460ca09a992aa1cb9280e22bf049ab24a63a40869e9bac8538a4cb6c6da50f99

Analysis

max time kernel
118s
max time network
117s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 23:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

460ca09a992aa1cb9280e22bf049ab24a63a40869e9bac8538a4cb6c6da50f99N.exe
Size

468KB
MD5

e98b9bf1b8751a5a8117fc40678422c0
SHA1

a70a2cf3f1c0e7f09da70c68023ea4b4dc0e6b76
SHA256

460ca09a992aa1cb9280e22bf049ab24a63a40869e9bac8538a4cb6c6da50f99
SHA512

8f28ce1a24341cc0772704b737ff460c62e4c8663326d0e00cd77dae40ae4c45ac41f6af5f2ba0f6761e3f020cdb067e75a5ff6642f6bd2f10d0db0f3d8b3495
SSDEEP

3072:bRcSogu1PU8hwbY4Pz+UOf8FECp8SZpjndH2dVT7stf73VKN8ElJ:bRZoVZhwvPiUOfavEHstDFKN8

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
3416	Unicorn-32124.exe
932	Unicorn-18886.exe
2204	Unicorn-33830.exe
1908	Unicorn-22176.exe
3868	Unicorn-10478.exe
3852	Unicorn-30344.exe
2732	Unicorn-51396.exe
3012	Unicorn-54594.exe
4188	Unicorn-42704.exe
4652	Unicorn-35928.exe
3124	Unicorn-63125.exe
4472	Unicorn-21538.exe
2952	Unicorn-25549.exe
3568	Unicorn-19683.exe
1112	Unicorn-2824.exe
1292	Unicorn-43878.exe
432	Unicorn-62907.exe
2180	Unicorn-17236.exe
1696	Unicorn-52409.exe
4700	Unicorn-6737.exe
3960	Unicorn-607.exe
4660	Unicorn-45632.exe
824	Unicorn-45632.exe
2648	Unicorn-23074.exe
3616	Unicorn-21219.exe
2032	Unicorn-11568.exe
2916	Unicorn-61895.exe
2756	Unicorn-53230.exe
2556	Unicorn-5559.exe
4848	Unicorn-3513.exe
3116	Unicorn-4360.exe
3808	Unicorn-1859.exe
1472	Unicorn-4936.exe
1184	Unicorn-14687.exe
5112	Unicorn-18772.exe
5092	Unicorn-51252.exe
4684	Unicorn-19955.exe
1444	Unicorn-26839.exe
3676	Unicorn-47915.exe
4980	Unicorn-31408.exe
3648	Unicorn-35492.exe
2036	Unicorn-35492.exe
4828	Unicorn-12933.exe
4788	Unicorn-49782.exe
2200	Unicorn-13680.exe
3504	Unicorn-12164.exe
2676	Unicorn-37630.exe
1716	Unicorn-17764.exe
3976	Unicorn-2819.exe
2296	Unicorn-45798.exe
3900	Unicorn-34100.exe
468	Unicorn-51920.exe
4212	Unicorn-58050.exe
1340	Unicorn-3374.exe
1652	Unicorn-61942.exe
2004	Unicorn-30951.exe
4588	Unicorn-30951.exe
3736	Unicorn-48128.exe
3364	Unicorn-52212.exe
400	Unicorn-29581.exe
408	Unicorn-9980.exe
3020	Unicorn-5533.exe
1260	Unicorn-64940.exe
2148	Unicorn-9617.exe

Program crash 3 IoCs

pid	pid_target	Process	procid_target
10424	10188	WerFault.exe
10676	10172	WerFault.exe	469
11932	6372	WerFault.exe	263

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23680.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30145.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-25015.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49400.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30540.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49723.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56234.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23064.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53358.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64940.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47080.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59130.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11387.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24989.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61971.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-44607.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7817.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54407.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34740.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56521.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30951.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56234.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31795.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-65096.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41900.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60256.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59695.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16432.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33819.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53358.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-45480.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62664.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-29518.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39592.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41291.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18382.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36214.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37163.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11175.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16358.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-40914.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58517.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-30184.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10633.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-26533.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51169.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-59282.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7328.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-7867.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39374.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-54344.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-61895.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63520.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20874.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3007.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34100.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-32794.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21232.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51334.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\HardwareID	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	3964	dwm.exe
Token: SeChangeNotifyPrivilege	3964	dwm.exe
Token: 33	3964	dwm.exe
Token: SeIncBasePriorityPrivilege	3964	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
4404	460ca09a992aa1cb9280e22bf049ab24a63a40869e9bac8538a4cb6c6da50f99N.exe
3416	Unicorn-32124.exe
932	Unicorn-18886.exe
2204	Unicorn-33830.exe
1908	Unicorn-22176.exe
3852	Unicorn-30344.exe
3868	Unicorn-10478.exe
2732	Unicorn-51396.exe
3012	Unicorn-54594.exe
4188	Unicorn-42704.exe
4652	Unicorn-35928.exe
3124	Unicorn-63125.exe
3568	Unicorn-19683.exe
2952	Unicorn-25549.exe
4472	Unicorn-21538.exe
1112	Unicorn-2824.exe
1292	Unicorn-43878.exe
2180	Unicorn-17236.exe
432	Unicorn-62907.exe
1696	Unicorn-52409.exe
4700	Unicorn-6737.exe
3960	Unicorn-607.exe
4660	Unicorn-45632.exe
2916	Unicorn-61895.exe
2756	Unicorn-53230.exe
824	Unicorn-45632.exe
2648	Unicorn-23074.exe
2032	Unicorn-11568.exe
3616	Unicorn-21219.exe
4848	Unicorn-3513.exe
2556	Unicorn-5559.exe
3116	Unicorn-4360.exe
3808	Unicorn-1859.exe
1472	Unicorn-4936.exe
1184	Unicorn-14687.exe
5112	Unicorn-18772.exe
5092	Unicorn-51252.exe
3676	Unicorn-47915.exe
1444	Unicorn-26839.exe
4684	Unicorn-19955.exe
4980	Unicorn-31408.exe
4828	Unicorn-12933.exe
3648	Unicorn-35492.exe
2036	Unicorn-35492.exe
4788	Unicorn-49782.exe
1716	Unicorn-17764.exe
2676	Unicorn-37630.exe
2200	Unicorn-13680.exe
3976	Unicorn-2819.exe
468	Unicorn-51920.exe
4588	Unicorn-30951.exe
1340	Unicorn-3374.exe
3900	Unicorn-34100.exe
2296	Unicorn-45798.exe
1652	Unicorn-61942.exe
4212	Unicorn-58050.exe
2004	Unicorn-30951.exe
3504	Unicorn-12164.exe
400	Unicorn-29581.exe
3736	Unicorn-48128.exe
3364	Unicorn-52212.exe
408	Unicorn-9980.exe
3020	Unicorn-5533.exe
2668	Unicorn-40436.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 3416	4404	460ca09a992aa1cb9280e22bf049ab24a63a40869e9bac8538a4cb6c6da50f99N.exe	82
PID 4404 wrote to memory of 3416	4404	460ca09a992aa1cb9280e22bf049ab24a63a40869e9bac8538a4cb6c6da50f99N.exe	82
PID 4404 wrote to memory of 3416	4404	460ca09a992aa1cb9280e22bf049ab24a63a40869e9bac8538a4cb6c6da50f99N.exe	82
PID 3416 wrote to memory of 932	3416	Unicorn-32124.exe	83
PID 3416 wrote to memory of 932	3416	Unicorn-32124.exe	83
PID 3416 wrote to memory of 932	3416	Unicorn-32124.exe	83
PID 4404 wrote to memory of 2204	4404	460ca09a992aa1cb9280e22bf049ab24a63a40869e9bac8538a4cb6c6da50f99N.exe	84
PID 4404 wrote to memory of 2204	4404	460ca09a992aa1cb9280e22bf049ab24a63a40869e9bac8538a4cb6c6da50f99N.exe	84
PID 4404 wrote to memory of 2204	4404	460ca09a992aa1cb9280e22bf049ab24a63a40869e9bac8538a4cb6c6da50f99N.exe	84
PID 932 wrote to memory of 1908	932	Unicorn-18886.exe	85
PID 932 wrote to memory of 1908	932	Unicorn-18886.exe	85
PID 932 wrote to memory of 1908	932	Unicorn-18886.exe	85
PID 3416 wrote to memory of 3868	3416	Unicorn-32124.exe	86
PID 3416 wrote to memory of 3868	3416	Unicorn-32124.exe	86
PID 3416 wrote to memory of 3868	3416	Unicorn-32124.exe	86
PID 2204 wrote to memory of 3852	2204	Unicorn-33830.exe	87
PID 2204 wrote to memory of 3852	2204	Unicorn-33830.exe	87
PID 2204 wrote to memory of 3852	2204	Unicorn-33830.exe	87
PID 4404 wrote to memory of 2732	4404	460ca09a992aa1cb9280e22bf049ab24a63a40869e9bac8538a4cb6c6da50f99N.exe	88
PID 4404 wrote to memory of 2732	4404	460ca09a992aa1cb9280e22bf049ab24a63a40869e9bac8538a4cb6c6da50f99N.exe	88
PID 4404 wrote to memory of 2732	4404	460ca09a992aa1cb9280e22bf049ab24a63a40869e9bac8538a4cb6c6da50f99N.exe	88
PID 1908 wrote to memory of 3012	1908	Unicorn-22176.exe	93
PID 1908 wrote to memory of 3012	1908	Unicorn-22176.exe	93
PID 1908 wrote to memory of 3012	1908	Unicorn-22176.exe	93
PID 932 wrote to memory of 4188	932	Unicorn-18886.exe	94
PID 932 wrote to memory of 4188	932	Unicorn-18886.exe	94
PID 932 wrote to memory of 4188	932	Unicorn-18886.exe	94
PID 3852 wrote to memory of 4652	3852	Unicorn-30344.exe	95
PID 3852 wrote to memory of 4652	3852	Unicorn-30344.exe	95
PID 3852 wrote to memory of 4652	3852	Unicorn-30344.exe	95
PID 2204 wrote to memory of 3124	2204	Unicorn-33830.exe	96
PID 2204 wrote to memory of 3124	2204	Unicorn-33830.exe	96
PID 2204 wrote to memory of 3124	2204	Unicorn-33830.exe	96
PID 2732 wrote to memory of 4472	2732	Unicorn-51396.exe	97
PID 2732 wrote to memory of 4472	2732	Unicorn-51396.exe	97
PID 2732 wrote to memory of 4472	2732	Unicorn-51396.exe	97
PID 4404 wrote to memory of 2952	4404	460ca09a992aa1cb9280e22bf049ab24a63a40869e9bac8538a4cb6c6da50f99N.exe	98
PID 4404 wrote to memory of 2952	4404	460ca09a992aa1cb9280e22bf049ab24a63a40869e9bac8538a4cb6c6da50f99N.exe	98
PID 4404 wrote to memory of 2952	4404	460ca09a992aa1cb9280e22bf049ab24a63a40869e9bac8538a4cb6c6da50f99N.exe	98
PID 3416 wrote to memory of 3568	3416	Unicorn-32124.exe	99
PID 3416 wrote to memory of 3568	3416	Unicorn-32124.exe	99
PID 3416 wrote to memory of 3568	3416	Unicorn-32124.exe	99
PID 3868 wrote to memory of 1112	3868	Unicorn-10478.exe	101
PID 3868 wrote to memory of 1112	3868	Unicorn-10478.exe	101
PID 3868 wrote to memory of 1112	3868	Unicorn-10478.exe	101
PID 3012 wrote to memory of 1292	3012	Unicorn-54594.exe	102
PID 3012 wrote to memory of 1292	3012	Unicorn-54594.exe	102
PID 3012 wrote to memory of 1292	3012	Unicorn-54594.exe	102
PID 1908 wrote to memory of 432	1908	Unicorn-22176.exe	103
PID 1908 wrote to memory of 432	1908	Unicorn-22176.exe	103
PID 1908 wrote to memory of 432	1908	Unicorn-22176.exe	103
PID 4188 wrote to memory of 2180	4188	Unicorn-42704.exe	104
PID 4188 wrote to memory of 2180	4188	Unicorn-42704.exe	104
PID 4188 wrote to memory of 2180	4188	Unicorn-42704.exe	104
PID 3852 wrote to memory of 1696	3852	Unicorn-30344.exe	105
PID 3852 wrote to memory of 1696	3852	Unicorn-30344.exe	105
PID 3852 wrote to memory of 1696	3852	Unicorn-30344.exe	105
PID 4652 wrote to memory of 4700	4652	Unicorn-35928.exe	106
PID 4652 wrote to memory of 4700	4652	Unicorn-35928.exe	106
PID 4652 wrote to memory of 4700	4652	Unicorn-35928.exe	106
PID 932 wrote to memory of 3960	932	Unicorn-18886.exe	107
PID 932 wrote to memory of 3960	932	Unicorn-18886.exe	107
PID 932 wrote to memory of 3960	932	Unicorn-18886.exe	107
PID 3124 wrote to memory of 4660	3124	Unicorn-63125.exe	108

C:\Users\Admin\AppData\Local\Temp\460ca09a992aa1cb9280e22bf049ab24a63a40869e9bac8538a4cb6c6da50f99N.exe
"C:\Users\Admin\AppData\Local\Temp\460ca09a992aa1cb9280e22bf049ab24a63a40869e9bac8538a4cb6c6da50f99N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Users\Admin\AppData\Local\Temp\Unicorn-32124.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-32124.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-18886.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-18886.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22176.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22176.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54594.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54594.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43878.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1859.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9617.exe
        8⤵
        Executes dropped EXE
        
        PID:2148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
        9⤵
        
        PID:5880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47376.exe
        10⤵
        
        PID:8052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        10⤵
        
        PID:11020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65217.exe
        10⤵
        
        PID:5148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22286.exe
        10⤵
        
        PID:9976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7090.exe
        9⤵
        
        PID:8232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65096.exe
        9⤵
        
        PID:12308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33962.exe
        9⤵
        
        PID:9448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59695.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:5736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32794.exe
        9⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe
        9⤵
        
        PID:3992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60334.exe
        9⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35792.exe
        8⤵
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1880.exe
        8⤵
        
        PID:12608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50868.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50868.exe
        8⤵
        
        PID:11624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24562.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24562.exe
        7⤵
        
        PID:3512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15585.exe
        8⤵
        
        PID:5828
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34740.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:6752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57199.exe
        9⤵
        
        PID:11888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38767.exe
        9⤵
        
        PID:576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22478.exe
        9⤵
        
        PID:16504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3006.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3006.exe
        8⤵
        
        PID:8216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65096.exe
        8⤵
        
        PID:11588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe
        8⤵
        
        PID:12148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8273.exe
        8⤵
        
        PID:11144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30643.exe
        7⤵
        
        PID:6704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11003.exe
        8⤵
        
        PID:8716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41786.exe
        8⤵
        
        PID:12760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20069.exe
        8⤵
        
        PID:9424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19290.exe
        7⤵
        
        PID:9156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6043.exe
        7⤵
        
        PID:13020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24225.exe
        7⤵
        
        PID:3184
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4936.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4936.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3587.exe
        7⤵
        
        PID:2316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7417.exe
        8⤵
        
        PID:5804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7583.exe
        9⤵
        
        PID:6812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18138.exe
        9⤵
        
        PID:9236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-457.exe
        9⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1626.exe
        9⤵
        
        PID:5028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24808.exe
        9⤵
        
        PID:11104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29518.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:7400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20874.exe
        9⤵
        
        PID:10364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5710.exe
        9⤵
        
        PID:3528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63319.exe
        9⤵
        
        PID:11512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37407.exe
        8⤵
        
        PID:11820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57274.exe
        8⤵
        
        PID:2488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1478.exe
        8⤵
        
        PID:16572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6218.exe
        7⤵
        
        PID:464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18596.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18596.exe
        8⤵
        
        PID:7808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19032.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19032.exe
        9⤵
        
        PID:14484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43255.exe
        9⤵
        
        PID:6316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51169.exe
        8⤵
        
        PID:3672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53716.exe
        8⤵
        
        PID:16060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65409.exe
        8⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61565.exe
        8⤵
        
        PID:16584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58350.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58350.exe
        7⤵
        
        PID:8636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1880.exe
        7⤵
        
        PID:12584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52046.exe
        7⤵
        
        PID:10412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40436.exe
        6⤵
        Suspicious use of SetWindowsHookEx
        
        PID:2668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35622.exe
        7⤵
        
        PID:5668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38118.exe
        8⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49296.exe
        9⤵
        
        PID:9260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49161.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18096.exe
        9⤵
        
        PID:9928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58211.exe
        8⤵
        
        PID:10200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53358.exe
        8⤵
        
        PID:14060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54880.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54880.exe
        8⤵
        
        PID:8960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52077.exe
        7⤵
        
        PID:7292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47236.exe
        8⤵
        
        PID:13924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59130.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25278.exe
        8⤵
        
        PID:16548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exe
        7⤵
        
        PID:10616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26551.exe
        7⤵
        
        PID:14772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-906.exe
        7⤵
        
        PID:9840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25819.exe
        6⤵
        
        PID:5844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26764.exe
        7⤵
        
        PID:7876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51169.exe
        7⤵
        
        PID:11372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42851.exe
        7⤵
        
        PID:16300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22478.exe
        7⤵
        
        PID:16424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55550.exe
        6⤵
        
        PID:8576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34048.exe
        6⤵
        
        PID:12520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3756.exe
        6⤵
        
        PID:5248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10725.exe
        6⤵
        
        PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62907.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31408.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31408.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57604.exe
        7⤵
        
        PID:4336
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14023.exe
        8⤵
        
        PID:5664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39592.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:8912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53847.exe
        9⤵
        
        PID:12860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35564.exe
        9⤵
        
        PID:15960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9794.exe
        9⤵
        
        PID:2572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28508.exe
        9⤵
        
        PID:10960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44615.exe
        8⤵
        
        PID:8600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4375.exe
        8⤵
        
        PID:12672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21454.exe
        8⤵
        
        PID:15540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11020.exe
        8⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56379.exe
        7⤵
        
        PID:6952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63520.exe
        8⤵
        
        PID:7256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe
        8⤵
        
        PID:13056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5103.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5103.exe
        8⤵
        
        PID:7484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58542.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58542.exe
        7⤵
        
        PID:7884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41543.exe
        7⤵
        
        PID:11996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58498.exe
        7⤵
        
        PID:3812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5943.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5943.exe
        7⤵
        
        PID:16536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38890.exe
        6⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21948.exe
        7⤵
        
        PID:7580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62586.exe
        8⤵
        
        PID:14604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53946.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53946.exe
        8⤵
        
        PID:11112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21236.exe
        7⤵
        
        PID:11544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15711.exe
        7⤵
        
        PID:1788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38807.exe
        7⤵
        
        PID:16840
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34831.exe
        6⤵
        
        PID:7396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54817.exe
        6⤵
        
        PID:11968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51492.exe
        6⤵
        
        PID:16136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9290.exe
        6⤵
        
        PID:5964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18924.exe
        6⤵
        
        PID:16404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49782.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16380.exe
        6⤵
        
        PID:2836
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47080.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23064.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe
        8⤵
        
        PID:12476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11325.exe
        8⤵
        
        PID:7960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48507.exe
        7⤵
        
        PID:8980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10213.exe
        7⤵
        
        PID:12904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9074.exe
        7⤵
        
        PID:5252
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5040.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5040.exe
        6⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46966.exe
        7⤵
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47215.exe
        7⤵
        
        PID:13684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59321.exe
        7⤵
        
        PID:10664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5641.exe
        6⤵
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50095.exe
        6⤵
        
        PID:12796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37854.exe
        6⤵
        
        PID:9768
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58491.exe
        5⤵
        
        PID:5912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24626.exe
        6⤵
        
        PID:6456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe
        6⤵
        
        PID:12540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46904.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46904.exe
        6⤵
        
        PID:11260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61004.exe
        5⤵
        
        PID:8276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45760.exe
        5⤵
        
        PID:11492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7508.exe
        5⤵
        
        PID:10856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42704.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42704.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17236.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35492.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22986.exe
        7⤵
        
        PID:5236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37158.exe
        8⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20874.exe
        9⤵
        
        PID:10492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51019.exe
        9⤵
        
        PID:1124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22478.exe
        9⤵
        
        PID:16432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38968.exe
        8⤵
        
        PID:8412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38392.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38392.exe
        8⤵
        
        PID:10884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54304.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54304.exe
        8⤵
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39440.exe
        7⤵
        
        PID:6008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50448.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50448.exe
        8⤵
        
        PID:10272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64319.exe
        8⤵
        
        PID:14676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52523.exe
        8⤵
        
        PID:7548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5231.exe
        7⤵
        
        PID:7856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18382.exe
        7⤵
        
        PID:14700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14912.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14912.exe
        7⤵
        
        PID:7720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6218.exe
        6⤵
        
        PID:5856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32794.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7304
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe
        7⤵
        
        PID:12988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30184.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42809.exe
        6⤵
        
        PID:9352
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60096.exe
        6⤵
        
        PID:13552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44292.exe
        6⤵
        
        PID:15992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29231.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29231.exe
        6⤵
        
        PID:16612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17764.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16380.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16380.exe
        6⤵
        
        PID:4692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63177.exe
        7⤵
        
        PID:6372
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 6372 -s 636
        8⤵
        Program crash
        
        PID:11932
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2517.exe
        7⤵
        
        PID:10180
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59223.exe
        7⤵
        
        PID:13972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37854.exe
        7⤵
        
        PID:4556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11454.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11454.exe
        6⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36852.exe
        7⤵
        
        PID:9244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49161.exe
        7⤵
        
        PID:13520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24318.exe
        7⤵
        
        PID:8408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32859.exe
        6⤵
        
        PID:9388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3224.exe
        6⤵
        
        PID:13528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56521.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10668
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10633.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31512.exe
        6⤵
        
        PID:7088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31974.exe
        7⤵
        
        PID:10592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31646.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31646.exe
        7⤵
        
        PID:14892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64365.exe
        7⤵
        
        PID:16668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11453.exe
        6⤵
        
        PID:9732
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6322.exe
        6⤵
        
        PID:13748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42354.exe
        6⤵
        
        PID:3892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16825.exe
        6⤵
        
        PID:16928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32399.exe
        5⤵
        
        PID:6448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4283.exe
        6⤵
        
        PID:12452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11796.exe
        6⤵
        
        PID:6620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33157.exe
        5⤵
        
        PID:9152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46658.exe
        5⤵
        
        PID:14352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41291.exe
        5⤵
        
        PID:11600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-607.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-607.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58050.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16764.exe
        6⤵
        
        PID:5184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56592.exe
        7⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20874.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:10368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35128.exe
        8⤵
        
        PID:15596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25086.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25086.exe
        8⤵
        
        PID:13660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27484.exe
        7⤵
        
        PID:10208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53358.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26100.exe
        7⤵
        
        PID:13580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37878.exe
        6⤵
        
        PID:7492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51320.exe
        7⤵
        
        PID:13352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62145.exe
        7⤵
        
        PID:16164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21194.exe
        7⤵
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62984.exe
        6⤵
        
        PID:10784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55331.exe
        6⤵
        
        PID:14928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28508.exe
        6⤵
        
        PID:10896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58927.exe
        5⤵
        
        PID:5488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60676.exe
        6⤵
        
        PID:6560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-95.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-95.exe
        7⤵
        
        PID:9376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49161.exe
        7⤵
        
        PID:13440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23742.exe
        7⤵
        
        PID:7824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58211.exe
        6⤵
        
        PID:10216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53358.exe
        6⤵
        
        PID:14052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24377.exe
        6⤵
        
        PID:1264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24808.exe
        6⤵
        
        PID:8068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47530.exe
        5⤵
        
        PID:7424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11169.exe
        6⤵
        
        PID:10548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41760.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41760.exe
        6⤵
        
        PID:14732
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8958.exe
        5⤵
        
        PID:10720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42582.exe
        5⤵
        
        PID:14880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50131.exe
        5⤵
        
        PID:4968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41291.exe
        5⤵
        
        PID:15536
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30951.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30951.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55658.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55658.exe
        5⤵
        
        PID:5200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39680.exe
        6⤵
        
        PID:7104
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34688.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34688.exe
        7⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26768.exe
        7⤵
        
        PID:15272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59321.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59321.exe
        7⤵
        
        PID:10656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31376.exe
        6⤵
        
        PID:8404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24989.exe
        6⤵
        
        PID:14256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40761.exe
        6⤵
        
        PID:11392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12798.exe
        5⤵
        
        PID:5452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12897.exe
        6⤵
        
        PID:11784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5710.exe
        6⤵
        
        PID:2964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28508.exe
        6⤵
        
        PID:10248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35958.exe
        5⤵
        
        PID:9952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18382.exe
        5⤵
        
        PID:14684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21518.exe
        5⤵
        
        PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49826.exe
      4⤵
      PID:5900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32794.exe
        5⤵
        
        PID:7576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14345.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14345.exe
        6⤵
        
        PID:15484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39363.exe
        6⤵
        
        PID:9576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe
        5⤵
        
        PID:4820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38767.exe
        5⤵
        
        PID:16312
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24808.exe
        5⤵
        
        PID:7544
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44468.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44468.exe
      4⤵
      PID:8252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49400.exe
        5⤵
        
        PID:12736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30348.exe
        5⤵
        
        PID:9472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62826.exe
      4⤵
      PID:11560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23771.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23771.exe
      4⤵
      PID:10648
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10478.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10478.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2824.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2824.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5559.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5559.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52212.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56234.exe
        7⤵
        
        PID:5380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29758.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29758.exe
        8⤵
        
        PID:6888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39592.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39592.exe
        9⤵
        
        PID:8880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19036.exe
        9⤵
        
        PID:12808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35564.exe
        9⤵
        
        PID:15952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1595.exe
        9⤵
        
        PID:3764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29238.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29238.exe
        8⤵
        
        PID:9720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43052.exe
        8⤵
        
        PID:13740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3956.exe
        8⤵
        
        PID:4924
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18394.exe
        8⤵
        
        PID:16392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25931.exe
        7⤵
        
        PID:7452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45939.exe
        8⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12824.exe
        7⤵
        
        PID:12220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29902.exe
        7⤵
        
        PID:1440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23008.exe
        7⤵
        
        PID:16560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10494.exe
        6⤵
        
        PID:4012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19172.exe
        7⤵
        
        PID:8764
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31977.exe
        7⤵
        
        PID:11152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13847.exe
        7⤵
        
        PID:8384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23539.exe
        6⤵
        
        PID:8516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12186.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12186.exe
        6⤵
        
        PID:12468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57998.exe
        6⤵
        
        PID:6628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9980.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21232.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21232.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58346.exe
        7⤵
        
        PID:6648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45814.exe
        8⤵
        
        PID:8688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56177.exe
        8⤵
        
        PID:12660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50400.exe
        8⤵
        
        PID:15416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26100.exe
        8⤵
        
        PID:7308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64241.exe
        7⤵
        
        PID:9172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24989.exe
        7⤵
        
        PID:13968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17434.exe
        7⤵
        
        PID:8816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35548.exe
        6⤵
        
        PID:7628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13975.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13975.exe
        6⤵
        
        PID:10820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10790.exe
        6⤵
        
        PID:15000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51669.exe
        6⤵
        
        PID:7696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55340.exe
        5⤵
        
        PID:6212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53598.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53598.exe
        6⤵
        
        PID:7440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58502.exe
        7⤵
        
        PID:14472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57838.exe
        7⤵
        
        PID:9416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51361.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51361.exe
        6⤵
        
        PID:12044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60640.exe
        6⤵
        
        PID:6960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25129.exe
        5⤵
        
        PID:8932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64782.exe
        5⤵
        
        PID:12848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38385.exe
        5⤵
        
        PID:10036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3513.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3513.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48128.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17340.exe
        6⤵
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35980.exe
        7⤵
        
        PID:5728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30822.exe
        8⤵
        
        PID:9528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55959.exe
        8⤵
        
        PID:13724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16181.exe
        8⤵
        
        PID:1408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2747.exe
        8⤵
        
        PID:7184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64625.exe
        7⤵
        
        PID:10028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26715.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26715.exe
        7⤵
        
        PID:14076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63048.exe
        7⤵
        
        PID:6992
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32153.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32153.exe
        6⤵
        
        PID:5592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51527.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51527.exe
        6⤵
        
        PID:11984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40034.exe
        6⤵
        
        PID:15656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17650.exe
        6⤵
        
        PID:4976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6672.exe
        6⤵
        
        PID:4532
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10494.exe
        5⤵
        
        PID:5516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8097.exe
        6⤵
        
        PID:6200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35216.exe
        6⤵
        
        PID:11660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60640.exe
        6⤵
        
        PID:1608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42809.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42809.exe
        5⤵
        
        PID:9360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60096.exe
        5⤵
        
        PID:13424
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52046.exe
        5⤵
        
        PID:7372
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29581.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29581.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56234.exe
        5⤵
        
        PID:5372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42394.exe
        6⤵
        
        PID:6924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18138.exe
        6⤵
        
        PID:10008
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-457.exe
        6⤵
        
        PID:14340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63048.exe
        6⤵
        
        PID:8448
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44677.exe
        5⤵
        
        PID:7084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47416.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47416.exe
        5⤵
        
        PID:11040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52399.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52399.exe
        5⤵
        
        PID:14760
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56521.exe
        5⤵
        
        PID:10660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55247.exe
      4⤵
      PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49296.exe
        5⤵
        
        PID:9304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49161.exe
        5⤵
        
        PID:13624
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20649.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20649.exe
        5⤵
        
        PID:1256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33474.exe
        5⤵
        
        PID:10880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6085.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6085.exe
      4⤵
      PID:7784
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39095.exe
      4⤵
      PID:13400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40330.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40330.exe
      4⤵
      PID:672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49735.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49735.exe
      4⤵
      PID:6644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19683.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19683.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45632.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45798.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45798.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17148.exe
        6⤵
        
        PID:5504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60676.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60676.exe
        7⤵
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45814.exe
        8⤵
        
        PID:8696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54344.exe
        8⤵
        
        PID:12536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48466.exe
        8⤵
        
        PID:5536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60157.exe
        7⤵
        
        PID:9088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62896.exe
        7⤵
        
        PID:13496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36406.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36406.exe
        7⤵
        
        PID:9032
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41962.exe
        6⤵
        
        PID:7512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62984.exe
        6⤵
        
        PID:10768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55331.exe
        6⤵
        
        PID:14944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37854.exe
        6⤵
        
        PID:1452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6218.exe
        5⤵
        
        PID:5824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4205.exe
        6⤵
        
        PID:7932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59337.exe
        6⤵
        
        PID:11636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3956.exe
        6⤵
        
        PID:16364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        6⤵
        
        PID:16512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11095.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11095.exe
        5⤵
        
        PID:8896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38637.exe
        5⤵
        
        PID:12800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33187.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33187.exe
        5⤵
        
        PID:1756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34100.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34100.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56234.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44148.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44148.exe
        6⤵
        
        PID:6396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20734.exe
        7⤵
        
        PID:8112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41054.exe
        7⤵
        
        PID:11404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53716.exe
        7⤵
        
        PID:16024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13193.exe
        7⤵
        
        PID:2656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55343.exe
        7⤵
        
        PID:16884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63473.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63473.exe
        6⤵
        
        PID:9100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6705.exe
        6⤵
        
        PID:12964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7817.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25434.exe
        5⤵
        
        PID:7348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39374.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39622.exe
        6⤵
        
        PID:13988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63628.exe
        6⤵
        
        PID:5104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57786.exe
        6⤵
        
        PID:16468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6026.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6026.exe
        5⤵
        
        PID:11576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21751.exe
        5⤵
        
        PID:13804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21319.exe
        5⤵
        
        PID:10044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4604.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4604.exe
      4⤵
      PID:7072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24958.exe
        5⤵
        
        PID:9588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6732.exe
        5⤵
        
        PID:15020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63405.exe
        5⤵
        
        PID:7112
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25399.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25399.exe
      4⤵
      PID:7032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43560.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43560.exe
      4⤵
      PID:13560
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60149.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60149.exe
      4⤵
      PID:10920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61895.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61895.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14687.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14687.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1184
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44236.exe
        5⤵
        
        PID:4380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48450.exe
        6⤵
        
        PID:6020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8097.exe
        7⤵
        
        PID:6964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57199.exe
        7⤵
        
        PID:11892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54292.exe
        7⤵
        
        PID:16164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24377.exe
        7⤵
        
        PID:2028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39007.exe
        7⤵
        
        PID:16804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37163.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21168.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21168.exe
        6⤵
        
        PID:14936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17964.exe
        6⤵
        
        PID:8248
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31795.exe
        5⤵
        
        PID:6904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24984.exe
        6⤵
        
        PID:9988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39622.exe
        6⤵
        
        PID:14036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26648.exe
        6⤵
        
        PID:7916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63805.exe
        5⤵
        
        PID:10088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40060.exe
        5⤵
        
        PID:14476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33955.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33955.exe
        5⤵
        
        PID:10792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36622.exe
      4⤵
      PID:364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
        5⤵
        
        PID:5864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38118.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8097.exe
        7⤵
        
        PID:7012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57199.exe
        7⤵
        
        PID:11908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34491.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34491.exe
        7⤵
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24808.exe
        7⤵
        
        PID:12272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54921.exe
        6⤵
        
        PID:9200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25179.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25179.exe
        6⤵
        
        PID:13080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48466.exe
        6⤵
        
        PID:9440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17266.exe
        5⤵
        
        PID:7312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61548.exe
        6⤵
        
        PID:9544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47215.exe
        6⤵
        
        PID:13692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31308.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31308.exe
        6⤵
        
        PID:8156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48402.exe
        5⤵
        
        PID:10300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63115.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63115.exe
        5⤵
        
        PID:13368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56744.exe
        5⤵
        
        PID:4008
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1859.exe
        5⤵
        
        PID:9628
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14910.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14910.exe
      4⤵
      PID:6088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32794.exe
        5⤵
        
        PID:7420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe
        5⤵
        
        PID:12464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10147.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25015.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25015.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:8088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65351.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65351.exe
      4⤵
      PID:12756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42884.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42884.exe
      4⤵
      PID:12152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62931.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62931.exe
      4⤵
      PID:16412
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19955.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30422.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30422.exe
      4⤵
      PID:1148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50541.exe
        5⤵
        
        PID:7056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4563.exe
        6⤵
        
        PID:9312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12980.exe
        6⤵
        
        PID:14112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-914.exe
        6⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61678.exe
        6⤵
        
        PID:11800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28199.exe
        5⤵
        
        PID:7940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3224.exe
        5⤵
        
        PID:13512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53807.exe
        5⤵
        
        PID:8136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5616.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5616.exe
      4⤵
      PID:7124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36852.exe
        5⤵
        
        PID:9224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49161.exe
        5⤵
        
        PID:13432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7982.exe
        5⤵
        
        PID:8356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65532.exe
      4⤵
      PID:8464
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3224.exe
      4⤵
      PID:13480
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37854.exe
      4⤵
      PID:3168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59165.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59165.exe
    3⤵
    PID:4028
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31320.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31320.exe
      4⤵
      PID:1160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12539.exe
        5⤵
        
        PID:10236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39622.exe
        5⤵
        
        PID:14028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7328.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31144.exe
        5⤵
        
        PID:16444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49851.exe
      4⤵
      PID:9324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62896.exe
      4⤵
      PID:13380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21439.exe
      4⤵
      PID:7896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20563.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20563.exe
    3⤵
    PID:7272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33126.exe
      4⤵
      PID:11304
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17661.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17661.exe
      4⤵
      PID:6696
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28493.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28493.exe
    3⤵
    PID:10624
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57086.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57086.exe
    3⤵
    PID:14788
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50913.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50913.exe
    3⤵
    PID:10488
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33830.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33830.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30344.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30344.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35928.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6737.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6737.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18772.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25762.exe
        7⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40282.exe
        8⤵
        
        PID:5988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18980.exe
        9⤵
        
        PID:7604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe
        9⤵
        
        PID:12300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58388.exe
        9⤵
        
        PID:7476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50069.exe
        8⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65096.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21518.exe
        8⤵
        
        PID:2716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43358.exe
        7⤵
        
        PID:5560
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15752.exe
        8⤵
        
        PID:6084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17174.exe
        9⤵
        
        PID:11808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42628.exe
        9⤵
        
        PID:8672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49554.exe
        8⤵
        
        PID:11172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54729.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54729.exe
        8⤵
        
        PID:15512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28508.exe
        8⤵
        
        PID:8188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58028.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58028.exe
        7⤵
        
        PID:7812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5258.exe
        7⤵
        
        PID:11076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18269.exe
        7⤵
        
        PID:13680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11973.exe
        7⤵
        
        PID:11296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61319.exe
        6⤵
        
        PID:4816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54672.exe
        7⤵
        
        PID:5872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15752.exe
        8⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        9⤵
        
        PID:10328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54397.exe
        9⤵
        
        PID:14404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7328.exe
        9⤵
        
        PID:220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33474.exe
        9⤵
        
        PID:7216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22911.exe
        8⤵
        
        PID:10004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57059.exe
        8⤵
        
        PID:14156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49723.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23680.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23680.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12029.exe
        7⤵
        
        PID:11244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46369.exe
        7⤵
        
        PID:15144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4528.exe
        7⤵
        
        PID:1052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55144.exe
        7⤵
        
        PID:16744
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7893.exe
        6⤵
        
        PID:5816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3665.exe
        7⤵
        
        PID:7620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53716.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53716.exe
        7⤵
        
        PID:16052
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13193.exe
        7⤵
        
        PID:2660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24808.exe
        7⤵
        
        PID:10900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64215.exe
        6⤵
        
        PID:8624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58752.exe
        6⤵
        
        PID:12552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44607.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44607.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47915.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63094.exe
        6⤵
        
        PID:3340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45134.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45134.exe
        7⤵
        
        PID:6488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36852.exe
        8⤵
        
        PID:8612
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49161.exe
        8⤵
        
        PID:13448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63628.exe
        8⤵
        
        PID:14452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33474.exe
        8⤵
        
        PID:7140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34692.exe
        7⤵
        
        PID:9016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22465.exe
        7⤵
        
        PID:12936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51019.exe
        7⤵
        
        PID:16376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61565.exe
        7⤵
        
        PID:16592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26420.exe
        6⤵
        
        PID:6584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31974.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31974.exe
        7⤵
        
        PID:10352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40312.exe
        7⤵
        
        PID:14308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13847.exe
        7⤵
        
        PID:8128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60270.exe
        6⤵
        
        PID:9896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59223.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59223.exe
        6⤵
        
        PID:14020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45753.exe
        6⤵
        
        PID:5948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45029.exe
        6⤵
        
        PID:16752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32999.exe
        5⤵
        
        PID:4476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16354.exe
        6⤵
        
        PID:6388
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62534.exe
        7⤵
        
        PID:9184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60645.exe
        7⤵
        
        PID:13036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61298.exe
        7⤵
        
        PID:2880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14999.exe
        7⤵
        
        PID:3772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48507.exe
        6⤵
        
        PID:8996
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37843.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37843.exe
        6⤵
        
        PID:12944
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5182.exe
        6⤵
        
        PID:8812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35139.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35139.exe
        5⤵
        
        PID:5932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53790.exe
        6⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2119.exe
        7⤵
        
        PID:14088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe
        6⤵
        
        PID:10748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11325.exe
        6⤵
        
        PID:8056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23453.exe
        5⤵
        
        PID:8300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15636.exe
        5⤵
        
        PID:11552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22281.exe
        5⤵
        
        PID:14716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61971.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61971.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52409.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52409.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51252.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15648.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15648.exe
        6⤵
        
        PID:1676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25700.exe
        7⤵
        
        PID:6056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11003.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11003.exe
        8⤵
        
        PID:8708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54344.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12684
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46520.exe
        8⤵
        
        PID:4528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3007.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3007.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45480.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45480.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48421.exe
        7⤵
        
        PID:16020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31795.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19172.exe
        7⤵
        
        PID:8796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31977.exe
        7⤵
        
        PID:12332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30184.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30184.exe
        7⤵
        
        PID:6472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50977.exe
        6⤵
        
        PID:8680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65325.exe
        6⤵
        
        PID:13960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37591.exe
        6⤵
        
        PID:6892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43420.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43420.exe
        5⤵
        
        PID:4148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32114.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32114.exe
        6⤵
        
        PID:5940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11387.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11387.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9306.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9306.exe
        7⤵
        
        PID:12980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42820.exe
        7⤵
        
        PID:11188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30145.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48341.exe
        6⤵
        
        PID:13572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37854.exe
        6⤵
        
        PID:9756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19953.exe
        5⤵
        
        PID:5848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32664.exe
        6⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41896.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41896.exe
        7⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6950.exe
        7⤵
        
        PID:14800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52523.exe
        7⤵
        
        PID:5244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22222.exe
        6⤵
        
        PID:6336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12517.exe
        6⤵
        
        PID:14708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42628.exe
        6⤵
        
        PID:8552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51257.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51257.exe
        5⤵
        
        PID:7596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50485.exe
        6⤵
        
        PID:8092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11175.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11175.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51127.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51127.exe
        5⤵
        
        PID:14992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6864.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6864.exe
        5⤵
        
        PID:2760
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26839.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26839.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50842.exe
        5⤵
        
        PID:3308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30360.exe
        6⤵
        
        PID:5152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38310.exe
        7⤵
        
        PID:5320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5907.exe
        8⤵
        
        PID:10632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49135.exe
        8⤵
        
        PID:15156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20234.exe
        8⤵
        
        PID:15960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63255.exe
        7⤵
        
        PID:9796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-457.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-457.exe
        7⤵
        
        PID:14108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17661.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17661.exe
        7⤵
        
        PID:6680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62575.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62575.exe
        6⤵
        
        PID:8168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10083.exe
        6⤵
        
        PID:10512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5144.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5144.exe
        6⤵
        
        PID:14464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60605.exe
        6⤵
        
        PID:8352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16908.exe
        5⤵
        
        PID:6724
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22654.exe
        6⤵
        
        PID:9452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49161.exe
        6⤵
        
        PID:13532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7328.exe
        6⤵
        
        PID:16356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33474.exe
        6⤵
        
        PID:10652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13425.exe
        5⤵
        
        PID:9160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14708.exe
        5⤵
        
        PID:13028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28508.exe
        5⤵
        
        PID:11328
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20966.exe
      4⤵
      PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32280.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32280.exe
        5⤵
        
        PID:5176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41294.exe
        6⤵
        
        PID:11160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
        6⤵
        
        PID:5228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23848.exe
        6⤵
        
        PID:8364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44205.exe
        5⤵
        
        PID:10112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46369.exe
        5⤵
        
        PID:14908
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13158.exe
        5⤵
        
        PID:5756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16333.exe
      4⤵
      PID:7796
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29258.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29258.exe
      4⤵
      PID:11004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45442.exe
      4⤵
      PID:14128
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3808.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3808.exe
      4⤵
      PID:10908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63125.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63125.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45632.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45632.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37630.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2676
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22602.exe
        6⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20630.exe
        7⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47376.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47376.exe
        8⤵
        
        PID:6596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11911.exe
        9⤵
        
        PID:12436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31640.exe
        9⤵
        
        PID:2276
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10723.exe
        9⤵
        
        PID:16632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16358.exe
        8⤵
        
        PID:11084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13193.exe
        8⤵
        
        PID:2424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49121.exe
        8⤵
        
        PID:16456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48507.exe
        7⤵
        
        PID:6568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49876.exe
        7⤵
        
        PID:12492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60256.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60256.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:16380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24808.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24808.exe
        7⤵
        
        PID:6356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7867.exe
        6⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63852.exe
        7⤵
        
        PID:10732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40521.exe
        7⤵
        
        PID:4512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28508.exe
        7⤵
        
        PID:7592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54267.exe
        6⤵
        
        PID:10292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54450.exe
        6⤵
        
        PID:13360
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15953.exe
        6⤵
        
        PID:7100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27135.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27135.exe
        5⤵
        
        PID:6932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16240.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16240.exe
        6⤵
        
        PID:9620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47215.exe
        6⤵
        
        PID:13700
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42824.exe
        6⤵
        
        PID:2120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37174.exe
        6⤵
        
        PID:8820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28035.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28035.exe
        5⤵
        
        PID:7560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35591.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35591.exe
        5⤵
        
        PID:12792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15320.exe
        5⤵
        
        PID:1384
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2396.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2396.exe
        5⤵
        
        PID:11524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3374.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3374.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56234.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38118.exe
        6⤵
        
        PID:6548
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16432.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49161.exe
        7⤵
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15958.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15958.exe
        7⤵
        
        PID:5192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58211.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58211.exe
        6⤵
        
        PID:9348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53358.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25908.exe
        6⤵
        
        PID:7328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25434.exe
        5⤵
        
        PID:7344
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37812.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25602.exe
        6⤵
        
        PID:6684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33819.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65445.exe
        5⤵
        
        PID:14780
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49723.exe
        5⤵
        
        PID:16000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62548.exe
      4⤵
      PID:6076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19172.exe
        5⤵
        
        PID:8788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54344.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54344.exe
        5⤵
        
        PID:12788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46520.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4132.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4132.exe
      4⤵
      PID:8292
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62296.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62296.exe
      4⤵
      PID:11460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42932.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42932.exe
      4⤵
      PID:16272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50253.exe
      4⤵
      PID:6808
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21219.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21219.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61942.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61942.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18518.exe
        5⤵
        
        PID:1288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47080.exe
        6⤵
        
        PID:6436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58066.exe
        7⤵
        
        PID:8776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31977.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31977.exe
        7⤵
        
        PID:12784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23962.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23962.exe
        7⤵
        
        PID:10452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48507.exe
        6⤵
        
        PID:9004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2045.exe
        6⤵
        
        PID:12868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41429.exe
        6⤵
        
        PID:15932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45831.exe
        6⤵
        
        PID:7048
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58517.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30822.exe
        6⤵
        
        PID:9520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16488.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16488.exe
        6⤵
        
        PID:13672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34624.exe
        6⤵
        
        PID:8920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32859.exe
        5⤵
        
        PID:9396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3224.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3224.exe
        5⤵
        
        PID:13544
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17434.exe
        5⤵
        
        PID:9068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20416.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20416.exe
      4⤵
      PID:5976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61382.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61382.exe
        5⤵
        
        PID:8160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35626.exe
        6⤵
        
        PID:11480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64720.exe
        6⤵
        
        PID:6136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-65450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65450.exe
        6⤵
        
        PID:16828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64791.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64791.exe
        5⤵
        
        PID:11644
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24551.exe
        5⤵
        
        PID:14596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10147.exe
        5⤵
        
        PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63804.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63804.exe
      4⤵
      PID:8304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18544.exe
        5⤵
        
        PID:11336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63048.exe
        5⤵
        
        PID:8452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58325.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58325.exe
      4⤵
      PID:11752
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12305.exe
      4⤵
      PID:7900
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62095.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62095.exe
      4⤵
      PID:16868
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30951.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30951.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2004
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17340.exe
      4⤵
      PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48616.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48616.exe
        5⤵
        
        PID:5888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56260.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56260.exe
        6⤵
        
        PID:4608
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55045.exe
        6⤵
        
        PID:7616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44205.exe
        5⤵
        
        PID:10052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40914.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38767.exe
        5⤵
        
        PID:16332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61565.exe
        5⤵
        
        PID:16620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29902.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29902.exe
      4⤵
      PID:7868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55430.exe
        5⤵
        
        PID:12696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54469.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54469.exe
        5⤵
        
        PID:7740
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64930.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64930.exe
      4⤵
      PID:11068
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35679.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35679.exe
      4⤵
      PID:14576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7512.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7512.exe
      4⤵
      PID:10484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-5093.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-5093.exe
    3⤵
    PID:5892
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10593.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10593.exe
      4⤵
      PID:9960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39622.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39622.exe
      4⤵
      PID:13996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4666.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4666.exe
      4⤵
      PID:15964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-39014.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-39014.exe
    3⤵
    PID:8616
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59282.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59282.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:12572
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64228.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64228.exe
    3⤵
    PID:7724
- C:\Users\Admin\AppData\Local\Temp\Unicorn-51396.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-51396.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21538.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21538.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4360.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4360.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5533.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5533.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3020
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48066.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48066.exe
        6⤵
        
        PID:5472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50370.exe
        7⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43816.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43816.exe
        8⤵
        
        PID:12208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43447.exe
        8⤵
        
        PID:8660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44205.exe
        7⤵
        
        PID:10124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42860.exe
        7⤵
        
        PID:14496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32322.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32322.exe
        7⤵
        
        PID:9740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15320.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15320.exe
        6⤵
        
        PID:7528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62984.exe
        6⤵
        
        PID:10776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11174.exe
        6⤵
        
        PID:14348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62359.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62359.exe
        6⤵
        
        PID:9268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39274.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39274.exe
        5⤵
        
        PID:5480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49000.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49000.exe
        6⤵
        
        PID:6660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20874.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20874.exe
        7⤵
        
        PID:9808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35128.exe
        7⤵
        
        PID:15536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63628.exe
        7⤵
        
        PID:12172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33474.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33474.exe
        7⤵
        
        PID:11000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22911.exe
        6⤵
        
        PID:7324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30417.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30417.exe
        6⤵
        
        PID:13668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37854.exe
        6⤵
        
        PID:10096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6689.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6689.exe
        5⤵
        
        PID:8076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49400.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21828.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21828.exe
        6⤵
        
        PID:15984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50961.exe
        6⤵
        
        PID:5256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64957.exe
        5⤵
        
        PID:10404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4839.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4839.exe
        5⤵
        
        PID:14660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46783.exe
        5⤵
        
        PID:6504
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64940.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64940.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:1260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60702.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60702.exe
        5⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55222.exe
        6⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41294.exe
        7⤵
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3733.exe
        7⤵
        
        PID:8748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57033.exe
        6⤵
        
        PID:9412
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12517.exe
        6⤵
        
        PID:14668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33422.exe
        6⤵
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22286.exe
        6⤵
        
        PID:14792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11044.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11044.exe
        5⤵
        
        PID:7672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42882.exe
        6⤵
        
        PID:9848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12980.exe
        6⤵
        
        PID:14120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3706.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3706.exe
        6⤵
        
        PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3093.exe
        5⤵
        
        PID:10712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51247.exe
        5⤵
        
        PID:14872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37854.exe
        5⤵
        
        PID:6976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13758.exe
      4⤵
      PID:5744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54407.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:8040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12029.exe
        5⤵
        
        PID:11236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46369.exe
        5⤵
        
        PID:14864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27548.exe
        5⤵
        
        PID:15180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56790.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56790.exe
      4⤵
      PID:7712
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47516.exe
        5⤵
        
        PID:11156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35128.exe
        5⤵
        
        PID:15528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57375.exe
        5⤵
        
        PID:10196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23036.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23036.exe
      4⤵
      PID:10868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-709.exe
      4⤵
      PID:15100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28120.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28120.exe
      4⤵
      PID:16660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11568.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11568.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2819.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2819.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19094.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19094.exe
        5⤵
        
        PID:4272
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25674.exe
        6⤵
        
        PID:6864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27698.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27698.exe
        7⤵
        
        PID:10740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5004.exe
        7⤵
        
        PID:14912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30540.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44205.exe
        6⤵
        
        PID:10132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12133.exe
        6⤵
        
        PID:14324
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48466.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48466.exe
        6⤵
        
        PID:9292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25931.exe
        5⤵
        
        PID:7444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38964.exe
        6⤵
        
        PID:11444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63048.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63048.exe
        6⤵
        
        PID:8656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37521.exe
        5⤵
        
        PID:12252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31656.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31656.exe
        5⤵
        
        PID:5680
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55873.exe
        5⤵
        
        PID:16876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1366.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1366.exe
      4⤵
      PID:5528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33842.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33842.exe
        5⤵
        
        PID:7028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39374.exe
        6⤵
        
        PID:10164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39622.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39622.exe
        6⤵
        
        PID:14004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54391.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54391.exe
        6⤵
        
        PID:2176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35228.exe
        6⤵
        
        PID:16496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44205.exe
        5⤵
        
        PID:9192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46369.exe
        5⤵
        
        PID:14836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17434.exe
        5⤵
        
        PID:7864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26533.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26533.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:6640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63852.exe
        5⤵
        
        PID:10696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7848.exe
        5⤵
        
        PID:6116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55343.exe
        5⤵
        
        PID:16852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11096.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11096.exe
      4⤵
      PID:10188
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 10188 -s 212
        5⤵
        Program crash
        
        PID:10424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
      4⤵
      PID:14300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48184.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48184.exe
      4⤵
      PID:3492
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35453.exe
      4⤵
      PID:16816
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51920.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51920.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:468
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4511.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4511.exe
      4⤵
      PID:5280
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16930.exe
        5⤵
        
        PID:5748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16432.exe
        6⤵
        
        PID:8632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49161.exe
        6⤵
        
        PID:13456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44931.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44931.exe
        6⤵
        
        PID:6912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49851.exe
        5⤵
        
        PID:9332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24989.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24989.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42323.exe
        5⤵
        
        PID:11048
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20966.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20966.exe
      4⤵
      PID:6460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27890.exe
        5⤵
        
        PID:10336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40312.exe
        5⤵
        
        PID:14316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26100.exe
        5⤵
        
        PID:9064
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5231.exe
      4⤵
      PID:9804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18382.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-18382.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:14692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52245.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52245.exe
      4⤵
      PID:8148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-30095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-30095.exe
    3⤵
    PID:3460
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46644.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46644.exe
      4⤵
      PID:7700
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51169.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:11324
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53716.exe
      4⤵
      PID:16044
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51019.exe
      4⤵
      PID:3532
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30838.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30838.exe
      4⤵
      PID:16644
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-20739.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-20739.exe
    3⤵
    PID:8504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34048.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34048.exe
    3⤵
    PID:12500
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47772.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47772.exe
    3⤵
    PID:212
- C:\Users\Admin\AppData\Local\Temp\Unicorn-25549.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-25549.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2952
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-23074.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-23074.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12933.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59358.exe
        5⤵
        
        PID:1544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47080.exe
        6⤵
        
        PID:6408
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10811.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10811.exe
        7⤵
        
        PID:6880
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35216.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35216.exe
        7⤵
        
        PID:12032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42851.exe
        7⤵
        
        PID:4672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63511.exe
        7⤵
        
        PID:10804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48507.exe
        6⤵
        
        PID:8988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10213.exe
        6⤵
        
        PID:12896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37854.exe
        6⤵
        
        PID:10064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7867.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64070.exe
        6⤵
        
        PID:10228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37292.exe
        6⤵
        
        PID:14292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61298.exe
        6⤵
        
        PID:3972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27060.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27060.exe
        6⤵
        
        PID:10396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54267.exe
        5⤵
        
        PID:10308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54450.exe
        5⤵
        
        PID:13416
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31355.exe
        5⤵
        
        PID:16040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64765.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64765.exe
      4⤵
      PID:1252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20630.exe
        5⤵
        
        PID:6428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11169.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11169.exe
        6⤵
        
        PID:10496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40888.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40888.exe
        6⤵
        
        PID:14136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26100.exe
        6⤵
        
        PID:7612
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48507.exe
        5⤵
        
        PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35678.exe
        5⤵
        
        PID:8876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2695.exe
        5⤵
        
        PID:5160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53013.exe
        5⤵
        
        PID:9748
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6715.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6715.exe
      4⤵
      PID:5752
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63520.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63520.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41900.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11804
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40682.exe
        5⤵
        
        PID:10380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64407.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-64407.exe
      4⤵
      PID:1712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32877.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32877.exe
      4⤵
      PID:12976
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5751.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5751.exe
      4⤵
      PID:8200
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13680.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2200
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56234.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56234.exe
      4⤵
      PID:5388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29374.exe
        5⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16790.exe
        6⤵
        
        PID:10536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35128.exe
        6⤵
        
        PID:15604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52523.exe
        6⤵
        
        PID:6244
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29814.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29814.exe
        5⤵
        
        PID:10072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53358.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53358.exe
        5⤵
        
        PID:14044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36214.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9098.exe
      4⤵
      PID:7264
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16790.exe
        5⤵
        
        PID:10252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37458.exe
        5⤵
        
        PID:14152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4282.exe
        5⤵
        
        PID:10388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52294.exe
      4⤵
      PID:10604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65445.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65445.exe
      4⤵
      PID:14828
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24229.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24229.exe
    3⤵
    PID:4632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22680.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22680.exe
      4⤵
      PID:7952
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51169.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51169.exe
      4⤵
      PID:11344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53716.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53716.exe
      4⤵
      PID:16032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3956.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3956.exe
      4⤵
      PID:15540
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29405.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29405.exe
    3⤵
    PID:8524
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50584.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50584.exe
    3⤵
    PID:12508
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52505.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52505.exe
    3⤵
    PID:5768
- C:\Users\Admin\AppData\Local\Temp\Unicorn-53230.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-53230.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-35492.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-35492.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26878.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26878.exe
      4⤵
      PID:2380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38336.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38336.exe
        5⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47516.exe
        6⤵
        
        PID:11168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35128.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35128.exe
        6⤵
        
        PID:15588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63405.exe
        6⤵
        
        PID:8392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44615.exe
        5⤵
        
        PID:8592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61552.exe
        5⤵
        
        PID:12560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5654.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5654.exe
        5⤵
        
        PID:14788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54433.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54433.exe
      4⤵
      PID:5484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47952.exe
        5⤵
        
        PID:8952
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53847.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53847.exe
        5⤵
        
        PID:12836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35564.exe
        5⤵
        
        PID:15660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62664.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62664.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51334.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51334.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3224.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3224.exe
      4⤵
      PID:13392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46215.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46215.exe
      4⤵
      PID:9180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63011.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63011.exe
    3⤵
    PID:5332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47656.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47656.exe
      4⤵
      PID:216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51818.exe
        5⤵
        
        PID:9944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12980.exe
        5⤵
        
        PID:14100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5844.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5844.exe
        5⤵
        
        PID:3136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49851.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49851.exe
      4⤵
      PID:9340
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62896.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-62896.exe
      4⤵
      PID:13488
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46520.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46520.exe
      4⤵
      PID:4092
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34701.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34701.exe
    3⤵
    PID:6556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4231.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4231.exe
      4⤵
      PID:15964
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59130.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59130.exe
      4⤵
      PID:4868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51921.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51921.exe
      4⤵
      PID:16528
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11096.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11096.exe
    3⤵
    PID:10172
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 10172 -s 176
      4⤵
      Program crash
      PID:10676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48228.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48228.exe
    3⤵
    PID:14456
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1999.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1999.exe
    3⤵
    PID:4168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41291.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41291.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:11604
- C:\Users\Admin\AppData\Local\Temp\Unicorn-12164.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-12164.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3504
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-56234.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-56234.exe
    3⤵
    PID:5396
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24112.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24112.exe
      4⤵
      PID:5576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49296.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49296.exe
        5⤵
        
        PID:9296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49161.exe
        5⤵
        
        PID:13472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30348.exe
        5⤵
        
        PID:9272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44205.exe
      4⤵
      PID:10108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46369.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46369.exe
      4⤵
      PID:14844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40761.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-40761.exe
      4⤵
      PID:9144
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1314.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1314.exe
    3⤵
    PID:7776
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48594.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48594.exe
    3⤵
    PID:11012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53577.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53577.exe
    3⤵
    PID:13888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42131.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42131.exe
    3⤵
    PID:8028
- C:\Users\Admin\AppData\Local\Temp\Unicorn-21959.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-21959.exe
  2⤵
  PID:5208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-16520.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-16520.exe
    3⤵
    PID:7756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-20874.exe
      4⤵
      PID:10376
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10816.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10816.exe
      4⤵
      PID:15400
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48439.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48439.exe
      4⤵
      PID:7972
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22414.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22414.exe
    3⤵
    PID:10964
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43628.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43628.exe
    3⤵
    PID:13756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31144.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31144.exe
    3⤵
    PID:16600
- C:\Users\Admin\AppData\Local\Temp\Unicorn-52509.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-52509.exe
  2⤵
  PID:8100
- C:\Users\Admin\AppData\Local\Temp\Unicorn-29956.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-29956.exe
  2⤵
  PID:10288
- C:\Users\Admin\AppData\Local\Temp\Unicorn-15568.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-15568.exe
  2⤵
  PID:14900
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13447.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13447.exe
  2⤵
  PID:7956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 10172 -ip 10172
1⤵
PID:10676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 10188 -ip 10188
1⤵
PID:10528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 6372 -ip 6372
1⤵
PID:11880

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3964

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3972 -ip 3972
1⤵
PID:18228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10478.exe

Filesize
468KB

MD5
dc1bb058e4f67f3878d72c964d7002ff

SHA1
1c66c31cf94e7c77e34951a17f47e3f5c7befa2d

SHA256
d915e976f0a3e33f9f801fd64489cf3d71116c150e15c748952cba4522444a1e

SHA512
a71bdda73da6c99a83beb2fe4842a22fa65509d30bd63b2020634c03ef92df216358cf0b7c0d59216035b422334da47ab3ac4157da4fbb22d498cb58aef5741f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-10494.exe

Filesize
468KB

MD5
bc50a85b7143cc502dd6d48889c9024a

SHA1
ca2503a1171eb2cde4dad1fe2ee494ae4f2e1ad8

SHA256
7563509bbba4a4800f538e28738a3a882b3ed46452ca531a8c17a47cf2ff3b8e

SHA512
ed5452db5dfe25ebc8335bb6549036a05802ad4e83659ea1921ef86012b49ee6ce159642b9c82c9d8e6c8a86b9a996d4e062942b3d9e2cc5fcd16d41676447fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11568.exe

Filesize
468KB

MD5
a305432acb1d31daa8de817acac4775a

SHA1
6e2743570673f28b1b4435919a85967462a8ed55

SHA256
14b71bf689d77d4db84f7fb20d765ce5795bfcf2d54b294c2bc27c992007bc4b

SHA512
009a423843ab3ee606277d285c9369144f7106bb4171104e4acb99323a853c49c72b1616a273446d8fb434ade24e32598b3673140510554e38ee1642a0414e9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17236.exe

Filesize
468KB

MD5
7abb957f3ecbc9f1b3ed8555f1533d7d

SHA1
a1148468119f5e608d1c25f60d0bee7208634681

SHA256
cc2183b5b65fbc30c143bfbd6ceaac92f1378cdea1472e43b39b49a5ff58dca3

SHA512
57ed7353558e8f0880e58cc36c12176c80cbb54a50af72db6586774a965072f75b13c65df7f8c0675bfbbfc0a174d2bdc633c6fd4aca965bfb28bef407b01e5d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1859.exe

Filesize
468KB

MD5
c2689727ca54df10da205c6385cf8fea

SHA1
b10d8aba07cebf2eb0093acc668226e00b6779d5

SHA256
af2af4a2f2e3c45569f6ede85166ad137966c8b6493ac7593790e458485104b1

SHA512
b8786258a091a472bfa10031eecbc6e8b2096523a2b9c5a6019fecb66946efa5b0ddaad686e59d7377e12bf0cc5fbee4933c8188279e7dd321363ca4caae479e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-18886.exe

Filesize
468KB

MD5
2a6ba4433180e2bee6c85986f862c435

SHA1
a0fd50363f40dd4549e277a6037d30f421d859da

SHA256
b6e958417e6987b19ee3c32e182e30e321ec2fbb659bb869d2c1dacc42acad75

SHA512
132e331b318bf585be6c78167ad56250223b5a6aa08ef9ca1924183015ee9d370583f564e15c164736d9bc683c627e511d2279235ff680439f7b8711de93e77f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19683.exe

Filesize
468KB

MD5
a93fc5e241ba041e07e7237421c1e775

SHA1
6b119c5a6d155014319ec3667ec179cf1bdca106

SHA256
afbdf2239d8ae0d7c79e25fe7cfaab8536dd54857c72beaf33d1388cc55a3a5a

SHA512
c511f60a00b02e500b4e730fd02d95eeea99ac7f1437b9fc12dacace492a6be80d66a44112b949d6961620d7350c6ba76bd7955a1e4898b89b136dd8c9b62480

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21219.exe

Filesize
468KB

MD5
d7626a67f669cda23637ddf2c3694325

SHA1
3162be411c4c99cf2c51b1fd43ba7571a23d78dd

SHA256
eaa47031feb86c4a6daeb76054ef1a4503d07658829404ae534cffa7f97811d9

SHA512
dd89d630d6fc84d19c66ea73634803e3585b4448e757d76336ffdb8d559a812eb946204142d046a64fe11c4b9b9229801854409b98ff024a986eeff94229f5c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21538.exe

Filesize
468KB

MD5
0ecd91bcd8096976ae1134c5b5167ec2

SHA1
3694d4cf374fa40afcffc769c11d6667c49d855e

SHA256
022a2f3b87db5d1f011f317eeac169b2e41799f6b8325bda48408561e4037784

SHA512
02fb67b9a6907215264df947d3f0af014cc249e1dd1872d21338068f07ea10d24ff29b959bb96934a16f8a38f5376c0ec29a71a4d4d743cf2df3c3aab8d91474

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22176.exe

Filesize
468KB

MD5
ea2774689b694160cf9b2dd0178bd0f7

SHA1
140c3710c9ba6718b76a7c8380a09cb1f16cd881

SHA256
229913207cb252b68d51df3c45aa544b66a8942e4b6281ebd870a6154d138bd3

SHA512
be78d2ed900ce34c5c2fc4d899c202e3e48c106708e33deaaea088476640028e9ad2f7a0deed9a140bfbbf45ba42af8c8673b7e6fa57c361bd0a496c84a378a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23074.exe

Filesize
468KB

MD5
13d1368fcb58783cc9aed7673f34f0cf

SHA1
3f3f22571cc76ad328277bfa06e20ea48753c3b5

SHA256
a1c45f4294311e56e476b99f64af38d8659ac01dd94a29bb093bbdd5fcbbacc4

SHA512
0f5b234ea2904e17be56c23f8d6ca731882421ca3afe4237734c3b56854b1cdd94473de38ec0ccaf1099b90b575384184d15040abb1eedc539fc26fcb0e2be7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23848.exe

Filesize
468KB

MD5
473048621b1d113f0d6b2f63fd10abb7

SHA1
5751763cc2c686b3aeae5602764494bb74b30099

SHA256
1564019d5f66ea8ad16e552e09c925b68ac9aa7e4658979e1ad692ecac5480a6

SHA512
9f4cec4be14246f8bebd6a7c988b78c35c597d9318ae24239719ccba096ee3763f1e4fed4d00d4b7df94831ef6fcca2319d983f34820cb5e61102c2b5fb822da

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25549.exe

Filesize
468KB

MD5
841bbe34a3c1db4975d3ca1b54e52e51

SHA1
375a9a5e37af94135d1113a14748a4f3f96cc4a1

SHA256
916bd90184102c14918735c84168e5065ce9bab701941a2843f238b634696829

SHA512
005d39da3f4d931a22ebad6d81873d50aeac1562cddca06e219a15cfbe82067c96648bfb5a913b76a95fa6647ffa0df79e6079073cdd77c24a88ca226e374a93

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-2824.exe

Filesize
468KB

MD5
b479afd65282622dad406c9c5b74dc24

SHA1
9e5eeca8bf6ed73ed762c3bc6f60b10e18817fc2

SHA256
9b45d14f038d6ace81aa5e309fc7e7fcab7196335e0afe734b40945dee75f346

SHA512
66eb7d7b45844629fd757f1497e1e34acaf042703a967fdafbffe8fbba55e406ac3965a5da10a36a07926896c16351d91e8ae021abacea6c6725cf1866048b05

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-30344.exe

Filesize
468KB

MD5
f7d373f15909fe980322c508a5b9bc5e

SHA1
e47b419045903a74eebb339a866a8024d36148c0

SHA256
630e6a9ef6647a44e59ca31db00a0ef93dd1816750d9f775a6f38af8ec93cd3e

SHA512
cd2099b855b7f619eb009fe48a890d6cb72c8dd2237e0e1b8ab4a93b64495c0292c80778df285e8d9f0c7c83e88af53504125a0625767dda6f54fe26f049233d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32124.exe

Filesize
468KB

MD5
7584315a3a79d85f45852fa78565bd39

SHA1
93f36e3905d2907386227716c426f5b2a2efe98d

SHA256
5650d13b7e788d80543a86509e55e47b3f000db015455e16bb4a91d03e6a14fb

SHA512
84cf1c8d9759a8fde2f4b9e3d7f8a1dc995349ca12299ed60df373ebb59f929a3a9653a3903bff7bddf6fa746c8c35e47d5da80f9560aa62cd8b2bb4fa983258

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33830.exe

Filesize
468KB

MD5
592142dac334f627873300300b1d3dbf

SHA1
33ac98bc6bd795be6f05efda08e0c907c98b8485

SHA256
0b9dab0bec2dba1cfcf9137ff9c8e572c20d728ee92f4cf897bcbf9fb3263c8f

SHA512
a9e9e3bda0364b84b35263cc3f58e7989770efbe7a8a43e2fdeccbb759940fc52ceda32867364d6e2852096a6cdf9d3b91098429f999a842f362a02005478a15

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3513.exe

Filesize
468KB

MD5
1ce6446edac1e7ec07eefe297cf72c85

SHA1
ebeaee3532150ddab6155f0ab063067cfb9a7ddf

SHA256
05d3a47bddeba9e2c31ac972d3fd44e56d24e5cb4d66adf8280d0de704a5cc89

SHA512
97a0c78ca2e92b5414f6493a69de9edd7778fd2724a0e3e1ff051773c3f08b8eb5de93fd5aa2e5167cc647a8f4a3fd523ad167ec9cde787774e37475ca9b8e76

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35928.exe

Filesize
468KB

MD5
fe26ea0a7a276e078400759605c6d5f0

SHA1
c0a9c913033de55b15d9de7e7ba993e9308a4f39

SHA256
32bf62712f38e936be1a21b405e8b5e4623bf0ec7fb6e85800104cdb49072e73

SHA512
b57660c63afd44df97beffdd48cfc7aa8a6a9e2c40ac2e3e55df6267ead2785852e8834487ad4d33036d0716eb8a1a0226120f7ca915111d5b3d5080d7adbf6f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42704.exe

Filesize
468KB

MD5
84d3576870488dff23e2cc84df437cd7

SHA1
c33eb7682d225601194151a9766c6ce6e65282be

SHA256
02394aa079977a3ada2ba8cd3692325da258e48d7f5cbee3030248bbd7e89a04

SHA512
383108b535336563a2b631fe96e77923a91e555365fcbd8487d2a5dc8274f13bf202d1df92bbdcde181c922ef3d02de820c7ebc848c8c619fb326c27decbcb6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4360.exe

Filesize
468KB

MD5
7acd0cad0389a7998ac25b31eeeb659e

SHA1
f0258d1d8d881bbb0c4b73b897b2cf02fccc857e

SHA256
07e3e95363a0ef5cef14184dbeedbdf23333c37dd6203d5b8465e73fde05b05c

SHA512
89805f848311deecb0ed6c08cf61487cddbdf52a28c81a838554b164a482888872bce859db7ab244a00ae964a20a1ffa83fc8a17e05f60d1bb2f84136acf14cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43878.exe

Filesize
468KB

MD5
08e3dc6ea36e61c69a89453c8bec2f38

SHA1
c2a5fdb4db2366f97f4c0710c0760cd15068fd36

SHA256
2c34a9a75396f061b7198a18b262116dd946fe80e8b0746dd3a5b0ec1c7ebd8d

SHA512
044be26d2700427bdc713595fa3bdef1f3634c895db5f250706f3f35ad38c51e3793f8a00e8bce1f8dcd21502d18a8397c2e1b091e2460b181a46cd0a8701853

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45632.exe

Filesize
468KB

MD5
7b42b9d60a8a88bc18723cc7077ddb32

SHA1
3302a2be1c261370d12648a3d8f99d64b16745f3

SHA256
4ba08d17911bbf567596af5f7091a05d514ef16c1e482fb2d0ec64803cc4a97d

SHA512
733281c75b76f09b35788ef507fe1812fe35c5d1d689ea4b1a4b07045fe5750a4b177f5b549573db784b31794c44235e2105c22f126298928daec64357a4f305

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50370.exe

Filesize
468KB

MD5
1981c45c12b9f6abd6c7221d8cb4d294

SHA1
d911398a9a2c0ee7227380ecfd7b6819ca6786fe

SHA256
5616184f8eaba875be59c166214d06fa58f713aa947fc7a5efdd44af1735b3ae

SHA512
9395b1c7eaf3007a90e11c5e8cf755f898fe5d889e8fd15af25f7f6e9f8f4566a36660fff514dd51114bc7dfdd2831d0b8abb5f1a8febe9dd3582a11a904e762

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51396.exe

Filesize
468KB

MD5
972f85e4860192a907ba4fb666d7ab8a

SHA1
10ec0b5cdea78ca9ae6cc4a010395f3477089f44

SHA256
190cd2a6630830d5160d481cc533a93f07a94ee13dd91a727c50d70794473a72

SHA512
61d73ada75ff9d3fba06ceff0efc3f22e43033c692ecd64cb3b23ed1bac2e7bcea81b9d48f5b19c07236c2c6c435acd5b4cd729577af6ff00af790478deb24f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52409.exe

Filesize
468KB

MD5
65ba6a94dddf18c8c714e9ad90f5680e

SHA1
0ce849e074dda475c5cebac5e5ad7c051fe0598e

SHA256
0e036900342d6d2259b325a80846db5d35a0d57a17bf906f202222ba3552772c

SHA512
41fd51f5625264a6c07ac0d9ecb74fc77418e22c3578eeac1ca089d1a699853659892dfe88ba158ddad0f86d084fd5149ab52673bab6ea4129a5242b43560830

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-53230.exe

Filesize
468KB

MD5
56b8100b7292491cd86729addb8fd20e

SHA1
05f42fbb5838576eb88361225980cdeb756e3d5a

SHA256
ee9f1c1359c4d40610f85ccea1ca920f84bc908e18942f3e8f9a91787edb3685

SHA512
04f3952c843654173930dcd3c26c6f422a666fddbb822726f82a8870916917d948a0d7fa470027f3e7605e8040e88c2aadd03b24ae45e980650ca42742499033

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-54594.exe

Filesize
468KB

MD5
3c41f5d7c97a4007accd3353362f2a0b

SHA1
f0db3c9c0291bebc82e7f2f3629cfecf845cc853

SHA256
55751f52573bb69be003422a150656631f5c8c5fd8d8f446b5eccbd4d7c04e26

SHA512
4e2bc7160e970f38ca53fd3881873c1ffe3cdb629a8746349fcd7334cfbce5155d27d4f95df0908aef07b662720e5954b92eec733bfb7be04c5d60bf5a7b6253

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5559.exe

Filesize
468KB

MD5
b00f8cd5d6e4036df7fe4151bb2bf221

SHA1
2cee00c6530be779d2076c3faf788e6a28963b1e

SHA256
5dd480eabff14fbdd25c3428de4a20b3dc6e5e9b11fa569914e222d5260da43a

SHA512
3065e93462a92916b732f5fc3e091ed645f3fd5990465400ea81fe04dc86e5d8a8728b63be0cd171e8fdae8cd2c776013138f8f5c0e2f642dc9172a8fdf85740

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-607.exe

Filesize
468KB

MD5
5766a56f2a025b3fbfa63f4b0d272df8

SHA1
79f7574f775780ab7e536bdcf4ff8ddf1a2a84ca

SHA256
77eb1d40b5de3107f19c1dfc5ae28a999bd2c84c46cfe9c65858de79f741183b

SHA512
6c50def04f692c5ae65e61842a733dad110f55cb1005bb8364329259fd37930ecbfe263281ab8687cdd49892907f4c268d2b248c4f92339bcd76393e525c04e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61895.exe

Filesize
468KB

MD5
2b9f0b9c84c77f583cb707e4d2eee6b7

SHA1
a1d575343f3088ad495577b0a278bfce0c8546b0

SHA256
aea48dc6a85879770f7494a4700d330aa5509576e3ccd504b9f23ca09eac851b

SHA512
c18f5b99520245977735b190889c6c9e6c013c4aa9a953d453ea33e8eb661fa9213396a519f5c54973d4d46dc87a6ee711db1f7cc7f5911dc103eaa277230ba1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-62907.exe

Filesize
468KB

MD5
2dd8f4ccdeb0d880cc79d1485db8628f

SHA1
a29c7b2f08b3fe2791ecdfbcb6cc0786aae74c01

SHA256
f9fb15217387195be1eea36a04a6b63aaa1deaf8014ea6de7b2bdc4b84623f26

SHA512
a348107b42a3039a604ae248a1a69bbe151d3d8e68fb6496df80e00426a70af77af550acfb7f9c063cdad62828ce226b318ca90ac268c843dffa5a8ab639a150

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63125.exe

Filesize
468KB

MD5
17216dd93fd44c6315c3ea60284aa7c0

SHA1
3054ae8f2e9d40512401bc9c087a4c7b1a802efb

SHA256
ed1a9e4612a7314c6ca279acb4b8db55b364cf486a4c707a22a428120b34ee1e

SHA512
e19780e9e212ce2e4adade1c160a261ce3ca35e0789f36cb57657c415119015727b31c124f53ddb599a64fe9b5ee2619cf5e69d2ce396ae73b458c8d1a4a0980

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6737.exe

Filesize
468KB

MD5
a49efc38e153bde9cb05a342623e7ccc

SHA1
390a3a0dbeea8b1968317054d89c32e97b4ff40e

SHA256
ca089106861ffbb965fcde519b5209338b2840302a8efc329edf93a2aedd717b

SHA512
571a2015d14edad5c16f32f2d3df5b9d28a2702cfa6fcd3bff487d034d8df72292963e0696539d82cd0255146ac214f4a1e6be1ad1736d8aa0608fdce9c2b1bf

Download Submit
memory/364-408-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/400-362-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/408-363-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/432-124-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/468-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/932-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1112-105-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1148-436-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1184-232-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1252-514-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1260-382-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1288-466-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1292-112-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1340-344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1444-252-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1472-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1544-461-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1652-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1676-415-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1696-138-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1716-312-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1908-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2004-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2032-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2148-383-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2180-125-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2200-294-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2204-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2296-332-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2316-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2380-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2556-200-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2648-183-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2668-385-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2676-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2732-45-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2756-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2836-460-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2916-181-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2952-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3012-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3020-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3116-215-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3124-79-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3308-437-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3340-434-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3364-360-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3416-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3504-355-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3512-397-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3568-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3616-184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3648-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3676-253-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3736-364-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3808-222-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3852-44-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3868-43-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3900-356-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3960-146-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3976-325-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4004-409-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4028-512-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4148-418-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4188-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4212-340-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4272-513-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4336-448-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4380-407-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4404-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4472-88-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4476-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4540-467-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4588-353-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4652-74-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4660-165-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4684-251-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4700-145-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4788-291-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4816-414-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4828-276-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4848-205-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4980-268-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5092-244-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5112-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5168-515-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5184-516-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5200-517-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5236-518-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5280-519-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5324-534-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5332-537-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5364-535-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5372-536-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5488-540-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5504-541-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads