bd4a44e9de807dee4a64e8adb71d37dc5cec5d6a5b858a5873666007a72ef45f

Analysis

max time kernel
117s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 11:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bd4a44e9de807dee4a64e8adb71d37dc5cec5d6a5b858a5873666007a72ef45fN.exe
Size

468KB
MD5

fd694307f239a6b2952853aa1d7f2ee0
SHA1

4f623b447c473eadae1b3b853323e73b4ecfa34f
SHA256

bd4a44e9de807dee4a64e8adb71d37dc5cec5d6a5b858a5873666007a72ef45f
SHA512

f8cc81ff10671d7e64ca745d9285e4f1222ffcb7c43a3f12f3dd54956678be92123c6c76264b88fa072dea1e6c67fc0566bc54b25d44693f6c3f7f1cea171371
SSDEEP

3072:1hrUogIuIw5UrbYXHzcjrf8/EoOC3lpC6FH0pVCQwaRkiCSzFXeM:1hIo3gUr4H4jrfkj+7waWJSzF

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2840	Unicorn-55734.exe
3188	Unicorn-25366.exe
3464	Unicorn-13668.exe
3320	Unicorn-12078.exe
4760	Unicorn-20247.exe
3776	Unicorn-381.exe
2280	Unicorn-23628.exe
4908	Unicorn-35763.exe
3236	Unicorn-32233.exe
3960	Unicorn-56183.exe
4832	Unicorn-56183.exe
3012	Unicorn-11258.exe
3604	Unicorn-1044.exe
3916	Unicorn-6909.exe
4312	Unicorn-3645.exe
2952	Unicorn-62727.exe
4064	Unicorn-30225.exe
756	Unicorn-47351.exe
3528	Unicorn-63117.exe
3860	Unicorn-22655.exe
2748	Unicorn-26739.exe
2308	Unicorn-27293.exe
4736	Unicorn-41029.exe
752	Unicorn-2234.exe
5056	Unicorn-6318.exe
2896	Unicorn-60158.exe
1456	Unicorn-16332.exe
4080	Unicorn-22463.exe
4076	Unicorn-42618.exe
2324	Unicorn-23017.exe
2892	Unicorn-31975.exe
544	Unicorn-20277.exe
2884	Unicorn-15639.exe
5096	Unicorn-23104.exe
3444	Unicorn-45379.exe
3932	Unicorn-4901.exe
3716	Unicorn-13069.exe
744	Unicorn-1414.exe
8	Unicorn-20681.exe
1508	Unicorn-9006.exe
1604	Unicorn-17175.exe
684	Unicorn-34855.exe
1600	Unicorn-47107.exe
3740	Unicorn-50926.exe
1204	Unicorn-43769.exe
3284	Unicorn-51938.exe
1524	Unicorn-6266.exe
264	Unicorn-14434.exe
1116	Unicorn-56022.exe
4844	Unicorn-30579.exe
3476	Unicorn-28532.exe
4072	Unicorn-34663.exe
2084	Unicorn-43577.exe
2236	Unicorn-6074.exe
2700	Unicorn-62681.exe
2388	Unicorn-6074.exe
3352	Unicorn-10521.exe
456	Unicorn-24256.exe
1636	Unicorn-30122.exe
1956	Unicorn-1990.exe
4972	Unicorn-60319.exe
2772	Unicorn-64958.exe
4300	Unicorn-19287.exe
1304	Unicorn-29300.exe

Program crash 4 IoCs

pid	pid_target	Process	procid_target
5752	3340	WerFault.exe	169
6092	2484	WerFault.exe	168
6888	3340	WerFault.exe	169
7112	2484	WerFault.exe	168

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25366.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49493.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36646.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12089.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53062.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6220.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12399.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14185.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64087.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29200.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37398.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58327.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53599.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53069.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7552.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13572.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53062.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7028.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53873.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21321.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61356.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4060.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64620.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28532.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20484.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1373.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32842.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22655.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23905.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49177.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14434.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58662.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43769.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4947.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57595.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37170.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30780.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-12758.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30839.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39281.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17463.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2385.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5212.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55196.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60615.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24923.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64538.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14502.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17536.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58525.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39962.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37049.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21031.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34533.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	6616	dwm.exe
Token: SeChangeNotifyPrivilege	6616	dwm.exe
Token: 33	6616	dwm.exe
Token: SeIncBasePriorityPrivilege	6616	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4996	bd4a44e9de807dee4a64e8adb71d37dc5cec5d6a5b858a5873666007a72ef45fN.exe
2840	Unicorn-55734.exe
3188	Unicorn-25366.exe
3464	Unicorn-13668.exe
3320	Unicorn-12078.exe
4760	Unicorn-20247.exe
2280	Unicorn-23628.exe
3776	Unicorn-381.exe
4908	Unicorn-35763.exe
3960	Unicorn-56183.exe
4832	Unicorn-56183.exe
3236	Unicorn-32233.exe
4312	Unicorn-3645.exe
3916	Unicorn-6909.exe
3604	Unicorn-1044.exe
3012	Unicorn-11258.exe
2952	Unicorn-62727.exe
4064	Unicorn-30225.exe
756	Unicorn-47351.exe
3528	Unicorn-63117.exe
2748	Unicorn-26739.exe
3860	Unicorn-22655.exe
4736	Unicorn-41029.exe
2896	Unicorn-60158.exe
2308	Unicorn-27293.exe
4080	Unicorn-22463.exe
4076	Unicorn-42618.exe
752	Unicorn-2234.exe
1456	Unicorn-16332.exe
2324	Unicorn-23017.exe
5056	Unicorn-6318.exe
2892	Unicorn-31975.exe
544	Unicorn-20277.exe
2884	Unicorn-15639.exe
5096	Unicorn-23104.exe
3444	Unicorn-45379.exe
3932	Unicorn-4901.exe
3716	Unicorn-13069.exe
744	Unicorn-1414.exe
8	Unicorn-20681.exe
1508	Unicorn-9006.exe
1604	Unicorn-17175.exe
684	Unicorn-34855.exe
1600	Unicorn-47107.exe
3740	Unicorn-50926.exe
3284	Unicorn-51938.exe
1204	Unicorn-43769.exe
1116	Unicorn-56022.exe
264	Unicorn-14434.exe
1524	Unicorn-6266.exe
3476	Unicorn-28532.exe
2084	Unicorn-43577.exe
4072	Unicorn-34663.exe
456	Unicorn-24256.exe
2700	Unicorn-62681.exe
4844	Unicorn-30579.exe
2236	Unicorn-6074.exe
3352	Unicorn-10521.exe
1636	Unicorn-30122.exe
2388	Unicorn-6074.exe
1956	Unicorn-1990.exe
2772	Unicorn-64958.exe
4972	Unicorn-60319.exe
1912	Unicorn-60127.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 2840	4996	bd4a44e9de807dee4a64e8adb71d37dc5cec5d6a5b858a5873666007a72ef45fN.exe	82
PID 4996 wrote to memory of 2840	4996	bd4a44e9de807dee4a64e8adb71d37dc5cec5d6a5b858a5873666007a72ef45fN.exe	82
PID 4996 wrote to memory of 2840	4996	bd4a44e9de807dee4a64e8adb71d37dc5cec5d6a5b858a5873666007a72ef45fN.exe	82
PID 2840 wrote to memory of 3188	2840	Unicorn-55734.exe	83
PID 2840 wrote to memory of 3188	2840	Unicorn-55734.exe	83
PID 2840 wrote to memory of 3188	2840	Unicorn-55734.exe	83
PID 4996 wrote to memory of 3464	4996	bd4a44e9de807dee4a64e8adb71d37dc5cec5d6a5b858a5873666007a72ef45fN.exe	84
PID 4996 wrote to memory of 3464	4996	bd4a44e9de807dee4a64e8adb71d37dc5cec5d6a5b858a5873666007a72ef45fN.exe	84
PID 4996 wrote to memory of 3464	4996	bd4a44e9de807dee4a64e8adb71d37dc5cec5d6a5b858a5873666007a72ef45fN.exe	84
PID 3188 wrote to memory of 3320	3188	Unicorn-25366.exe	85
PID 3188 wrote to memory of 3320	3188	Unicorn-25366.exe	85
PID 3188 wrote to memory of 3320	3188	Unicorn-25366.exe	85
PID 3464 wrote to memory of 4760	3464	Unicorn-13668.exe	86
PID 3464 wrote to memory of 4760	3464	Unicorn-13668.exe	86
PID 3464 wrote to memory of 4760	3464	Unicorn-13668.exe	86
PID 2840 wrote to memory of 3776	2840	Unicorn-55734.exe	87
PID 2840 wrote to memory of 3776	2840	Unicorn-55734.exe	87
PID 2840 wrote to memory of 3776	2840	Unicorn-55734.exe	87
PID 4996 wrote to memory of 2280	4996	bd4a44e9de807dee4a64e8adb71d37dc5cec5d6a5b858a5873666007a72ef45fN.exe	88
PID 4996 wrote to memory of 2280	4996	bd4a44e9de807dee4a64e8adb71d37dc5cec5d6a5b858a5873666007a72ef45fN.exe	88
PID 4996 wrote to memory of 2280	4996	bd4a44e9de807dee4a64e8adb71d37dc5cec5d6a5b858a5873666007a72ef45fN.exe	88
PID 3320 wrote to memory of 4908	3320	Unicorn-12078.exe	91
PID 3320 wrote to memory of 4908	3320	Unicorn-12078.exe	91
PID 3320 wrote to memory of 4908	3320	Unicorn-12078.exe	91
PID 3188 wrote to memory of 3236	3188	Unicorn-25366.exe	92
PID 3188 wrote to memory of 3236	3188	Unicorn-25366.exe	92
PID 3188 wrote to memory of 3236	3188	Unicorn-25366.exe	92
PID 3776 wrote to memory of 4832	3776	Unicorn-381.exe	94
PID 3776 wrote to memory of 4832	3776	Unicorn-381.exe	94
PID 3776 wrote to memory of 4832	3776	Unicorn-381.exe	94
PID 2280 wrote to memory of 3960	2280	Unicorn-23628.exe	93
PID 2280 wrote to memory of 3960	2280	Unicorn-23628.exe	93
PID 2280 wrote to memory of 3960	2280	Unicorn-23628.exe	93
PID 4760 wrote to memory of 3012	4760	Unicorn-20247.exe	95
PID 4760 wrote to memory of 3012	4760	Unicorn-20247.exe	95
PID 4760 wrote to memory of 3012	4760	Unicorn-20247.exe	95
PID 2840 wrote to memory of 3604	2840	Unicorn-55734.exe	96
PID 2840 wrote to memory of 3604	2840	Unicorn-55734.exe	96
PID 2840 wrote to memory of 3604	2840	Unicorn-55734.exe	96
PID 4996 wrote to memory of 3916	4996	bd4a44e9de807dee4a64e8adb71d37dc5cec5d6a5b858a5873666007a72ef45fN.exe	97
PID 4996 wrote to memory of 3916	4996	bd4a44e9de807dee4a64e8adb71d37dc5cec5d6a5b858a5873666007a72ef45fN.exe	97
PID 4996 wrote to memory of 3916	4996	bd4a44e9de807dee4a64e8adb71d37dc5cec5d6a5b858a5873666007a72ef45fN.exe	97
PID 3464 wrote to memory of 4312	3464	Unicorn-13668.exe	98
PID 3464 wrote to memory of 4312	3464	Unicorn-13668.exe	98
PID 3464 wrote to memory of 4312	3464	Unicorn-13668.exe	98
PID 4908 wrote to memory of 2952	4908	Unicorn-35763.exe	101
PID 4908 wrote to memory of 2952	4908	Unicorn-35763.exe	101
PID 4908 wrote to memory of 2952	4908	Unicorn-35763.exe	101
PID 3320 wrote to memory of 4064	3320	Unicorn-12078.exe	102
PID 3320 wrote to memory of 4064	3320	Unicorn-12078.exe	102
PID 3320 wrote to memory of 4064	3320	Unicorn-12078.exe	102
PID 3916 wrote to memory of 756	3916	Unicorn-6909.exe	104
PID 3916 wrote to memory of 756	3916	Unicorn-6909.exe	104
PID 3916 wrote to memory of 756	3916	Unicorn-6909.exe	104
PID 4996 wrote to memory of 3528	4996	bd4a44e9de807dee4a64e8adb71d37dc5cec5d6a5b858a5873666007a72ef45fN.exe	105
PID 4996 wrote to memory of 3528	4996	bd4a44e9de807dee4a64e8adb71d37dc5cec5d6a5b858a5873666007a72ef45fN.exe	105
PID 4996 wrote to memory of 3528	4996	bd4a44e9de807dee4a64e8adb71d37dc5cec5d6a5b858a5873666007a72ef45fN.exe	105
PID 4312 wrote to memory of 3860	4312	Unicorn-3645.exe	106
PID 4312 wrote to memory of 3860	4312	Unicorn-3645.exe	106
PID 4312 wrote to memory of 3860	4312	Unicorn-3645.exe	106
PID 3960 wrote to memory of 2748	3960	Unicorn-56183.exe	107
PID 3960 wrote to memory of 2748	3960	Unicorn-56183.exe	107
PID 3960 wrote to memory of 2748	3960	Unicorn-56183.exe	107
PID 2280 wrote to memory of 2308	2280	Unicorn-23628.exe	108

C:\Users\Admin\AppData\Local\Temp\bd4a44e9de807dee4a64e8adb71d37dc5cec5d6a5b858a5873666007a72ef45fN.exe
"C:\Users\Admin\AppData\Local\Temp\bd4a44e9de807dee4a64e8adb71d37dc5cec5d6a5b858a5873666007a72ef45fN.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Users\Admin\AppData\Local\Temp\Unicorn-55734.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-55734.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25366.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25366.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12078.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12078.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35763.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62727.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31975.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60319.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29649.exe
        9⤵
        
        PID:5288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39281.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:10076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23084.exe
        10⤵
        
        PID:14252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38860.exe
        10⤵
        
        PID:4220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47241.exe
        9⤵
        
        PID:9060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18477.exe
        9⤵
        
        PID:12696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54029.exe
        9⤵
        
        PID:17336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7501.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7501.exe
        8⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61731.exe
        9⤵
        
        PID:9464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1373.exe
        9⤵
        
        PID:13912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62641.exe
        9⤵
        
        PID:18340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53873.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15789.exe
        8⤵
        
        PID:12404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12228.exe
        8⤵
        
        PID:5068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64958.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25565.exe
        8⤵
        
        PID:5164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17191.exe
        9⤵
        
        PID:9252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29200.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:17080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25442.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25442.exe
        8⤵
        
        PID:9600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12308.exe
        8⤵
        
        PID:13984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17536.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17536.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50683.exe
        8⤵
        
        PID:8756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16993.exe
        8⤵
        
        PID:12748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55869.exe
        8⤵
        
        PID:16668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56309.exe
        7⤵
        
        PID:8332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55114.exe
        7⤵
        
        PID:13252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26931.exe
        7⤵
        
        PID:15032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20277.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19287.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19287.exe
        7⤵
        Executes dropped EXE
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29649.exe
        8⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47642.exe
        9⤵
        
        PID:9892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14724.exe
        9⤵
        
        PID:14208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22716.exe
        9⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29560.exe
        8⤵
        
        PID:8800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46682.exe
        8⤵
        
        PID:12812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53069.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:16748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49110.exe
        7⤵
        
        PID:6368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19407.exe
        8⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55374.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47309.exe
        8⤵
        
        PID:2476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
        8⤵
        
        PID:6816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7796.exe
        7⤵
        
        PID:8616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24726.exe
        7⤵
        
        PID:12136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49177.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29300.exe
        6⤵
        Executes dropped EXE
        
        PID:1304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50527.exe
        7⤵
        
        PID:5888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4886.exe
        8⤵
        
        PID:7488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58919.exe
        9⤵
        
        PID:5076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64568.exe
        9⤵
        
        PID:3360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52573.exe
        8⤵
        
        PID:1964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9865.exe
        8⤵
        
        PID:16732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64205.exe
        7⤵
        
        PID:8484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23382.exe
        7⤵
        
        PID:11792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61621.exe
        7⤵
        
        PID:16416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38586.exe
        6⤵
        
        PID:5744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48711.exe
        7⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
        7⤵
        
        PID:10508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29008.exe
        7⤵
        
        PID:17436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7928.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7928.exe
        6⤵
        
        PID:8428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46331.exe
        6⤵
        
        PID:13136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13376.exe
        6⤵
        
        PID:17540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30225.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15639.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60127.exe
        7⤵
        Suspicious use of SetWindowsHookEx
        
        PID:1912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42359.exe
        8⤵
        
        PID:5708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27781.exe
        9⤵
        
        PID:7468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12089.exe
        9⤵
        
        PID:10384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
        9⤵
        
        PID:2144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63732.exe
        9⤵
        
        PID:8864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64205.exe
        8⤵
        
        PID:8284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41717.exe
        8⤵
        
        PID:13172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37301.exe
        8⤵
        
        PID:16644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47958.exe
        7⤵
        
        PID:5596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16371.exe
        8⤵
        
        PID:7208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52707.exe
        9⤵
        
        PID:9352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30780.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24673.exe
        8⤵
        
        PID:9792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53173.exe
        8⤵
        
        PID:13900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe
        8⤵
        
        PID:17608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45601.exe
        7⤵
        
        PID:7408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55219.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55219.exe
        8⤵
        
        PID:14540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57516.exe
        8⤵
        
        PID:5924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3424.exe
        7⤵
        
        PID:12604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36533.exe
        7⤵
        
        PID:16712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40069.exe
        6⤵
        
        PID:4548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58695.exe
        7⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4886.exe
        8⤵
        
        PID:7504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38483.exe
        9⤵
        
        PID:11496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25405.exe
        9⤵
        
        PID:15444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33866.exe
        9⤵
        
        PID:9340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8721.exe
        8⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16992.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16992.exe
        8⤵
        
        PID:14972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33344.exe
        8⤵
        
        PID:4536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64538.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31867.exe
        8⤵
        
        PID:14732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12399.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:2152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61325.exe
        7⤵
        
        PID:10688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44046.exe
        7⤵
        
        PID:14500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12300.exe
        6⤵
        
        PID:5692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16859.exe
        7⤵
        
        PID:8444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12141.exe
        7⤵
        
        PID:11392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15028.exe
        7⤵
        
        PID:15296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41482.exe
        6⤵
        
        PID:8364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49493.exe
        6⤵
        
        PID:13212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53599.exe
        6⤵
        
        PID:16724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23104.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1305.exe
        6⤵
        
        PID:5212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36599.exe
        7⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54679.exe
        8⤵
        
        PID:9684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1373.exe
        8⤵
        
        PID:13948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4947.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31497.exe
        7⤵
        
        PID:9860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18808.exe
        7⤵
        
        PID:14180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42944.exe
        7⤵
        
        PID:1184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32772.exe
        6⤵
        
        PID:7624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62530.exe
        6⤵
        
        PID:10736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44125.exe
        6⤵
        
        PID:15096
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7951.exe
        6⤵
        
        PID:7740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59670.exe
        5⤵
        
        PID:4060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38083.exe
        6⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21031.exe
        7⤵
        
        PID:4700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42043.exe
        8⤵
        
        PID:9740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1373.exe
        8⤵
        
        PID:13904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19555.exe
        8⤵
        
        PID:5516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10204.exe
        7⤵
        
        PID:10472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22858.exe
        7⤵
        
        PID:14992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54995.exe
        7⤵
        
        PID:8152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3469.exe
        6⤵
        
        PID:8020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8005.exe
        6⤵
        
        PID:11112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
        6⤵
        
        PID:14752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26028.exe
        5⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
        6⤵
        
        PID:9120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38565.exe
        6⤵
        
        PID:12472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6860.exe
        6⤵
        
        PID:15488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35651.exe
        5⤵
        
        PID:8912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12932.exe
        5⤵
        
        PID:12848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26733.exe
        5⤵
        
        PID:16676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32233.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32233.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6318.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6074.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8726.exe
        7⤵
        
        PID:5520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21031.exe
        8⤵
        
        PID:6484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47803.exe
        9⤵
        
        PID:11972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42701.exe
        9⤵
        
        PID:15596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17530.exe
        9⤵
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2333.exe
        8⤵
        
        PID:10028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23084.exe
        8⤵
        
        PID:14260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22716.exe
        8⤵
        
        PID:15972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15721.exe
        7⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15863.exe
        8⤵
        
        PID:10264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52406.exe
        8⤵
        
        PID:16360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61325.exe
        7⤵
        
        PID:10516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44046.exe
        7⤵
        
        PID:4180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27802.exe
        7⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23645.exe
        6⤵
        
        PID:6032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21031.exe
        7⤵
        
        PID:6176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52707.exe
        8⤵
        
        PID:9380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18825.exe
        8⤵
        
        PID:14344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55107.exe
        8⤵
        
        PID:6376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18372.exe
        7⤵
        
        PID:10544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22858.exe
        7⤵
        
        PID:15008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17204.exe
        6⤵
        
        PID:8012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1653.exe
        6⤵
        
        PID:10460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31296.exe
        6⤵
        
        PID:1936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10521.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8726.exe
        6⤵
        
        PID:5528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12286.exe
        7⤵
        
        PID:7220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37959.exe
        8⤵
        
        PID:9696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1373.exe
        8⤵
        
        PID:13932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4755.exe
        8⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46246.exe
        7⤵
        
        PID:9876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50241.exe
        7⤵
        
        PID:14444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16047.exe
        7⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27781.exe
        6⤵
        
        PID:7448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12089.exe
        6⤵
        
        PID:10612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61621.exe
        6⤵
        
        PID:16452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16576.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16576.exe
        5⤵
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
        6⤵
        
        PID:9128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13572.exe
        6⤵
        
        PID:12200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42658.exe
        6⤵
        
        PID:17832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12893.exe
        5⤵
        
        PID:8216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15578.exe
        5⤵
        
        PID:13780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21352.exe
        5⤵
        
        PID:17820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16332.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6074.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62011.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62011.exe
        6⤵
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11326.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11326.exe
        7⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4362.exe
        8⤵
        
        PID:9496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33085.exe
        8⤵
        
        PID:13740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16372.exe
        8⤵
        
        PID:17796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2909.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2909.exe
        7⤵
        
        PID:9768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55949.exe
        7⤵
        
        PID:14076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16318.exe
        7⤵
        
        PID:7452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14185.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58637.exe
        6⤵
        
        PID:9808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59038.exe
        6⤵
        
        PID:13836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34278.exe
        6⤵
        
        PID:14824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27345.exe
        5⤵
        
        PID:5460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4030.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4030.exe
        6⤵
        
        PID:768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60226.exe
        6⤵
        
        PID:12140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62057.exe
        6⤵
        
        PID:16216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23172.exe
        5⤵
        
        PID:8336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41717.exe
        5⤵
        
        PID:13164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29133.exe
        5⤵
        
        PID:16588
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30122.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30122.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8726.exe
        5⤵
        
        PID:5568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12286.exe
        6⤵
        
        PID:7228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48343.exe
        7⤵
        
        PID:11492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62746.exe
        7⤵
        
        PID:15032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57691.exe
        7⤵
        
        PID:2788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24150.exe
        6⤵
        
        PID:12424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
        6⤵
        
        PID:1260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43503.exe
        6⤵
        
        PID:18236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27781.exe
        5⤵
        
        PID:7660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6874.exe
        6⤵
        
        PID:13120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24401.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24401.exe
        6⤵
        
        PID:18204
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26518.exe
        6⤵
        
        PID:6332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12089.exe
        5⤵
        
        PID:10420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61621.exe
        5⤵
        
        PID:16436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43503.exe
        5⤵
        
        PID:8496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54809.exe
      4⤵
      PID:5504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14502.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54710.exe
        5⤵
        
        PID:12572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8012.exe
        5⤵
        
        PID:17140
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3837.exe
      4⤵
      PID:8348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23606.exe
      4⤵
      PID:11592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56764.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56764.exe
      4⤵
      PID:15412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-381.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-381.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56183.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56183.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2234.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34855.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25255.exe
        7⤵
        
        PID:5336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40683.exe
        8⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7398.exe
        9⤵
        
        PID:9760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26993.exe
        9⤵
        
        PID:14420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46747.exe
        9⤵
        
        PID:6132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55897.exe
        8⤵
        
        PID:10288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46594.exe
        8⤵
        
        PID:14456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16510.exe
        8⤵
        
        PID:4516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19037.exe
        7⤵
        
        PID:7608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27191.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27191.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42465.exe
        8⤵
        
        PID:13844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56665.exe
        7⤵
        
        PID:10728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52790.exe
        7⤵
        
        PID:15060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18217.exe
        6⤵
        
        PID:5832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20455.exe
        7⤵
        
        PID:7236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15146.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15146.exe
        8⤵
        
        PID:14848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33203.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33203.exe
        8⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32841.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32841.exe
        7⤵
        
        PID:9648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61342.exe
        7⤵
        
        PID:15396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37398.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61503.exe
        7⤵
        
        PID:12324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15465.exe
        7⤵
        
        PID:16524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61746.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61746.exe
        6⤵
        
        PID:13244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33755.exe
        6⤵
        
        PID:16404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56022.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8918.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8918.exe
        6⤵
        
        PID:5316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43926.exe
        7⤵
        
        PID:8096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34399.exe
        8⤵
        
        PID:11468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21321.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:15416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47899.exe
        8⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12089.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
        7⤵
        
        PID:4740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64205.exe
        6⤵
        
        PID:8268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41717.exe
        6⤵
        
        PID:12484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4437.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4437.exe
        6⤵
        
        PID:1960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3364.exe
        5⤵
        
        PID:5988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57595.exe
        6⤵
        
        PID:3332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62027.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62027.exe
        7⤵
        
        PID:10312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26993.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26993.exe
        7⤵
        
        PID:14428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30218.exe
        7⤵
        
        PID:1852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23905.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23905.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15840.exe
        6⤵
        
        PID:13964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55196.exe
        6⤵
        
        PID:15132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47382.exe
        5⤵
        
        PID:7556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29755.exe
        6⤵
        
        PID:13492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19259.exe
        6⤵
        
        PID:2340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58525.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14761.exe
        5⤵
        
        PID:14364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60158.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60158.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14434.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9110.exe
        6⤵
        
        PID:5192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44855.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44855.exe
        7⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31659.exe
        8⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1742.exe
        9⤵
        
        PID:14468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64376.exe
        9⤵
        
        PID:652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15493.exe
        8⤵
        
        PID:12056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62057.exe
        8⤵
        
        PID:16316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23396.exe
        8⤵
        
        PID:8592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27885.exe
        7⤵
        
        PID:9048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9924.exe
        7⤵
        
        PID:12392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12725.exe
        7⤵
        
        PID:4744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18321.exe
        6⤵
        
        PID:6004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55321.exe
        7⤵
        
        PID:10620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22858.exe
        7⤵
        
        PID:14532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1740.exe
        6⤵
        
        PID:8964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40050.exe
        6⤵
        
        PID:12052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5980.exe
        6⤵
        
        PID:17332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18217.exe
        5⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24923.exe
        6⤵
        
        PID:7084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-766.exe
        7⤵
        
        PID:11100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57310.exe
        7⤵
        
        PID:15640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48689.exe
        6⤵
        
        PID:11516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54134.exe
        6⤵
        
        PID:15512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43703.exe
        6⤵
        
        PID:18240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12736.exe
        5⤵
        
        PID:1360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1653.exe
        5⤵
        
        PID:10668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35380.exe
        5⤵
        
        PID:2684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63732.exe
        5⤵
        
        PID:8732
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28532.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25255.exe
        5⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36983.exe
        6⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46859.exe
        7⤵
        
        PID:14508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56208.exe
        7⤵
        
        PID:17632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16313.exe
        6⤵
        
        PID:9728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36646.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19421.exe
        5⤵
        
        PID:7296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61325.exe
        5⤵
        
        PID:10500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44046.exe
        5⤵
        
        PID:14492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43901.exe
      4⤵
      PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7870.exe
        5⤵
        
        PID:8232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60714.exe
        5⤵
        
        PID:12588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49621.exe
        5⤵
        
        PID:17560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33961.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33961.exe
      4⤵
      PID:8552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4530.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4530.exe
      4⤵
      PID:12624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32068.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32068.exe
      4⤵
      PID:16540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1044.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1044.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22463.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34663.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8726.exe
        6⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2125.exe
        7⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41097.exe
        7⤵
        
        PID:10352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11181.exe
        7⤵
        
        PID:15332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5212.exe
        7⤵
        
        PID:17092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2125.exe
        6⤵
        
        PID:7848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22355.exe
        7⤵
        
        PID:14524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56208.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56208.exe
        7⤵
        
        PID:1392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20484.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11181.exe
        6⤵
        
        PID:15324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5212.exe
        6⤵
        
        PID:17152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15093.exe
        5⤵
        
        PID:5580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40875.exe
        6⤵
        
        PID:5180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
        7⤵
        
        PID:11080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53226.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53226.exe
        7⤵
        
        PID:15248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65322.exe
        6⤵
        
        PID:10192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32560.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32560.exe
        6⤵
        
        PID:5840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61356.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61356.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37049.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37049.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3424.exe
        5⤵
        
        PID:12224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61230.exe
        5⤵
        
        PID:14380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43577.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43577.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8726.exe
        5⤵
        
        PID:5560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23771.exe
        6⤵
        
        PID:5592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60963.exe
        7⤵
        
        PID:9224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
        7⤵
        
        PID:12908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29200.exe
        7⤵
        
        PID:17168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23137.exe
        6⤵
        
        PID:9932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23084.exe
        6⤵
        
        PID:14228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55196.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2125.exe
        5⤵
        
        PID:7864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21955.exe
        6⤵
        
        PID:11364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33573.exe
        6⤵
        
        PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41097.exe
        5⤵
        
        PID:10092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11181.exe
        5⤵
        
        PID:15340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5212.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28828.exe
      4⤵
      PID:5172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11985.exe
        5⤵
        
        PID:8084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3572.exe
        5⤵
        
        PID:11324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53174.exe
        5⤵
        
        PID:15364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20594.exe
        5⤵
        
        PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47382.exe
      4⤵
      PID:7632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9142.exe
        5⤵
        
        PID:14040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7007.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:17628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
      4⤵
      PID:12204
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4590.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4590.exe
      4⤵
      PID:13956
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42618.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42618.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30579.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30579.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25255.exe
        5⤵
        
        PID:5300
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5898.exe
        6⤵
        
        PID:6592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31607.exe
        7⤵
        
        PID:8900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22997.exe
        7⤵
        
        PID:12840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55869.exe
        7⤵
        
        PID:16756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31392.exe
        6⤵
        
        PID:9756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46594.exe
        6⤵
        
        PID:14404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7382.exe
        6⤵
        
        PID:6776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14185.exe
        5⤵
        
        PID:2252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53911.exe
        6⤵
        
        PID:14136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27427.exe
        6⤵
        
        PID:18384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25774.exe
        5⤵
        
        PID:11432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32256.exe
        5⤵
        
        PID:15424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30661.exe
      4⤵
      PID:5864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53895.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53895.exe
        5⤵
        
        PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18372.exe
        5⤵
        
        PID:10536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22858.exe
        5⤵
        
        PID:14980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33506.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33506.exe
      4⤵
      PID:7980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18743.exe
        5⤵
        
        PID:12632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44246.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44246.exe
        5⤵
        
        PID:17288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14908.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14908.exe
      4⤵
      PID:11308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61230.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61230.exe
      4⤵
      PID:4968
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62681.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62681.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25255.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25255.exe
      4⤵
      PID:5344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24923.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24969.exe
        6⤵
        
        PID:12444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6860.exe
        6⤵
        
        PID:3652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44902.exe
        5⤵
        
        PID:6908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40729.exe
        5⤵
        
        PID:14368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16047.exe
        5⤵
        
        PID:6948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64538.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64538.exe
      4⤵
      PID:7768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12089.exe
      4⤵
      PID:10636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
      4⤵
      PID:14988
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-25061.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-25061.exe
    3⤵
    PID:5872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32515.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32515.exe
      4⤵
      PID:6872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17923.exe
        5⤵
        
        PID:9568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58217.exe
        5⤵
        
        PID:14760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59472.exe
        5⤵
        
        PID:712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43645.exe
      4⤵
      PID:10300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46594.exe
      4⤵
      PID:14396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15550.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15550.exe
      4⤵
      PID:6688
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22334.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22334.exe
    3⤵
    PID:7560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
      4⤵
      PID:11056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49805.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49805.exe
      4⤵
      PID:16252
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32864.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32864.exe
    3⤵
    PID:10716
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17789.exe
    3⤵
    PID:15072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13015.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13015.exe
    3⤵
    PID:7340
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13668.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13668.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3464
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20247.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20247.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11258.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4901.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4901.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51383.exe
        6⤵
        
        PID:4464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59655.exe
        7⤵
        
        PID:5648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18483.exe
        8⤵
        
        PID:7528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10065.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10065.exe
        8⤵
        
        PID:10660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18336.exe
        8⤵
        
        PID:15128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64538.exe
        7⤵
        
        PID:7776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12089.exe
        7⤵
        
        PID:10448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:1152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49110.exe
        6⤵
        
        PID:6384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4886.exe
        7⤵
        
        PID:7480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26999.exe
        8⤵
        
        PID:12004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48322.exe
        8⤵
        
        PID:16280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20462.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20462.exe
        8⤵
        
        PID:7460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52573.exe
        7⤵
        
        PID:13304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50322.exe
        7⤵
        
        PID:18088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48317.exe
        7⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4533.exe
        6⤵
        
        PID:8252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49493.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53599.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8496.exe
        5⤵
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33400.exe
        6⤵
        
        PID:6784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24481.exe
        7⤵
        
        PID:10068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53173.exe
        7⤵
        
        PID:13928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55196.exe
        7⤵
        
        PID:4228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51290.exe
        6⤵
        
        PID:9800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53149.exe
        6⤵
        
        PID:14084
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30445.exe
        6⤵
        
        PID:8040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19317.exe
        5⤵
        
        PID:6444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13572.exe
        6⤵
        
        PID:13296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1241.exe
        6⤵
        
        PID:17348
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58089.exe
        5⤵
        
        PID:8788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46651.exe
        6⤵
        
        PID:11540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30020.exe
        6⤵
        
        PID:15356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64678.exe
        5⤵
        
        PID:11484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12758.exe
        5⤵
        
        PID:15456
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23017.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1990.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1956
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8726.exe
        6⤵
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33283.exe
        7⤵
        
        PID:5756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44347.exe
        8⤵
        
        PID:8424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30780.exe
        8⤵
        
        PID:15472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59702.exe
        7⤵
        
        PID:10224
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28284.exe
        7⤵
        
        PID:13620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18631.exe
        7⤵
        
        PID:4580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27640.exe
        6⤵
        
        PID:8004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23574.exe
        6⤵
        
        PID:11624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12228.exe
        6⤵
        
        PID:16328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39301.exe
        5⤵
        
        PID:1068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42235.exe
        6⤵
        
        PID:9652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1373.exe
        6⤵
        
        PID:14020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40936.exe
        6⤵
        
        PID:6228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35426.exe
        5⤵
        
        PID:8808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38016.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38016.exe
        5⤵
        
        PID:12804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36533.exe
        5⤵
        
        PID:16552
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24256.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24256.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25255.exe
        5⤵
        
        PID:5264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10101.exe
        6⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57279.exe
        7⤵
        
        PID:11664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50686.exe
        7⤵
        
        PID:16472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24826.exe
        7⤵
        
        PID:2224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25774.exe
        6⤵
        
        PID:11424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44509.exe
        6⤵
        
        PID:4544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17463.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17936.exe
        5⤵
        
        PID:7264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3424.exe
        5⤵
        
        PID:10252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45085.exe
        5⤵
        
        PID:16488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50262.exe
      4⤵
      PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45374.exe
        5⤵
        
        PID:8324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8912.exe
        5⤵
        
        PID:12832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11274.exe
        5⤵
        
        PID:16128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4228.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4228.exe
      4⤵
      PID:8224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48343.exe
        5⤵
        
        PID:11488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58662.exe
        5⤵
        
        PID:5080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6541.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6541.exe
      4⤵
      PID:11380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12758.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3645.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3645.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4312
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22655.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22655.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3860
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17175.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28571.exe
        6⤵
        
        PID:3340
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 436
        7⤵
        Program crash
        
        PID:5752
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 3340 -s 400
        7⤵
        Program crash
        
        PID:6888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64538.exe
        6⤵
        
        PID:7352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24939.exe
        7⤵
        
        PID:14284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16291.exe
        7⤵
        
        PID:5916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61325.exe
        6⤵
        
        PID:10800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44046.exe
        6⤵
        
        PID:14356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55955.exe
        6⤵
        
        PID:8956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25809.exe
        5⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36599.exe
        6⤵
        
        PID:6968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38151.exe
        7⤵
        
        PID:9624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1373.exe
        7⤵
        
        PID:13920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48720.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43645.exe
        6⤵
        
        PID:10280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46594.exe
        6⤵
        
        PID:14412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10506.exe
        6⤵
        
        PID:6296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32772.exe
        5⤵
        
        PID:7616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62530.exe
        5⤵
        
        PID:10708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44125.exe
        5⤵
        
        PID:15088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39419.exe
        5⤵
        
        PID:8644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43769.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43769.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:1204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28571.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28571.exe
        5⤵
        
        PID:2484
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 464
        6⤵
        Program crash
        
        PID:6092
      - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2484 -s 508
        6⤵
        Program crash
        
        PID:7112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64205.exe
        5⤵
        
        PID:8276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28831.exe
        6⤵
        
        PID:12756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15273.exe
        6⤵
        
        PID:17472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41717.exe
        5⤵
        
        PID:13152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21157.exe
        5⤵
        
        PID:17124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23592.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23592.exe
      4⤵
      PID:1708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52255.exe
        5⤵
        
        PID:6584
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
        6⤵
        
        PID:9172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26313.exe
        6⤵
        
        PID:12524
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8012.exe
        6⤵
        
        PID:17304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51046.exe
        5⤵
        
        PID:8848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30728.exe
        5⤵
        
        PID:12312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12725.exe
        5⤵
        
        PID:2384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39354.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39354.exe
      4⤵
      PID:6832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37943.exe
        5⤵
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11072
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16940.exe
        6⤵
        
        PID:15576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34496.exe
        6⤵
        
        PID:7440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19908.exe
        5⤵
        
        PID:11404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57258.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30740.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30740.exe
      4⤵
      PID:8088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49495.exe
        5⤵
        
        PID:11136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58662.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65407.exe
      4⤵
      PID:12276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48596.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48596.exe
      4⤵
      PID:3628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41029.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41029.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9006.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9006.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57543.exe
        5⤵
        
        PID:3808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10262.exe
        6⤵
        
        PID:6204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50683.exe
        7⤵
        
        PID:8768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4741.exe
        7⤵
        
        PID:11316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15028.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51430.exe
        6⤵
        
        PID:8576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2332.exe
        6⤵
        
        PID:12068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4749.exe
        6⤵
        
        PID:16444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36473.exe
        5⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48711.exe
        6⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43335.exe
        7⤵
        
        PID:12268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60574.exe
        7⤵
        
        PID:16376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17569.exe
        6⤵
        
        PID:12704
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55869.exe
        6⤵
        
        PID:16764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26328.exe
        6⤵
        
        PID:7892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36193.exe
        5⤵
        
        PID:8916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48846.exe
        5⤵
        
        PID:12332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
        5⤵
        
        PID:16212
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20765.exe
      4⤵
      PID:3328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60615.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17923.exe
        6⤵
        
        PID:9560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58217.exe
        6⤵
        
        PID:14768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59472.exe
        6⤵
        
        PID:3552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51046.exe
        5⤵
        
        PID:8856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30728.exe
        5⤵
        
        PID:12304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12725.exe
        5⤵
        
        PID:1340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33488.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33488.exe
      4⤵
      PID:6728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17923.exe
        5⤵
        
        PID:9508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13817.exe
        5⤵
        
        PID:13976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62641.exe
        5⤵
        
        PID:18332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4179.exe
        5⤵
        
        PID:6320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30958.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30958.exe
      4⤵
      PID:9008
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7124.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7124.exe
      4⤵
      PID:12376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53062.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14748
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50926.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50926.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9110.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9110.exe
      4⤵
      PID:5200
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2582.exe
        5⤵
        
        PID:6900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61347.exe
        6⤵
        
        PID:8784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23853.exe
        7⤵
        
        PID:8544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20449.exe
        6⤵
        
        PID:12496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60913.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60913.exe
        6⤵
        
        PID:17132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31689.exe
        5⤵
        
        PID:9812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55949.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55949.exe
        5⤵
        
        PID:14068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2969.exe
        5⤵
        
        PID:18304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31066.exe
        5⤵
        
        PID:9364
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50558.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50558.exe
      4⤵
      PID:7472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49495.exe
        5⤵
        
        PID:11416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58662.exe
        5⤵
        
        PID:15376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22456.exe
      4⤵
      PID:10488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22858.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22858.exe
      4⤵
      PID:15660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29152.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29152.exe
    3⤵
    PID:5804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11793.exe
      4⤵
      PID:7712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43911.exe
        5⤵
        
        PID:11804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34533.exe
        5⤵
        
        PID:15544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3572.exe
      4⤵
      PID:11336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53174.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53174.exe
      4⤵
      PID:15384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55955.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55955.exe
      4⤵
      PID:8472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54662.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54662.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43876.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43876.exe
    3⤵
    PID:9784
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43261.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43261.exe
    3⤵
    PID:4008
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23628.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23628.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2280
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56183.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56183.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26739.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26739.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47107.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47107.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65519.exe
        6⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31643.exe
        7⤵
        
        PID:6512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10610.exe
        8⤵
        
        PID:9164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26313.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26313.exe
        8⤵
        
        PID:12516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31172.exe
        8⤵
        
        PID:16528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51046.exe
        7⤵
        
        PID:8840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30728.exe
        7⤵
        
        PID:11464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12725.exe
        7⤵
        
        PID:4572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52810.exe
        6⤵
        
        PID:6608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4886.exe
        7⤵
        
        PID:7496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58903.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58903.exe
        8⤵
        
        PID:11648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30020.exe
        8⤵
        
        PID:15320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23396.exe
        8⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33120.exe
        7⤵
        
        PID:12228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2385.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4533.exe
        6⤵
        
        PID:8260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23076.exe
        6⤵
        
        PID:11640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45085.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45085.exe
        6⤵
        
        PID:16464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29125.exe
        5⤵
        
        PID:1308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56339.exe
        6⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41887.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41887.exe
        7⤵
        
        PID:9324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46490.exe
        7⤵
        
        PID:13828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29968.exe
        7⤵
        
        PID:17988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51046.exe
        6⤵
        
        PID:8832
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30728.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30728.exe
        6⤵
        
        PID:12296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13877.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13877.exe
        6⤵
        
        PID:17160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64123.exe
        6⤵
        
        PID:18116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62461.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62461.exe
        5⤵
        
        PID:6624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17923.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17923.exe
        6⤵
        
        PID:9552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1373.exe
        6⤵
        
        PID:13940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49680.exe
        6⤵
        
        PID:7968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26874.exe
        5⤵
        
        PID:8984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40181.exe
        5⤵
        
        PID:12340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53062.exe
        5⤵
        
        PID:1676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51938.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51938.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25255.exe
        5⤵
        
        PID:5256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22619.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22619.exe
        6⤵
        
        PID:6708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36371.exe
        7⤵
        
        PID:10108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14933.exe
        7⤵
        
        PID:13476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16658.exe
        7⤵
        
        PID:3548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42441.exe
        6⤵
        
        PID:9284
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46821.exe
        6⤵
        
        PID:13748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22237.exe
        6⤵
        
        PID:17884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-973.exe
        5⤵
        
        PID:6640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63755.exe
        6⤵
        
        PID:11132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64274.exe
        6⤵
        
        PID:228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9244.exe
        5⤵
        
        PID:10100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32842.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9966.exe
        5⤵
        
        PID:18388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52565.exe
      4⤵
      PID:5928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56635.exe
        5⤵
        
        PID:5188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
        6⤵
        
        PID:11028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20745.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20745.exe
        6⤵
        
        PID:15212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16570.exe
        6⤵
        
        PID:7820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10204.exe
        5⤵
        
        PID:10464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22858.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22858.exe
        5⤵
        
        PID:15000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64123.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64123.exe
        5⤵
        
        PID:9032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58674.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58674.exe
      4⤵
      PID:7952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9142.exe
        5⤵
        
        PID:3540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11091.exe
        5⤵
        
        PID:17884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38297.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38297.exe
      4⤵
      PID:10340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51518.exe
      4⤵
      PID:15300
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27293.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6266.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6266.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8726.exe
        5⤵
        
        PID:5544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20455.exe
        6⤵
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
        7⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58609.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58609.exe
        7⤵
        
        PID:1480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57154.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57154.exe
        6⤵
        
        PID:10024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28668.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28668.exe
        6⤵
        
        PID:14480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2103.exe
        6⤵
        
        PID:5296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31865.exe
        5⤵
        
        PID:7396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61325.exe
        5⤵
        
        PID:10748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39962.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14436
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27729.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27729.exe
      4⤵
      PID:6016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17243.exe
        5⤵
        
        PID:8304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48601.exe
        5⤵
        
        PID:13128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61734.exe
        5⤵
        
        PID:16688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7028.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31742.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31742.exe
      4⤵
      PID:11604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61621.exe
      4⤵
      PID:16396
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24414.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24414.exe
    3⤵
    PID:2920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51295.exe
      4⤵
      PID:5996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47642.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47642.exe
        5⤵
        
        PID:9884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14724.exe
        5⤵
        
        PID:14196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22716.exe
        5⤵
        
        PID:17836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10589.exe
      4⤵
      PID:8504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46651.exe
        5⤵
        
        PID:11532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34533.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:15564
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63275.exe
        5⤵
        
        PID:1216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46105.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46105.exe
      4⤵
      PID:11924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4749.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4749.exe
      4⤵
      PID:16428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60045.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60045.exe
    3⤵
    PID:6348
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18483.exe
      4⤵
      PID:7536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47523.exe
        5⤵
        
        PID:12796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42133.exe
        5⤵
        
        PID:16648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37170.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53069.exe
      4⤵
      PID:16636
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5653.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5653.exe
    3⤵
    PID:7176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59055.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59055.exe
    3⤵
    PID:10796
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14380.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14380.exe
    3⤵
    PID:13772
- C:\Users\Admin\AppData\Local\Temp\Unicorn-6909.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-6909.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3916
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47351.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47351.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45379.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45379.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31155.exe
        5⤵
        
        PID:4540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38083.exe
        6⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12670.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12670.exe
        7⤵
        
        PID:7192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44902.exe
        7⤵
        
        PID:9320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48898.exe
        7⤵
        
        PID:15492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14730.exe
        7⤵
        
        PID:8748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64538.exe
        6⤵
        
        PID:7760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12089.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12089.exe
        6⤵
        
        PID:10320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
        6⤵
        
        PID:16388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51672.exe
        6⤵
        
        PID:8548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55934.exe
        5⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42235.exe
        6⤵
        
        PID:9664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1373.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58040.exe
        6⤵
        
        PID:7640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65165.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65165.exe
        5⤵
        
        PID:8556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24726.exe
        5⤵
        
        PID:12152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12228.exe
        5⤵
        
        PID:15440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40069.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40069.exe
      4⤵
      PID:4204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58695.exe
        5⤵
        
        PID:5936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21031.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43911.exe
        7⤵
        
        PID:11776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34533.exe
        7⤵
        
        PID:15556
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56259.exe
        7⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59702.exe
        6⤵
        
        PID:9976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23084.exe
        6⤵
        
        PID:14220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22716.exe
        6⤵
        
        PID:18300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27640.exe
        5⤵
        
        PID:7880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1934.exe
        6⤵
        
        PID:13644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49540.exe
        6⤵
        
        PID:6828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23574.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23574.exe
        5⤵
        
        PID:11528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12228.exe
        5⤵
        
        PID:15184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58761.exe
      4⤵
      PID:6284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30839.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38373.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8012.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8012.exe
        5⤵
        
        PID:17104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5493.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5493.exe
      4⤵
      PID:8584
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16060.exe
      4⤵
      PID:6576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53062.exe
      4⤵
      PID:4168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13069.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13069.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59743.exe
      4⤵
      PID:1716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13578.exe
        5⤵
        
        PID:5972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35831.exe
        6⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48711.exe
        7⤵
        
        PID:8300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25301.exe
        7⤵
        
        PID:5048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29200.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29200.exe
        7⤵
        
        PID:17324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31392.exe
        6⤵
        
        PID:8212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46594.exe
        6⤵
        
        PID:14384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46443.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46443.exe
        6⤵
        
        PID:7700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-781.exe
        5⤵
        
        PID:6988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58327.exe
        6⤵
        
        PID:11064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62057.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62057.exe
        6⤵
        
        PID:16204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17028.exe
        5⤵
        
        PID:1980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34150.exe
        5⤵
        
        PID:13636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46531.exe
        5⤵
        
        PID:15128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18985.exe
      4⤵
      PID:6012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8778.exe
        5⤵
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58727.exe
        6⤵
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64568.exe
        6⤵
        
        PID:18352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22945.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22945.exe
        5⤵
        
        PID:10060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23084.exe
        5⤵
        
        PID:14236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22716.exe
        5⤵
        
        PID:18092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29456.exe
      4⤵
      PID:8056
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3424.exe
      4⤵
      PID:4756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53062.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53062.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:15508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8496.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8496.exe
    3⤵
    PID:1808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34959.exe
      4⤵
      PID:5476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57595.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9894.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9894.exe
        6⤵
        
        PID:11156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37849.exe
        6⤵
        
        PID:14824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11653.exe
        5⤵
        
        PID:9240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15840.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15840.exe
        5⤵
        
        PID:13960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55196.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55196.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16156
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40033.exe
      4⤵
      PID:7648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1934.exe
        5⤵
        
        PID:14160
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12089.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12089.exe
      4⤵
      PID:12220
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61621.exe
      4⤵
      PID:15068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47395.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47395.exe
      4⤵
      PID:9244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-3173.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-3173.exe
    3⤵
    PID:6356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4886.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4886.exe
      4⤵
      PID:7512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49495.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49495.exe
        5⤵
        
        PID:6400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50686.exe
        5⤵
        
        PID:16408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32994.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32994.exe
        5⤵
        
        PID:18428
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52573.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52573.exe
      4⤵
      PID:12820
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55750.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55750.exe
      4⤵
      PID:18216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48317.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48317.exe
      4⤵
      PID:8492
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26272.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26272.exe
    3⤵
    PID:4520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41989.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41989.exe
    3⤵
    PID:10584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35911.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35911.exe
    3⤵
    PID:13792
- C:\Users\Admin\AppData\Local\Temp\Unicorn-63117.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-63117.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1414.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1414.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15743.exe
      4⤵
      PID:2164
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22707.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22707.exe
        5⤵
        
        PID:5124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53179.exe
        6⤵
        
        PID:8928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19615.exe
        7⤵
        
        PID:14724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39871.exe
        7⤵
        
        PID:4840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20449.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20449.exe
        6⤵
        
        PID:12180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12864.exe
        6⤵
        
        PID:17148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64620.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64620.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58830.exe
        5⤵
        
        PID:7056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25876.exe
        5⤵
        
        PID:11400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20893.exe
        5⤵
        
        PID:14816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3801.exe
      4⤵
      PID:6420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10610.exe
        5⤵
        
        PID:9140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46734.exe
        5⤵
        
        PID:12488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6860.exe
        5⤵
        
        PID:15592
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48637.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48637.exe
      4⤵
      PID:8776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24342.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24342.exe
      4⤵
      PID:11376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
      4⤵
      PID:4912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4045.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4045.exe
    3⤵
    PID:3500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47211.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47211.exe
      4⤵
      PID:5428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29775.exe
        5⤵
        
        PID:7248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49391.exe
        6⤵
        
        PID:10436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60434.exe
        6⤵
        
        PID:14948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12486.exe
        6⤵
        
        PID:8072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65322.exe
        5⤵
        
        PID:9972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53173.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53173.exe
        5⤵
        
        PID:13796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14355.exe
        5⤵
        
        PID:4232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60262.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60262.exe
      4⤵
      PID:7992
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30424.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30424.exe
      4⤵
      PID:12384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40617.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40617.exe
      4⤵
      PID:16700
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42041.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42041.exe
    3⤵
    PID:6476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64087.exe
      4⤵
      PID:9104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13572.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13572.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46358.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46358.exe
      4⤵
      PID:17068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64123.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64123.exe
      4⤵
      PID:18120
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1217.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1217.exe
    3⤵
    PID:8812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15676.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15676.exe
    3⤵
    PID:11452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45085.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45085.exe
    3⤵
    PID:16480
- C:\Users\Admin\AppData\Local\Temp\Unicorn-20681.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-20681.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:8
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-60859.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-60859.exe
    3⤵
    PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41570.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41570.exe
      4⤵
      PID:7344
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5234.exe
        5⤵
        
        PID:10764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-517.exe
        5⤵
        
        PID:15148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49243.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49243.exe
        5⤵
        
        PID:6884
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10720.exe
      4⤵
      PID:9904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33837.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33837.exe
      4⤵
      PID:13676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6220.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6220.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:2732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7552.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7552.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-278.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-278.exe
      4⤵
      PID:9516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58217.exe
      4⤵
      PID:14776
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19171.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19171.exe
      4⤵
      PID:6308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62042.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62042.exe
    3⤵
    PID:9276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44021.exe
    3⤵
    PID:13760
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62574.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62574.exe
    3⤵
    PID:17804
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56543.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56543.exe
  2⤵
  PID:5032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52853.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52853.exe
    3⤵
    PID:7336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59286.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59286.exe
    3⤵
    PID:11628
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45999.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45999.exe
    3⤵
    PID:15520
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65131.exe
    3⤵
    PID:7104
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39044.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39044.exe
  2⤵
  PID:6340
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-8778.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-8778.exe
    3⤵
    PID:2576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47051.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47051.exe
      4⤵
      PID:14796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5767.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5767.exe
      4⤵
      PID:2012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22945.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22945.exe
    3⤵
    PID:10052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23084.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23084.exe
    3⤵
    PID:14244
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22716.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22716.exe
    3⤵
    PID:1464
- C:\Users\Admin\AppData\Local\Temp\Unicorn-11421.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-11421.exe
  2⤵
  PID:7936
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47819.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47819.exe
    3⤵
    PID:15020
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16161.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16161.exe
  2⤵
  PID:10020
- C:\Users\Admin\AppData\Local\Temp\Unicorn-18182.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-18182.exe
  2⤵
  PID:15312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2484 -ip 2484
1⤵
PID:5404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 3340 -ip 3340
1⤵
PID:5452

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3340 -ip 3340
1⤵
PID:6508

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2484 -ip 2484
1⤵
PID:6800

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:6616

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-1044.exe

Filesize
468KB

MD5
10fdcf0a59d460d0f90156350afdf9e1

SHA1
3443d22b1ec59588b35db09aab5dd8c4919d59be

SHA256
e1cb58bebfcbf89f1b6473ea56f16446b09adf8de5c60bbca146bc0cca883d14

SHA512
57b0b292ad821813b5ccd3e95a4feb183c9b43d6789aae8368ea3ee99b5fa7c400da33af9a43311254e676bb35c8e523307ebecce55bfb5dddfeabe79db54415

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11258.exe

Filesize
468KB

MD5
43b14213b9c3d9a21472d626477730f7

SHA1
109ebfd07de7868944ec75a5851a7b95c8673c05

SHA256
215638f1cb86ea3460d316e6aa5285f8449aac7f25fd15803dfc174aec5f3933

SHA512
694d13d1b5e8173975bc3086fdaf3fa37e68979ebd860f3497eb56ca6ac850cbfdf4673f0b489d094eb6a1d32359a0842fed141a101ee0767bd3051e634d1c45

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12078.exe

Filesize
468KB

MD5
3d40d67858542c575b37c8426ed65408

SHA1
c98b9ccb56a68a7c56c4a34768c81772ac34d19e

SHA256
76e241ad1540862235db87a4d7179718f38c6a04cf47576505ff9cb73530f897

SHA512
2197a8488a9f1985cb97203c0d933345638539c5399f3fcf98fe2aeed63d9c3f307621f312c6161338f73a140005e09a39448b7d050761c705b58b007e681fd0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13668.exe

Filesize
468KB

MD5
de5a06f29e2bebfdefdb673c865aca47

SHA1
315e7cc50b495bdd4dcf74c2704cce94071d5ff7

SHA256
2622ed2bb35e6f473eaab572944e3a3a591599dcdebe5a10771a51f3631543bc

SHA512
4b25b2b26b4fa1d0fe562fc87d5e8602e47264e0cdcdb2c832be05327db2a52fef0e6e54200cd433e82ec283aa64238e3c76f7147649f8ffbc881351f72e0c99

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-16332.exe

Filesize
468KB

MD5
6d4fdcd6ccd190a7ff9a2f73c2f905c2

SHA1
4bc0f1faa35fb937fd129f4611a9ed202e50acb0

SHA256
259c9e64bee82f8fe67aaa5a9cf6fed245d2c9bb3ce51ff0789d32b3e90903cd

SHA512
3ec979640d4ccb87d5b017453dc411425d01ad9a7e39f5efc171480d0a0012a768913bfe42272193141515fc2c2981543f0f809493a347fb842a547e6e2f6f96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19171.exe

Filesize
468KB

MD5
d11935be9fe31ffdd6eeb099c104bbe3

SHA1
fa838b760a0ef281aea3d7fb8b6d913ad33af104

SHA256
0e885fcbb608504bb5598d6d906da0161a75979018ab7dbd63729aa285beb49d

SHA512
662ed5776cedd4da2aa82453ee0670d64be37bb3926d3f46f461c196a2430994b6028358438bbd461aa0f95129047a59609132d10a09a8c9112c06a16965044d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20247.exe

Filesize
468KB

MD5
4e77003b329eea6e5430a3e4e67f61e2

SHA1
eeda091c45e7359859439ec191580bbb788bf030

SHA256
2c85e96c0b5354d51fe4d49d5f5a26cdcf5a5545c64a72765493a968c6c2f1ea

SHA512
24c6f3301c8c1609b00c48d88bd39f369f0d9952d1054e6c32f8d44171a68a70deb05472769feb4a12b1e9843e0bc1decd5461c19ba082d73984c6a7cce58cf8

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-20277.exe

Filesize
468KB

MD5
61236930b6531c1a1f76eb8a18362dc3

SHA1
c383f5c0f667d4e7a64a21c7ffd64a46a841a6ae

SHA256
baf0031104dfad6367c99a7cf4d358f2bba67a32ed7c0d479c9a048fbeebe775

SHA512
13d7a9c7a5489e67fe1683c20b0a8cc25a5b04c76965218c67acb743cbf0a6c7c1a9b971691178b7625ae0e32b4a50c2a80c3834bfd97843b260a7a1abf39e1f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2234.exe

Filesize
468KB

MD5
6874de724fd249b6181b677b03311d95

SHA1
77cba3274969e79a0da837bc9372386961f6249b

SHA256
d8d835af708306d52aa3f255213290faa9564611fa20e957a355b2e594a5d96d

SHA512
e07ea090ee9236c252aedd0be64db3111434426811e4c381f3c3203f5157d9e61a1cc18f75323dd9deb12a6f8588dade66454cd3bce3fd2228df2db7a2874e9f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22463.exe

Filesize
468KB

MD5
1b5510f90f2950f7c90cc2383e67c28a

SHA1
be826c98a84d6b9aef0e24c86174f791623fa5a2

SHA256
767df5b16336e751ba64d77dfde4d751c3de53c21b03ad0e583e135740744b60

SHA512
fc9b57d10086fbcc294de2bf4eda93fd3c3aeeeecab47ce6c15a826a2fa1ed77535aee5980dcfc7b3b5eaff82854341ddfa0dd1344163ea16e2567ab707c762b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22655.exe

Filesize
468KB

MD5
191d6dece799b70aa026b4c29c285700

SHA1
54c27c201f2790912734b6c531bc7aea22ec3383

SHA256
8e7f4b50d259e14ad99a0a1987067e0a400519dadd8486660a0ed6d4d2cf43dd

SHA512
d03d8c8c14b66c4900593dbbbce4bd88df321a2e281a506c2433e7d27bc99692f7177db80607ba99c38e78d7d97fb8171644fc053cd74130b3f54a1799449f6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23017.exe

Filesize
468KB

MD5
22a1c4cca0d8a6ef474681ebe10ece18

SHA1
ff4bdd2c7e17bf39976c676685140efb76cdf89a

SHA256
adca441bd8e28a91d6825923fc054bc205d63ad973c11d653825d33f294a6bd4

SHA512
d7f71d57f9c2c917c5a0a1482a0740ae8e86c8518656102e9cf9e17f2c3c3956a7818009a3e6104b4aa8c930171feda133f76571ca75d516fdc75ac32b9795b5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23628.exe

Filesize
468KB

MD5
582740dfe29b914d5e60b665f5dd4b9f

SHA1
2e1fcd43932ae609d6e5a41147891b7d6fcbb33d

SHA256
7e29bf3edb46e9b5bc7abd00280ca2fa1e8f21fe57aa272232d5fc22865b1f07

SHA512
819c4ef6e2b7c3ccfea8ddc22d651f0c3337e25729dc3dfd67e3f2498455d240fe7413043f9525c6fa048fbe9da7757451a4368ae2e863db14bd5dd9298a8cbd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25366.exe

Filesize
468KB

MD5
6e3249c46654ab7dbf561c942ff49253

SHA1
b079d5abecc9370c7ff9960e5973517bbaeeffa5

SHA256
b9344588fba1ed430822e38b59c3f727cfbbe31ec47058546e428a5140f9c7b8

SHA512
4340f2204bf027599fdd7e247a1679cf29efcea4ff757d101cdb6543aa0328b2d2639995fdc58258720a9b58e1a556e5ab7b87357052aec5735d92d6ca5901ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26739.exe

Filesize
468KB

MD5
261c13f0d9b66cabd2ad01e95b6276fc

SHA1
08a154ac96074b10e66ed02949b5b41ae17dc3e7

SHA256
b19e429b3812ae1bf6c776c85d049b06bda97b771263f073a694dad8b88a2383

SHA512
0cbf5c76a8c57337a4d65a12fc0af6906fabf4fe23f27361caacf73df78f2734996ad3093bcdf22135937459df59bd1f0356e06452a1499d0504dedf4534d8b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27293.exe

Filesize
468KB

MD5
547f6dd17123056b6506551d8dbcc130

SHA1
966abefb403a2234309e3c8f84ead478a63485f1

SHA256
eaaeff95bcbe82ef558268b140e92cff640b383739692ace74c86d8b50586ba6

SHA512
60da5546ac1e356b33412be2e0ffd257dc14768bbd72d7de1acd08c015bdaf21a7b9d06bdd61fcdbea34166d25febc3ef2f6601c4acff2969c91431cbfb5c83b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30225.exe

Filesize
468KB

MD5
41f3adfec5ae505dfa0bffd84e041f5b

SHA1
96d8d9eaba77076bdc8268f6438b69ec88afc025

SHA256
27cf44dd84784ee8833f8b31e3cf23a399fee59a277f7dae245be0f1f073159d

SHA512
c5ed30232c14892365ec32e2efd34ff9d038159928e5d892042ae9916a5f990193daae198fda806ccb0e01ed9bf61892647ce183b33a6c10e0a5be5d72d36dff

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31975.exe

Filesize
468KB

MD5
957f5a899137014c5aa8eca4bc66fb61

SHA1
211a4c1e228177ca950e678142dc9081bcc39952

SHA256
d8b672af59fbebe358e855d4329d2efb2c6c68ab02d55273c1ac87f303cd6471

SHA512
78d83c0718bffd5c29d236f37f4f462d4cf1afaa704cb10c9c96b9d62855c530ceed218f7a1d90782e1568d6bc8920dcd3c1e0a7040122e3e46b34018d173c19

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32233.exe

Filesize
468KB

MD5
1662743cbd84e9dbbf31d896c79bc84b

SHA1
3a976c1954dfad85801a40054dbbc09e3330506d

SHA256
5b91403c7550f2830f3527209316ec8c4d3cc94272c0c49c8236f8958f643501

SHA512
3987fbd94e692d5336bf8bb1af1797dd79f5a09e766354dbb5f7d22ca388c8ddc9902da5ced41c09c42d7b69b3798fccfcbedcad52b38a2cb8a61838504eb1cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35763.exe

Filesize
468KB

MD5
574906243a18d2155991d953d525b7c6

SHA1
da642eb7d32b548229ffcfecef0b0ce4b350798e

SHA256
43af35decb2261bc8bcc9dde26eef5ed44a12db529d9a370d879ec10db516522

SHA512
edb05fbe9f776ec3a54fe72763ea95e03261a6af45228becbce1ceee9bfb22063e4866c1043727bf304ec8e0c553ec329cb5f0170ff74fa473b81609fdd53436

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3645.exe

Filesize
468KB

MD5
7a0fbd95aa5320adfa6bf294bc1e2469

SHA1
64a11a44a3427475dc88f596d70cc47a4977e3a1

SHA256
3d2a1f89b1aaca82da76b761b473448ccba7bcfe04d01efebbd052f901c87634

SHA512
2de15a76ccf539243a27e5dbd80966d1c9d01a34774e3ca475deeeda7ba34c13cfc2528aa8349917743f65c35b6a98755c71f8eca4e38df27effad7a1d620cb7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-381.exe

Filesize
468KB

MD5
2fe6ea6b643988a8862567305c1a6509

SHA1
cd64abc91eab5097a06ad292e12767c6b4050b86

SHA256
6ac2722035d861f199ebb5049cfe93d88ddbd9c13782c51bbca8935acb9bbd08

SHA512
b88884e6a10064ef20bbed57cc46a765efb8c531831a7bbc1a5352275860262bca80677c3f81bc2364b410457ed17f9ddb8914faa94ef334f11ef4e6fe94c46f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-41029.exe

Filesize
468KB

MD5
6d07b93a5855d3aea8021b870e15c5d6

SHA1
74195ac8d2b5ad7907d235f10b2ff3b4fa55c5c8

SHA256
83720dfa13ae4c854aa830c6b564b84548902e396ee726d2e82cf24d2ec73de6

SHA512
e44e95f5a6c7bda126266ddac5def65a3fa242fb086cba39607d3ce5c5f23e4635638029b208f7e0dfd63a880ebc9a970f2712d620cdc5407cd39bd5a1ca5124

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42618.exe

Filesize
468KB

MD5
686140bd40894b256482efca420a5567

SHA1
7bd4f0672ae86c9056617a948433525131a1bc29

SHA256
d9ec8a3024ac823fbff2702cee369b0c3c1f2a73b43b5663fdf9da06493987c7

SHA512
2bd813354b08853c07263d7896e945754671a64108ed3b2e37c8160ae7cd343a1f95fcf47cbe1a40da8a49bec7b95f85eb8d5d7af726251a477f0fc1dc69cfac

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47351.exe

Filesize
468KB

MD5
1b8204a2fb500c65aa310626442363fb

SHA1
e910bc49c34e4b16454a6deb751e66884eab7cd2

SHA256
81f277691e42851a40724225d8db37e629160c90ddeb31854f23a0abcea97f04

SHA512
a9bab14b971994dae3b2beed7d40319c15be48139afc449313617cba7b8dc9beb2010bd0bdeceeb2ff099e4ae8adb16f55766c687aad7f3a65fda1b5d27c71bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-55734.exe

Filesize
468KB

MD5
e2186b1fdb00560078d4f365b767207d

SHA1
60f0afffb4722fee1934ff5cf36759c929db0442

SHA256
6dbc3a76dfd3190a68c633feb3e2eebf96aa14b599433388dee88c6d5e08c9d2

SHA512
17e812b014be148c55cefba8449b6f7b4221db388ab12a6c39865877e9cc1f1119e5d1627b6d33b2cc1bd287c56cd0f133b889231ba60f215c58dbf55bbcb5cb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56183.exe

Filesize
468KB

MD5
981d989fd0550bdcb37160c372263951

SHA1
8504bbbda4733b51474fd5808da51c21a5507231

SHA256
07a6ab0d66ef717db7ef9ea563deca377b1bc66f0ef8bed4860affa8fc15ad5c

SHA512
d26a73acab128c01af6a6c7c9972f68afb0d8c2d5812f49d0a203b7c08ac057f6d524149bcc77cbbe5d87876506663eaf4423cacd43058a8f907238f0e6c9c7d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-58695.exe

Filesize
468KB

MD5
3e780b5016a43d52664b215340bf8446

SHA1
998e8bd0a3e02cbae760f4956ac7d032e4b8a84c

SHA256
454308e5e56999fa46306452e230a744290644c7fad7d171cbe75edecaded2de

SHA512
ca550188a6cbbd38d2146a9379e41382141351795042d5ea6cd6ec64dd4ea1cf9efad6722331ea64614141117bf640d2b5c50a9be0db907279686273ba88938a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60158.exe

Filesize
468KB

MD5
e1f9b73901670a0a0bd1599374d6c398

SHA1
845efd9e9039f7668c4e2060bfb79e67fa207534

SHA256
59d75e5cbe804da8a146001481cbf5d3d90b870ee034a2e230776bfb99b094a9

SHA512
583c4fa6f964a3795f883703f1e2246a69997efdf2bc1991008060b88466315b1f469e1b9e7b2565ae675cc1d37199909ac27551b18c50029d721617fd26a923

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62727.exe

Filesize
468KB

MD5
46d34728c93de60cf3ee34c9ade6d9d1

SHA1
131daac1c7c68419b6c30613da9b3b0f01414a3d

SHA256
f7d72c32d9221f3f4437e93e97d2af0544d4345ec5d3a3a118f73d45b76c306d

SHA512
f23aa0d77761e5a19f7a3ea10302fbf2d0c00a5b3214f9811cf31089c84c674287fbf3ca300052095661c9193fce556bb70a8df9dd70a54ddfa444c21ef11868

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63117.exe

Filesize
468KB

MD5
70c60705a1d49730f9052fac9311bce7

SHA1
3aa14385434c05248dcf411df2e7aee5fdd1cd5a

SHA256
3ed3442ef4c753255c86788dd0ad787536288ab69139be3bf0ea7e50e6a1f073

SHA512
d191a6ee1c9c8488f10c2636cb4af5ea61ef10b42d9084324c497bb5f72a12e1d30026230fa8c419ece262d74330772dc054f8bcaaf59c9051647dea8a28c488

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6318.exe

Filesize
468KB

MD5
0bfa318887799bb2bb9fb1f9d3d6b616

SHA1
acf1309d1837c905713f9782b374e133d0f45027

SHA256
ab1ef480eed18e816bdb6ebf2f38ad45ba61ca0f99fccc39170b912934185e14

SHA512
0e4ac672c24a20ce74e84349605a7c90e523e17809488c5a0b0d6b2275eee3d440f36b1452bd86ebb7ee05a79ec44cde0c572ac8c8d050ff0652a1f662af0db5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6909.exe

Filesize
468KB

MD5
b6a50997860a087cd53a52d5fb62015a

SHA1
2e8d334b9e4bc1ca44d1c522f92cb99fcd350911

SHA256
d26f3ca35ff75cd921033049ba9aa212fa6ef4b206e4a0361c105b4523f5437f

SHA512
9967f8bd6690807c40c8c851c5c86cadebc1d9756347a3eae182084ff671006cac2e32a53a68c593cc37eab09f71fa22ff6f6b187c6709a696d8f15b7f20990d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads