931.exe
        7⤵
        
        PID:2196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36957.exe
        7⤵
        
        PID:11640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        6⤵
        
        PID:9596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16682.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7122.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49067.exe
        5⤵
        
        PID:7540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29017.exe
        6⤵
        
        PID:12316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53869.exe
        6⤵
        
        PID:852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61818.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34206.exe
        5⤵
        
        PID:11580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64513.exe
        5⤵
        
        PID:14320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31818.exe
        5⤵
        
        PID:10236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56903.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56903.exe
      4⤵
      PID:5916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-568.exe
        5⤵
        
        PID:6380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4517.exe
        5⤵
        
        PID:10140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33898.exe
        5⤵
        
        PID:14072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51181.exe
        5⤵
        
        PID:11228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50272.exe
      4⤵
      PID:7612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30994.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30994.exe
      4⤵
      PID:11136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10453.exe
      4⤵
      PID:13552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61328.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61328.exe
      4⤵
      PID:7384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27124.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27124.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42304.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42304.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54338.exe
        5⤵
        
        PID:2400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49001.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49001.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59795.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39047.exe
        7⤵
        
        PID:12892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43100.exe
        7⤵
        
        PID:15796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26075.exe
        7⤵
        
        PID:12280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7641.exe
        6⤵
        
        PID:9700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
        6⤵
        
        PID:14056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11222.exe
        6⤵
        
        PID:576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19405.exe
        5⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26329.exe
        6⤵
        
        PID:9764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61004.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29555.exe
        6⤵
        
        PID:9932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59093.exe
        5⤵
        
        PID:9620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15067.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15067.exe
        5⤵
        
        PID:14212
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54000.exe
        5⤵
        
        PID:7112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34472.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34472.exe
      4⤵
      PID:1112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1170.exe
        5⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3666.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3666.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18305.exe
        6⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42935.exe
        6⤵
        
        PID:6884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33527.exe
        6⤵
        
        PID:16916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23847.exe
        5⤵
        
        PID:8552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38839.exe
        5⤵
        
        PID:10608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42452.exe
        5⤵
        
        PID:15132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13735.exe
        5⤵
        
        PID:16304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61729.exe
      4⤵
      PID:7136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33407.exe
        5⤵
        
        PID:8656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19265.exe
        5⤵
        
        PID:12380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46635.exe
        5⤵
        
        PID:6052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24207.exe
        5⤵
        
        PID:12564
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32888.exe
      4⤵
      PID:8820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2920.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2920.exe
      4⤵
      PID:12404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43608.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43608.exe
      4⤵
      PID:15792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22599.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22599.exe
      4⤵
      PID:12680
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15753.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54146.exe
      4⤵
      PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6022.exe
        5⤵
        
        PID:6560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16023.exe
        6⤵
        
        PID:10512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31429.exe
        6⤵
        
        PID:14996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56800.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56800.exe
        6⤵
        
        PID:7528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        5⤵
        
        PID:9656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48124.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48124.exe
        5⤵
        
        PID:13532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34269.exe
        5⤵
        
        PID:6804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35466.exe
        5⤵
        
        PID:17032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48762.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48762.exe
      4⤵
      PID:7264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5332.exe
        5⤵
        
        PID:9872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52260.exe
        5⤵
        
        PID:13860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49400.exe
        5⤵
        
        PID:9000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34972.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34972.exe
      4⤵
      PID:10296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14875.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14875.exe
      4⤵
      PID:12236
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58468.exe
      4⤵
      PID:9108
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21016.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21016.exe
    3⤵
    PID:880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49001.exe
      4⤵
      PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15202.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15202.exe
        5⤵
        
        PID:12524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29265.exe
        5⤵
        
        PID:15940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36764.exe
        5⤵
        
        PID:9476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
      4⤵
      PID:9688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
      4⤵
      PID:13600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47019.exe
      4⤵
      PID:5076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35473.exe
      4⤵
      PID:17084
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30340.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30340.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5652
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40141.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40141.exe
    3⤵
    PID:10544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59231.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59231.exe
    3⤵
    PID:14844
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62548.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62548.exe
    3⤵
    PID:7536
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22823.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22823.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:212
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42906.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42906.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36658.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36658.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21425.exe
        5⤵
        
        PID:5600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27813.exe
        6⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42883.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42883.exe
        7⤵
        
        PID:7180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54460.exe
        7⤵
        
        PID:12972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40770.exe
        7⤵
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63599.exe
        7⤵
        
        PID:12592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63064.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44232.exe
        6⤵
        
        PID:13736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59158.exe
        6⤵
        
        PID:2236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11948.exe
        6⤵
        
        PID:16584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58300.exe
        5⤵
        
        PID:5792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15805.exe
        6⤵
        
        PID:11944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22851.exe
        6⤵
        
        PID:14904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2259.exe
        6⤵
        
        PID:716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29941.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29941.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59093.exe
        5⤵
        
        PID:9480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45794.exe
        5⤵
        
        PID:14244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45536.exe
        5⤵
        
        PID:7960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2711.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2711.exe
      4⤵
      PID:5952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36531.exe
        5⤵
        
        PID:6964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1777.exe
        5⤵
        
        PID:10836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48965.exe
        5⤵
        
        PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7679.exe
        5⤵
        
        PID:11068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31552.exe
      4⤵
      PID:8384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44704.exe
      4⤵
      PID:10524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64513.exe
      4⤵
      PID:1460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64107.exe
      4⤵
      PID:8288
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41794.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41794.exe
    3⤵
    PID:3972
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49001.exe
      4⤵
      PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9992.exe
        5⤵
        
        PID:10096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62566.exe
        5⤵
        
        PID:14008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3899.exe
        5⤵
        
        PID:10224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48674.exe
      4⤵
      PID:9408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
      4⤵
      PID:13628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50117.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50117.exe
      4⤵
      PID:7460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39006.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39006.exe
    3⤵
    PID:6472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32172.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32172.exe
    3⤵
    PID:10304
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55212.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55212.exe
    3⤵
    PID:13360
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51406.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51406.exe
    3⤵
    PID:10748
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42144.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42144.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22460.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22460.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37810.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37810.exe
      4⤵
      PID:3252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63391.exe
        5⤵
        
        PID:6604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
        5⤵
        
        PID:9572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24770.exe
        5⤵
        
        PID:13684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39235.exe
        5⤵
        
        PID:3420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19405.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19405.exe
      4⤵
      PID:5440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41195.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41195.exe
      4⤵
      PID:10252
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23236.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23236.exe
      4⤵
      PID:14324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54000.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54000.exe
      4⤵
      PID:3852
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32142.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32142.exe
    3⤵
    PID:1636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29951.exe
      4⤵
      PID:6588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44803.exe
        5⤵
        
        PID:10112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9281.exe
        5⤵
        
        PID:14032
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54558.exe
        5⤵
        
        PID:16316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5566.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5566.exe
        5⤵
        
        PID:17164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
      4⤵
      PID:9664
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41107.exe
      4⤵
      PID:13848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37865.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37865.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6498.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6498.exe
    3⤵
    PID:4056
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61258.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:10592
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58701.exe
    3⤵
    PID:14824
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8082.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8082.exe
    3⤵
    PID:7284
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15276.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15276.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4720
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31972.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31972.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49001.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49001.exe
      4⤵
      PID:6488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50013.exe
        5⤵
        
        PID:12476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16457.exe
        5⤵
        
        PID:6576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26075.exe
        5⤵
        
        PID:12264
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3557.exe
      4⤵
      PID:9580
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13313.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13313.exe
      4⤵
      PID:14376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37969.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37969.exe
      4⤵
      PID:6044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62327.exe
      4⤵
      PID:11964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30287.exe
    3⤵
    PID:4324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33153.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33153.exe
      4⤵
      PID:8672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14543.exe
      4⤵
      PID:12388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43100.exe
      4⤵
      PID:15640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2146.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2146.exe
      4⤵
      PID:12184
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58901.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58901.exe
    3⤵
    PID:9800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40750.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40750.exe
    3⤵
    PID:13768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34269.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34269.exe
    3⤵
    PID:6796
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 6796 -s 464
      4⤵
      Program crash
      PID:14540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2026.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2026.exe
    3⤵
    PID:16884
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3870.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3870.exe
  2⤵
  PID:6120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64543.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64543.exe
    3⤵
    PID:7248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41461.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41461.exe
      4⤵
      PID:12136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45233.exe
      4⤵
      PID:8316
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11788.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11788.exe
      4⤵
      PID:17224
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46702.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46702.exe
    3⤵
    PID:11144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58569.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58569.exe
    3⤵
    PID:13612
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48145.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48145.exe
    3⤵
    PID:6164
- C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-35764.exe
  2⤵
  PID:7480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48555.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48555.exe
    3⤵
    PID:15644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18264.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18264.exe
    3⤵
    PID:7764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19545.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19545.exe
    3⤵
    PID:3916
- C:\Users\Admin\AppData\Local\Temp\Unicorn-64742.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-64742.exe
  2⤵
  PID:11556
- C:\Users\Admin\AppData\Local\Temp\Unicorn-42377.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-42377.exe
  2⤵
  PID:13932
- C:\Users\Admin\AppData\Local\Temp\Unicorn-8596.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-8596.exe
  2⤵
  PID:9192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 6572 -ip 6572
1⤵
PID:16248

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3044 -ip 3044
1⤵
PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10233.exe

Filesize
468KB

MD5
263f2127759d4e15ebb7f57c03c033eb

SHA1
27660e46e9f8c6530703496735a070c667441b51

SHA256
04dd2a80742ecf554db58a8a70d3b80f1f4209ec0817e775fff476e437f3c674

SHA512
ad8a533771f95122bd69898834a116405c8ec86dedd464d8556fb048bdc17f72cf6368e3a4d7723b19709f01f1087c20d53d1aeb85de2b64bee4285dfbff48b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1084.exe

Filesize
468KB

MD5
3eb783d9b54743a44eb0ed9e6398a9af

SHA1
0d74ff0669a26848bfd7f590322286f1b054a024

SHA256
6592f581b50ba09216abdeecca915b8d8249b33b12693b1c4c7fe708b863f1cd

SHA512
a82cc49c3313646e9dcda07bbb003c6f7c54971c0136f52f1a4e5356fb072006e81e1122a3b0fe40ab80064609004b51f3897c2a3d2a8c88b2a878e62429a534

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13832.exe

Filesize
468KB

MD5
5803127dae3eb2ded6494b7383a015d0

SHA1
c7524decf32c4fca77cc9b8bac39e3fb7a7b960e

SHA256
484c548e9cf46836a0ec2960aad49618f48d5595c542dde92e04006ba4863ec4

SHA512
d31fa0d5e05fedb8de358caacd6c5826046eb168867fb72ba001ca83d327be71c57a814c8f323130f5c2b3de281a6b94aad2cd892fa84326455a0970918666c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-14819.exe

Filesize
468KB

MD5
ef09b393ef6d7846a2f77b7333c8b064

SHA1
20019abe5ecb0c060703ed1b3a6c78c212c91f39

SHA256
9b618efa7c5d2689ecf3187c2d46f9db145f345bfc03e4cb020af0956e02049a

SHA512
2454225e0887c963ccb80cf1978c3c57a78545bd68d2abd1b996f0d084cdd88af27092fe61533d702e77a3a961a2b58c80b6bc73a78e381d9516f5bdf61ee4b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-15998.exe

Filesize
468KB

MD5
8ce7af23463abb416595f00287196598

SHA1
93ae960e4041a53dadbae2e59b2ce076ee5b8b92

SHA256
3a29fe17e0fd604f11062367032c0fab3c0d27592a50d22ef03fe2dfea365b2a

SHA512
fdacf1a6c5d295b17904b8699d6e388cb511f15ab2a0f373cda96f5eada5222e22fb9638afc767018f7b3dfd074a73adc2bc78926e5eee74174ff69f916f55b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16160.exe

Filesize
468KB

MD5
d27d8456b2d8308151077318e0faa113

SHA1
5cd46c8683759fbf1f41cf52f052f3aeb3c83a1b

SHA256
74c8fe8bc63f820c7e2e4eae89a7428f8fd81a4481e299d9c29cc9b05807aaf4

SHA512
441605c61c6f7dbcaf0455ec81dfe59d8a5b938288e033284e244289e8eb5bac816e70d8081b7e9411a5174d7d0495b9fa632845f53342dfd8ab0a7082d85419

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19004.exe

Filesize
468KB

MD5
54d815fa539599fce3f356feeb470841

SHA1
1a0cae9ae281c86f0b46f483e9513c325074fa9c

SHA256
163ff45fa8a5388baaca645fbf39f50a96fecf147c99a930c9a395b1e8c1150f

SHA512
2d2987fe8f57369c132dc662c433d4d254fe1d9fd08e9c2e30cd463ef025c1366338790e398f77f4dfc0e5ab26350057e8464a512d87d5b386423f2943e1a1e3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19558.exe

Filesize
468KB

MD5
1c48480eb8d671cedc0670a5ae502014

SHA1
0833cbd874e316e5910e8c68c28d3f0609674f1b

SHA256
603ceced088cd54fb511946c9aff0880852ef96c2baea8dc7db53d863e1f558a

SHA512
14687c29e704227bf5271cd6a4b9830294922668f400868fccd7031173ffa913e55d210682f685858a9577efeefa3b64bd13f9c0119e5daca0718ec90d7819fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20950.exe

Filesize
468KB

MD5
bbc8088b4fa20e6066f86d799877fee6

SHA1
e22c13dc83fc67f20affb5cd8e4b6b49b61525c0

SHA256
d3f65f01dcb02e4f23b8812a5485813606c1a262b7121aea843e45bc82fcebcf

SHA512
0ef223028318f02359df4e828b79409eb306b77ead5160531ab7336524bb98669bf4d78185d692e877e88fc3c2766c0f73f816e9d3ca5f1b8c31ff8fc1a6447e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22823.exe

Filesize
468KB

MD5
74400fb6fde1c1156ab1d8ed1cc32b73

SHA1
55551f29b0301b4d4704ff1d4b44d779a499407f

SHA256
ac71f6455be1030c3d1546b3a0cf8e2939402d112434dcff7254d3803371a3c0

SHA512
fd092df3ad04e0b57a933956fe0b4abdb4c63a411be8fb62a1b4e03a47d0b0ddb34886f44792215862141c40f640c433a03217a3372c490dbab6e84139ebd097

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23342.exe

Filesize
468KB

MD5
efaaa8dace3c652c5708c572c7e1b8ef

SHA1
838ca9f7dfcf6b12e5c6b8b697fa771ff06c30f2

SHA256
c9aaabf3c37767c4525e0f906ec15a3d2dda09759b0e26f3a9b0020da8a4dcac

SHA512
8651c2b9c971aa8ee8fe5ba4a3ab5d6a492cfd8a85525c48cbdc2acc598280711970dddc7665a559e48f3581bd6a1cbc404c6fc67ce4470d39b5a6d7eea71534

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27124.exe

Filesize
468KB

MD5
e1441d8bcdba6b2dbd49de0a159baedd

SHA1
086cf735f6722063d04d6acee07c094108f9e51c

SHA256
38bd75155c80a7350c76f7f00c929de1c4e3618d43b5d4c0f95d562e266d581d

SHA512
461cf04c50a2f76dd60f8e8cd14f8098fde72d48f14649c59e6120263575ab75eb402ccad1566fe0d6dd055c3230efc1c7da28eb6c4dd50fe2f648c931ceba2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-29262.exe

Filesize
468KB

MD5
9f2d9352456d0d43d05379caa78dcedd

SHA1
82e2a616bc1dae14949e494d90b44ff15ff223dc

SHA256
c975da05f488cb8b3297687cf365af0efee5876a96d1a41b40497c3a08bea991

SHA512
3e53fae21688ce798e9bcd637828c3f9341146566928ef3e10a6aae4d89516639c648fc0be7c57d9be15897930e2c5777e0dba3bafc3ed252adc58a9e440b692

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32691.exe

Filesize
468KB

MD5
4a17ae309e3a51e1f85b1b7cefbf8b67

SHA1
d3f207243bb63f26175421b1bc049e438fc67197

SHA256
8fdc9099c82854032c6aef6ee7407ac608c630b6dd3ce570bcb7819114d45ad2

SHA512
3583cef113f3d47dceb499e7d1336930933b64e1bb4e46cfd523d5634b6c31b79d093725cf8e9aaae4056703a14f5ed1255a6e5fd5422d28857a55585f59eb4d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33346.exe

Filesize
468KB

MD5
33186e84dae36b566d497a40561f62d5

SHA1
ecb62cb06e9492e223eb66ec58fc6e00f47166e9

SHA256
8faf7ddedbd6ea285f2b77ca40869a1cbb81f1013e6b9904b684a1ffe9f95215

SHA512
2bf885dc686b2483347cf67a3a759339a47bc4499398c39f64f88502a4ef459af9d6e8c7de1ced128690fe76ce83fd8b929f99040a05f9e6c63ed86cb302e771

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35188.exe

Filesize
468KB

MD5
a27c6816f0e1640e79a0e4d050d4c05e

SHA1
b694e90b0b62ce9fab3f3046a34c9ed885821e75

SHA256
9fc1e23935060e8f5c144a126857c851071b4c2a42395b09cf8cf0c30f7d0e41

SHA512
0eb9135aa5ef861f0d686c8637d48c6672693aa4d9d82a0ef1b92ee81422bf3acc351966e7ccdc4d47676f1229222285ebd83b6c4adc02ea3a9aec826ad5762e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35340.exe

Filesize
468KB

MD5
2a094de8fe44bd320f05c3c9e08b7802

SHA1
d87adc2a0d364e5176b015bf48898de74ac6a32b

SHA256
d33d991a1f7259438e54009ec496d213e9cad8119c7ac765a9d2f40bc3a43f53

SHA512
0bbd2f62eaa597395e18d7ae72711b3d846b6b377e370917af06ad8357071ad3df0475fdb7465780b5390c5b32b79b2b3d18c47235cac11972dbc7dc59fe0235

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-38822.exe

Filesize
468KB

MD5
bf20c6d940b112f1566c16a4b1a50f9e

SHA1
eab510ce7c7182c7657d1fc91b5d9403beaee1b9

SHA256
8775aee3742187efb9e17f29d07ce65255f39efee46d87a4f3d9ca1d25be8f67

SHA512
70519cf2260dcd94f5e5db1a58b9621b13a266593e737023ed2aa56e7a8544aca4c20891a47bf919e345005671968e54a784b61413d58330e027e177fef85075

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42144.exe

Filesize
468KB

MD5
1aab5d77595fa50896a72c28e7b3da43

SHA1
620c04f273bcb283c5cbf452f3b205769ab35d78

SHA256
34ded8e1f91fc2ee406ca0bed580b5edc9340d6ad78785a4323655fa0d963993

SHA512
9cf0848de0bded86bdc0c6116daf1163df64aab4ac69ea64518e84cbf088607225f6d12210c89f062b973514f600d70e899adfe33b95a269fcc6b2edc5cb1f74

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42906.exe

Filesize
468KB

MD5
ddfce565e1fa6c487ae41055d6ca10ca

SHA1
ce15c51002fbad40d2ae7d238861c8cf27cb4fbf

SHA256
c43dd29aff8fdb3cd048e7d35a181e40eecd77c8d124fd7c97e9402bb8f393d7

SHA512
e9bd418843e1c2461a5a057bb437a1ffcc2752c25bc9fad04f1f96a9c02dccba2b1cc9705a86a2d8fdc6ecaf936e93056260a12f532d1f99e7e6282f99c86915

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47082.exe

Filesize
468KB

MD5
794ccd247a53b14dcbb62df0dec664f7

SHA1
485ca9698e8cb358a41c7aeacbc785e7bc64ddb9

SHA256
f42ab39fb6f2e9d1e9157be012942c7ef521dbacec7a37a957f174e2b9bd9ca9

SHA512
0dde8e760df9b05d4f35178067d32da32ee2785e80d18ee2a53a76d93ecf6e9aba022dab894a54a24ece4035038c2efbcc37c8c7fced13f742d9fbf2e64a0bcc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4893.exe

Filesize
468KB

MD5
b07e30811976f02c5de8a0849c40ef02

SHA1
e25235012454107607b01ba1f4b09e7d171e461d

SHA256
561d443d74e19f1e685c6b17265d478115b657a1981bd70b4ed20f9350f69f7f

SHA512
1fbe035e321884da7940d67acd5ef6908af6e8021d91460e4493f83b7ac391527aa665bf546208e8e6be60b1cb74763a18ebbaea395c66022bf0b1edf0072264

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-49128.exe

Filesize
468KB

MD5
56c4b962f2df4d7419454bd406a05069

SHA1
6dd3b37e1580732ca5c357d42b1758c06f4b8552

SHA256
45e412a1d828f2d5e984ccf2e982614d61987f105609a93cf516d8cf615baf8a

SHA512
ae46c54be6e17c9b547353f156871ff9d000f6096a76f03f3655b31cd89b3e43f6b561ba8a8479a2a1d0b4afd2ba1a3b9a5ac7e2d086f1e7b1547d4492e229ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51074.exe

Filesize
468KB

MD5
4d17a34e35769cab140af23dd9a204c2

SHA1
0874a35b518a8b33a23c961cb491f20c8b781eb3

SHA256
b9319e53df5ac054e9ef711b3df701f9cba7f33a328041ba02b4b181ca391a1b

SHA512
2160f5a81cfea2066842a86acf580ca236cd21fce5287c929a05a1704f1f68fe0916565f60cf767f1c140b72cfc890363fb148d4506ed1bf3d7816536c86741c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5163.exe

Filesize
468KB

MD5
ee823756b4f05ac867340cf35f7e64a6

SHA1
870a3753a2693e193dbc69b3f936cfdcb485603e

SHA256
6fb48b3b748468329cf06f6eb2218596b04d5a923a904467ef05ce4faff4d383

SHA512
eb864d881ea70c9187c36bb419f971cce8aec0b583d45196e949b034a3c838f1fc27f7d2f6beaf6ed1dbc45b0ba3b75125443bad1d65e60e05850c97d7a601a4

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52022.exe

Filesize
468KB

MD5
c4e94578e357e6bd1e2abe6105b3cfc2

SHA1
db0db182ff7fb81bbfb0d62157dcc00910eb4684

SHA256
138a0f3ac762c10317904e4a7824472c2bcec17a50f7190fa9d7d2be0fbd01ea

SHA512
77ead88c4e1053c4f4443b66bf72510c9234f30690cafcd6f34c0bf7e65327898eb56c5e70f01e141997d5d8e428d4a9bd2b2f6b091d629358d5e86da5753cfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-59003.exe

Filesize
468KB

MD5
fc00860f9e4462ae1590b04b76cf40dd

SHA1
e2c74637776e5722997e39faf6a7fa2da6f9a02a

SHA256
69db8bad26ae6c9edf71798b73e201d9a250fd2003ed107c4b5bc86c1afb38a9

SHA512
a7e92600941a532618030ae461b22b65cd0ba357a3b1f925f12eb6504fc81068f25c68d1c1c3b1e01cbaefa20530a1507676d0a188d58c0ef25cd6909d76ce25

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61982.exe

Filesize
468KB

MD5
268d55cc598142fee15a3fa670ba3b70

SHA1
942541d60d35661143b8851e8185387c627bf7de

SHA256
2cdb48dd87a1cf1e0ff2625ad9a6455ac5474b36877ce06031a9bdc73c9b25be

SHA512
2c7ebbb548b79baf44056482e4684b3c7b7d5d361e4270cd28ab86ad590d4a2dc41c94f2bee201459973622ed56e091168cabe32e8d96242caddc2a74ca01e9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64374.exe

Filesize
468KB

MD5
4d92bf163279885cf714bc5c0e8cb781

SHA1
93b28571989ac25b24aca48ac900451e89abd89b

SHA256
f2e0e9e974fe38d6647b7f1b316bf73b280f248064ed7349e547d562e9e2c574

SHA512
212fac9b0e5d2169efd175e095863ddb2e9ac10a82a19718ff2b046ceb59939f36fc578bcac2b63ee179481974ebb9150b29337603e12bcec8890912a7d18044

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6704.exe

Filesize
468KB

MD5
0e2d4170c16e07bdf4fb870ee1a8f9d8

SHA1
09e8145faa79e7edc3b42a3061979cf7e6fd07a5

SHA256
b270386a47474f8b82db5fd90338905158ba4b99dd1e21b8cca8e665876a95b6

SHA512
41ac7e37253a347d069602d598401d39d818bc9b6cb3a5b429a98d0a2777f922385628af335ba3e1524489b173753a383b00a411894465f4db530265a6269065

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8095.exe

Filesize
468KB

MD5
1ef3689dab18433324423d9dadff90b7

SHA1
4e3c06c6ff473c5da71720352dc6125421f23a0b

SHA256
e437f69e3af4b57c8579e17d841fd5c12fe71395695499ada46fd966ce9f8b68

SHA512
019f7921b7e71bbda5fe8bfe6e101b39ade698cc591e501344adc461d750d318c3bbc6624ccfa43f7624ca7dafab453342e422af7eb016ec49c355fe75b9174a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9698.exe

Filesize
468KB

MD5
7dd1554394d4046103f229bcf154d2d9

SHA1
17cb9d0e75a7edf90b5c51d9c7fc5dde181b0109

SHA256
1a723834961189b4d7c1fe2fb16481995e990218179666cb0221cd25f9fea258

SHA512
30d207cbd1c29c352eaafef1ab6cc09a949e37d7e7d2a624ee262bdc3d2f2f359b896054d92ff55e24260f19341673d58239976de0317a651a6175f2a8bb5c4f

Download Submit
memory/60-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/208-406-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/212-76-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/232-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/512-154-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/624-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/740-348-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/752-500-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/880-499-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/884-177-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/920-41-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1000-495-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1112-454-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1228-259-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1292-3496-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1300-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1324-47-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1336-42-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1416-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1512-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1580-176-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1580-3469-0x0000000076E60000-0x0000000076E78000-memory.dmp

Filesize
96KB

Download
memory/1596-396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1636-488-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1676-83-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1680-104-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1744-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1804-2374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1912-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1964-340-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2088-217-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2176-346-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2224-172-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2316-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2392-338-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2400-463-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2584-175-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2624-455-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2628-112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2652-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2660-337-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2664-61-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2768-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2780-272-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2824-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2848-254-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2868-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2908-101-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2940-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3004-510-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3068-400-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3136-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3140-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3252-496-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3340-224-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3388-497-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3396-403-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3428-306-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3460-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3540-384-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3624-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3696-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3784-72-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3876-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3924-498-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3972-466-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4000-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4032-173-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4124-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4224-372-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4296-436-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4316-19-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4348-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4428-121-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4616-302-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4720-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4780-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4800-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4824-187-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4832-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4856-273-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4892-486-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4916-279-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4920-464-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4952-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4992-241-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4996-405-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5008-174-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5044-529-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5084-251-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5164-531-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5176-534-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5188-533-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5200-532-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5216-528-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5352-541-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5360-551-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5424-550-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5468-562-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/7448-3494-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15956-2396-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16280-2419-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads