b338e9b54119c6a2208b6c51b7b50a38837051435df4872224e3976a1ba93d17

Analysis

max time kernel
120s
max time network
121s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 09:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b338e9b54119c6a2208b6c51b7b50a38837051435df4872224e3976a1ba93d17N.exe
Size

468KB
MD5

b6aa452d013269cba08194916cc12b50
SHA1

6ac38abe2011695647ddc756886b3bfa0aa0f7e5
SHA256

b338e9b54119c6a2208b6c51b7b50a38837051435df4872224e3976a1ba93d17
SHA512

851d9f8874d84f07d6d62e777ed69d3386e9895d4ef812255fe9d99ea94240e39b3b2d5163ed63a8207543ce04483d4fbec706faba667b609f75f85b42a62999
SSDEEP

3072:LqoFogLdjC8n2bxVPz5Wf99kChjWXpwnmHeFVqlnEi3E311TyS9lQ:LqKoo7n2fP1Wf9g5KaEi3qTTyS

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2896	Unicorn-10698.exe
6080	Unicorn-9759.exe
5168	Unicorn-46194.exe
3840	Unicorn-33828.exe
3076	Unicorn-12893.exe
1676	Unicorn-7085.exe
1368	Unicorn-13215.exe
1880	Unicorn-4191.exe
3980	Unicorn-4191.exe
2104	Unicorn-23278.exe
5848	Unicorn-7761.exe
5156	Unicorn-23543.exe
3436	Unicorn-23543.exe
3120	Unicorn-17412.exe
3472	Unicorn-3677.exe
4848	Unicorn-60164.exe
4940	Unicorn-43313.exe
3176	Unicorn-27108.exe
5572	Unicorn-17871.exe
1968	Unicorn-39360.exe
320	Unicorn-61316.exe
4316	Unicorn-47995.exe
2108	Unicorn-28129.exe
5028	Unicorn-28129.exe
1332	Unicorn-52079.exe
4876	Unicorn-1901.exe
6024	Unicorn-52079.exe
5420	Unicorn-64066.exe
5060	Unicorn-19521.exe
5372	Unicorn-8586.exe
3052	Unicorn-22321.exe
5700	Unicorn-51332.exe
5512	Unicorn-51332.exe
4912	Unicorn-34481.exe
4712	Unicorn-48217.exe
4444	Unicorn-2214.exe
3428	Unicorn-22635.exe
5092	Unicorn-64544.exe
3112	Unicorn-55307.exe
2448	Unicorn-39525.exe
4536	Unicorn-4060.exe
2512	Unicorn-16312.exe
2684	Unicorn-22443.exe
3712	Unicorn-32147.exe
5296	Unicorn-32147.exe
3260	Unicorn-31882.exe
2532	Unicorn-53636.exe
1916	Unicorn-52567.exe
2128	Unicorn-7450.exe
4880	Unicorn-59774.exe
5416	Unicorn-10772.exe
5432	Unicorn-65374.exe
2580	Unicorn-32701.exe
2436	Unicorn-27222.exe
4744	Unicorn-21356.exe
1580	Unicorn-7621.exe
2976	Unicorn-32448.exe
3772	Unicorn-54139.exe
5436	Unicorn-57419.exe
1136	Unicorn-61503.exe
5540	Unicorn-13926.exe
3588	Unicorn-14340.exe
2792	Unicorn-605.exe
5268	Unicorn-61503.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
1232	15208	WerFault.exe	662
15796	15584	WerFault.exe	682

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46194.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42098.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48230.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38435.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14630.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-31801.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46157.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-51851.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2498.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-751.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-27222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64371.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3743.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4191.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-41823.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33657.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20997.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2098.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35539.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21801.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19217.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-62902.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33432.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47334.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38435.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35375.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64474.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-89.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58782.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60147.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3074.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55959.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1934.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5725.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-3021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23494.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36335.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-64910.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-53188.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13433.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9720.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42022.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63587.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1901.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24748.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58678.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-801.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-37739.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15097.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-52222.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46239.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-2710.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20665.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-18669.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19447.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-24714.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	3224	dwm.exe
Token: SeChangeNotifyPrivilege	3224	dwm.exe
Token: 33	3224	dwm.exe
Token: SeIncBasePriorityPrivilege	3224	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
5744	b338e9b54119c6a2208b6c51b7b50a38837051435df4872224e3976a1ba93d17N.exe
2896	Unicorn-10698.exe
6080	Unicorn-9759.exe
5168	Unicorn-46194.exe
3076	Unicorn-12893.exe
3840	Unicorn-33828.exe
1368	Unicorn-13215.exe
1676	Unicorn-7085.exe
1880	Unicorn-4191.exe
3472	Unicorn-3677.exe
3980	Unicorn-4191.exe
5848	Unicorn-7761.exe
3436	Unicorn-23543.exe
3120	Unicorn-17412.exe
2104	Unicorn-23278.exe
5156	Unicorn-23543.exe
4848	Unicorn-60164.exe
4940	Unicorn-43313.exe
5572	Unicorn-17871.exe
3176	Unicorn-27108.exe
5028	Unicorn-28129.exe
2108	Unicorn-28129.exe
320	Unicorn-61316.exe
3052	Unicorn-22321.exe
4316	Unicorn-47995.exe
5372	Unicorn-8586.exe
5420	Unicorn-64066.exe
4876	Unicorn-1901.exe
1332	Unicorn-52079.exe
6024	Unicorn-52079.exe
5060	Unicorn-19521.exe
1968	Unicorn-39360.exe
4712	Unicorn-48217.exe
5512	Unicorn-51332.exe
5700	Unicorn-51332.exe
4912	Unicorn-34481.exe
4444	Unicorn-2214.exe
3428	Unicorn-22635.exe
5092	Unicorn-64544.exe
3112	Unicorn-55307.exe
2448	Unicorn-39525.exe
2684	Unicorn-22443.exe
3712	Unicorn-32147.exe
3260	Unicorn-31882.exe
2580	Unicorn-32701.exe
2128	Unicorn-7450.exe
1916	Unicorn-52567.exe
5416	Unicorn-10772.exe
4880	Unicorn-59774.exe
2532	Unicorn-53636.exe
5296	Unicorn-32147.exe
4536	Unicorn-4060.exe
2512	Unicorn-16312.exe
5432	Unicorn-65374.exe
2436	Unicorn-27222.exe
4744	Unicorn-21356.exe
2976	Unicorn-32448.exe
1580	Unicorn-7621.exe
5436	Unicorn-57419.exe
5268	Unicorn-61503.exe
5540	Unicorn-13926.exe
1136	Unicorn-61503.exe
3772	Unicorn-54139.exe
2792	Unicorn-605.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5744 wrote to memory of 2896	5744	b338e9b54119c6a2208b6c51b7b50a38837051435df4872224e3976a1ba93d17N.exe	89
PID 5744 wrote to memory of 2896	5744	b338e9b54119c6a2208b6c51b7b50a38837051435df4872224e3976a1ba93d17N.exe	89
PID 5744 wrote to memory of 2896	5744	b338e9b54119c6a2208b6c51b7b50a38837051435df4872224e3976a1ba93d17N.exe	89
PID 2896 wrote to memory of 6080	2896	Unicorn-10698.exe	92
PID 2896 wrote to memory of 6080	2896	Unicorn-10698.exe	92
PID 2896 wrote to memory of 6080	2896	Unicorn-10698.exe	92
PID 5744 wrote to memory of 5168	5744	b338e9b54119c6a2208b6c51b7b50a38837051435df4872224e3976a1ba93d17N.exe	93
PID 5744 wrote to memory of 5168	5744	b338e9b54119c6a2208b6c51b7b50a38837051435df4872224e3976a1ba93d17N.exe	93
PID 5744 wrote to memory of 5168	5744	b338e9b54119c6a2208b6c51b7b50a38837051435df4872224e3976a1ba93d17N.exe	93
PID 6080 wrote to memory of 3840	6080	Unicorn-9759.exe	96
PID 6080 wrote to memory of 3840	6080	Unicorn-9759.exe	96
PID 6080 wrote to memory of 3840	6080	Unicorn-9759.exe	96
PID 2896 wrote to memory of 3076	2896	Unicorn-10698.exe	97
PID 2896 wrote to memory of 3076	2896	Unicorn-10698.exe	97
PID 2896 wrote to memory of 3076	2896	Unicorn-10698.exe	97
PID 5744 wrote to memory of 1676	5744	b338e9b54119c6a2208b6c51b7b50a38837051435df4872224e3976a1ba93d17N.exe	98
PID 5744 wrote to memory of 1676	5744	b338e9b54119c6a2208b6c51b7b50a38837051435df4872224e3976a1ba93d17N.exe	98
PID 5744 wrote to memory of 1676	5744	b338e9b54119c6a2208b6c51b7b50a38837051435df4872224e3976a1ba93d17N.exe	98
PID 5168 wrote to memory of 1368	5168	Unicorn-46194.exe	99
PID 5168 wrote to memory of 1368	5168	Unicorn-46194.exe	99
PID 5168 wrote to memory of 1368	5168	Unicorn-46194.exe	99
PID 1676 wrote to memory of 1880	1676	Unicorn-7085.exe	104
PID 1676 wrote to memory of 1880	1676	Unicorn-7085.exe	104
PID 1676 wrote to memory of 1880	1676	Unicorn-7085.exe	104
PID 3076 wrote to memory of 3980	3076	Unicorn-12893.exe	105
PID 3076 wrote to memory of 3980	3076	Unicorn-12893.exe	105
PID 3076 wrote to memory of 3980	3076	Unicorn-12893.exe	105
PID 1368 wrote to memory of 5156	1368	Unicorn-13215.exe	106
PID 1368 wrote to memory of 5156	1368	Unicorn-13215.exe	106
PID 1368 wrote to memory of 5156	1368	Unicorn-13215.exe	106
PID 5744 wrote to memory of 2104	5744	b338e9b54119c6a2208b6c51b7b50a38837051435df4872224e3976a1ba93d17N.exe	107
PID 5744 wrote to memory of 2104	5744	b338e9b54119c6a2208b6c51b7b50a38837051435df4872224e3976a1ba93d17N.exe	107
PID 5744 wrote to memory of 2104	5744	b338e9b54119c6a2208b6c51b7b50a38837051435df4872224e3976a1ba93d17N.exe	107
PID 3840 wrote to memory of 3436	3840	Unicorn-33828.exe	108
PID 3840 wrote to memory of 3436	3840	Unicorn-33828.exe	108
PID 3840 wrote to memory of 3436	3840	Unicorn-33828.exe	108
PID 2896 wrote to memory of 3120	2896	Unicorn-10698.exe	109
PID 2896 wrote to memory of 3120	2896	Unicorn-10698.exe	109
PID 2896 wrote to memory of 3120	2896	Unicorn-10698.exe	109
PID 6080 wrote to memory of 3472	6080	Unicorn-9759.exe	110
PID 6080 wrote to memory of 3472	6080	Unicorn-9759.exe	110
PID 6080 wrote to memory of 3472	6080	Unicorn-9759.exe	110
PID 5168 wrote to memory of 5848	5168	Unicorn-46194.exe	111
PID 5168 wrote to memory of 5848	5168	Unicorn-46194.exe	111
PID 5168 wrote to memory of 5848	5168	Unicorn-46194.exe	111
PID 1880 wrote to memory of 4848	1880	Unicorn-4191.exe	112
PID 1880 wrote to memory of 4848	1880	Unicorn-4191.exe	112
PID 1880 wrote to memory of 4848	1880	Unicorn-4191.exe	112
PID 1676 wrote to memory of 4940	1676	Unicorn-7085.exe	113
PID 1676 wrote to memory of 4940	1676	Unicorn-7085.exe	113
PID 1676 wrote to memory of 4940	1676	Unicorn-7085.exe	113
PID 3980 wrote to memory of 3176	3980	Unicorn-4191.exe	114
PID 3980 wrote to memory of 3176	3980	Unicorn-4191.exe	114
PID 3980 wrote to memory of 3176	3980	Unicorn-4191.exe	114
PID 3436 wrote to memory of 5572	3436	Unicorn-23543.exe	115
PID 3436 wrote to memory of 5572	3436	Unicorn-23543.exe	115
PID 3436 wrote to memory of 5572	3436	Unicorn-23543.exe	115
PID 3472 wrote to memory of 1968	3472	Unicorn-3677.exe	116
PID 3472 wrote to memory of 1968	3472	Unicorn-3677.exe	116
PID 3472 wrote to memory of 1968	3472	Unicorn-3677.exe	116
PID 5156 wrote to memory of 320	5156	Unicorn-23543.exe	117
PID 5156 wrote to memory of 320	5156	Unicorn-23543.exe	117
PID 5156 wrote to memory of 320	5156	Unicorn-23543.exe	117
PID 5848 wrote to memory of 4316	5848	Unicorn-7761.exe	118

C:\Users\Admin\AppData\Local\Temp\b338e9b54119c6a2208b6c51b7b50a38837051435df4872224e3976a1ba93d17N.exe
"C:\Users\Admin\AppData\Local\Temp\b338e9b54119c6a2208b6c51b7b50a38837051435df4872224e3976a1ba93d17N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5744
- C:\Users\Admin\AppData\Local\Temp\Unicorn-10698.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-10698.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2896
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9759.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9759.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:6080
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33828.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23543.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:3436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4881.exe
        7⤵
        
        PID:3484
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51851.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45907.exe
        9⤵
        
        PID:9044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        9⤵
        
        PID:8064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17822.exe
        9⤵
        
        PID:3168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26041.exe
        8⤵
        
        PID:9000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49554.exe
        8⤵
        
        PID:12076
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1181.exe
        8⤵
        
        PID:6392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39917.exe
        7⤵
        
        PID:6760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22519.exe
        8⤵
        
        PID:13544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
        8⤵
        
        PID:432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63614.exe
        7⤵
        
        PID:9892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19933.exe
        7⤵
        
        PID:14780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38284.exe
        7⤵
        
        PID:19036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7621.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36335.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36335.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34091.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34091.exe
        8⤵
        
        PID:7652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2098.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14950.exe
        9⤵
        
        PID:7728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1397.exe
        8⤵
        
        PID:11188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62569.exe
        8⤵
        
        PID:15844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5578.exe
        8⤵
        
        PID:17832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51558.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51558.exe
        7⤵
        
        PID:3708
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23108.exe
        7⤵
        
        PID:10128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15917.exe
        7⤵
        
        PID:16328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37937.exe
        7⤵
        
        PID:1276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9265.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9265.exe
        6⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45907.exe
        7⤵
        
        PID:9124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55783.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55783.exe
        8⤵
        
        PID:5364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30467.exe
        7⤵
        
        PID:17192
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33691.exe
        6⤵
        
        PID:8388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33432.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12264
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22331.exe
        6⤵
        
        PID:17120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28129.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55307.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43460.exe
        7⤵
        
        PID:4048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-346.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-346.exe
        8⤵
        
        PID:2816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51667.exe
        9⤵
        
        PID:7176
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23588.exe
        10⤵
        
        PID:13444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23494.exe
        10⤵
        System Location Discovery: System Language Discovery
        
        PID:15640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62902.exe
        9⤵
        
        PID:9440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14298.exe
        9⤵
        
        PID:15376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41838.exe
        9⤵
        
        PID:18644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12341.exe
        8⤵
        
        PID:7944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
        9⤵
        
        PID:14440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14950.exe
        9⤵
        
        PID:7648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11013.exe
        8⤵
        
        PID:11088
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38314.exe
        8⤵
        
        PID:16668
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28394.exe
        7⤵
        
        PID:6216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1859.exe
        8⤵
        
        PID:9064
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19504.exe
        8⤵
        
        PID:16312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5266.exe
        8⤵
        
        PID:18152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40270.exe
        7⤵
        
        PID:8280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42098.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45914.exe
        7⤵
        
        PID:17808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32037.exe
        6⤵
        
        PID:1656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16499.exe
        7⤵
        
        PID:6344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27947.exe
        8⤵
        
        PID:9808
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40369.exe
        8⤵
        
        PID:14168
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52990.exe
        8⤵
        
        PID:7092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19409.exe
        7⤵
        
        PID:9324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24748.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22291.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22291.exe
        7⤵
        
        PID:5804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12672.exe
        6⤵
        
        PID:7204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58206.exe
        7⤵
        
        PID:14884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7881.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7881.exe
        7⤵
        
        PID:17900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16965.exe
        6⤵
        
        PID:9408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22872.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22872.exe
        6⤵
        
        PID:14548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21807.exe
        6⤵
        
        PID:18764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16312.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21151.exe
        6⤵
        
        PID:1372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
        7⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32445.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32445.exe
        7⤵
        
        PID:10832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59239.exe
        7⤵
        
        PID:16564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15377.exe
        6⤵
        
        PID:7860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18472.exe
        7⤵
        
        PID:10548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13893.exe
        6⤵
        
        PID:13640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5273.exe
        6⤵
        
        PID:17664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13485.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13485.exe
        5⤵
        
        PID:6532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37739.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:8948
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63183.exe
        7⤵
        
        PID:5664
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35695.exe
        6⤵
        
        PID:1848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25793.exe
        5⤵
        
        PID:8856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30218.exe
        5⤵
        
        PID:12240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19199.exe
        5⤵
        
        PID:16980
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3677.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3677.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39360.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39360.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1968
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64544.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43460.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43460.exe
        7⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26963.exe
        8⤵
        
        PID:6748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        9⤵
        
        PID:7188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49254.exe
        9⤵
        
        PID:11144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62569.exe
        9⤵
        
        PID:15896
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13938.exe
        9⤵
        
        PID:17472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49394.exe
        8⤵
        
        PID:7588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe
        9⤵
        
        PID:17720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5340.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5340.exe
        8⤵
        
        PID:11752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        8⤵
        
        PID:5936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38433.exe
        7⤵
        
        PID:6792
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25259.exe
        8⤵
        
        PID:1796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58907.exe
        8⤵
        
        PID:1468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6742.exe
        7⤵
        
        PID:9848
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28300.exe
        7⤵
        
        PID:14744
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5266.exe
        7⤵
        
        PID:16776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47990.exe
        6⤵
        
        PID:5696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35515.exe
        7⤵
        
        PID:7016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34283.exe
        8⤵
        
        PID:7380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28833.exe
        8⤵
        
        PID:11092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62569.exe
        8⤵
        
        PID:15860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30467.exe
        8⤵
        
        PID:16784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16721.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16721.exe
        7⤵
        
        PID:7312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59886.exe
        7⤵
        
        PID:11680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42022.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7080
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35833.exe
        6⤵
        
        PID:7024
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39467.exe
        7⤵
        
        PID:9188
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35242.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35242.exe
        7⤵
        
        PID:11928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40554.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40554.exe
        7⤵
        
        PID:19088
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64438.exe
        6⤵
        
        PID:9856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51305.exe
        6⤵
        
        PID:14128
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6218.exe
        6⤵
        
        PID:17056
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32701.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1934.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1934.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5036
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35323.exe
        7⤵
        
        PID:6876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63831.exe
        8⤵
        
        PID:7724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17733.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17733.exe
        8⤵
        
        PID:11208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22496.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22496.exe
        8⤵
        
        PID:16244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34167.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34167.exe
        8⤵
        
        PID:18568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47339.exe
        7⤵
        
        PID:8200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35539.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35539.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20178.exe
        8⤵
        
        PID:16532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
        7⤵
        
        PID:12004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2062.exe
        7⤵
        
        PID:16580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51563.exe
        6⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53188.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3021.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:2092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62849.exe
        6⤵
        
        PID:9768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59970.exe
        6⤵
        
        PID:14152
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29769.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29769.exe
        6⤵
        
        PID:6632
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62109.exe
        5⤵
        
        PID:5424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48595.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48595.exe
        6⤵
        
        PID:6940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59799.exe
        7⤵
        
        PID:10596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24601.exe
        8⤵
        
        PID:17480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58782.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58782.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31801.exe
        7⤵
        
        PID:1632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19025.exe
        6⤵
        
        PID:2936
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3333.exe
        6⤵
        
        PID:14356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21801.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:7320
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9601.exe
        5⤵
        
        PID:912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23863.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23863.exe
        6⤵
        
        PID:9792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48205.exe
        6⤵
        
        PID:15188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41254.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41254.exe
        6⤵
        
        PID:1456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40013.exe
        5⤵
        
        PID:10120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27141.exe
        5⤵
        
        PID:12168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22331.exe
        5⤵
        
        PID:7284
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1901.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1901.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:4876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53636.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53636.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35375.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6040
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5315.exe
        7⤵
        
        PID:652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37163.exe
        8⤵
        
        PID:8320
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60147.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:16148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27010.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27010.exe
        9⤵
        
        PID:17736
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21781.exe
        8⤵
        
        PID:15208
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15208 -s 472
        9⤵
        Program crash
        
        PID:1232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        8⤵
        
        PID:5292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15517.exe
        7⤵
        
        PID:8944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28832.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28832.exe
        7⤵
        
        PID:10904
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63323.exe
        7⤵
        
        PID:16696
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27717.exe
        6⤵
        
        PID:7152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39867.exe
        7⤵
        
        PID:11216
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20701.exe
        7⤵
        
        PID:16708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2348.exe
        6⤵
        
        PID:10848
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22515.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22515.exe
        6⤵
        
        PID:4872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59339.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59339.exe
        5⤵
        
        PID:4340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43499.exe
        6⤵
        
        PID:7132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61055.exe
        7⤵
        
        PID:11660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16433.exe
        7⤵
        
        PID:17776
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62902.exe
        6⤵
        
        PID:9852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50178.exe
        6⤵
        
        PID:5528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53307.exe
        6⤵
        
        PID:14020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13824.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13824.exe
        5⤵
        
        PID:7904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43131.exe
        6⤵
        
        PID:11916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27578.exe
        6⤵
        
        PID:1548
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2348.exe
        5⤵
        
        PID:10880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-751.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-27222.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45572.exe
        5⤵
        
        PID:1716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7427.exe
        6⤵
        
        PID:7288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20215.exe
        7⤵
        
        PID:11600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20074.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53295.exe
        7⤵
        
        PID:18268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6602.exe
        6⤵
        
        PID:8908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25672.exe
        6⤵
        
        PID:14576
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59290.exe
        6⤵
        
        PID:18180
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47090.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47090.exe
        5⤵
        
        PID:7236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60147.exe
        6⤵
        
        PID:16112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23118.exe
        6⤵
        
        PID:7316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46653.exe
        5⤵
        
        PID:11120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2897.exe
        5⤵
        
        PID:15852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21801.exe
        5⤵
        
        PID:17440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17949.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17949.exe
      4⤵
      PID:1512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63748.exe
        5⤵
        
        PID:7640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19432.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19432.exe
        6⤵
        
        PID:16936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17400.exe
        5⤵
        
        PID:11072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        5⤵
        
        PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7722.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7722.exe
      4⤵
      PID:4664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30724.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30724.exe
        5⤵
        
        PID:16804
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15322.exe
      4⤵
      PID:11768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17030.exe
      4⤵
      PID:16484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-12893.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-12893.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3076
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27108.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2214.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33984.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33984.exe
        7⤵
        
        PID:3632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5315.exe
        8⤵
        
        PID:5072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
        9⤵
        
        PID:9012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14329.exe
        9⤵
        
        PID:10952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7629.exe
        9⤵
        
        PID:15640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18022.exe
        9⤵
        
        PID:17552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
        8⤵
        
        PID:9468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41513.exe
        8⤵
        
        PID:14452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-982.exe
        8⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31801.exe
        7⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30879.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30879.exe
        8⤵
        
        PID:13428
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3074.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3074.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:4436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19269.exe
        7⤵
        
        PID:10740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5825.exe
        7⤵
        
        PID:15204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21807.exe
        7⤵
        
        PID:18652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26225.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26225.exe
        6⤵
        
        PID:4156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23263.exe
        7⤵
        
        PID:6652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60634.exe
        8⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48978.exe
        8⤵
        
        PID:11244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30467.exe
        8⤵
        
        PID:17424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27110.exe
        7⤵
        
        PID:8928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58041.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58041.exe
        7⤵
        
        PID:13132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49222.exe
        7⤵
        
        PID:5904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39917.exe
        6⤵
        
        PID:6720
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48512.exe
        7⤵
        
        PID:9316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29756.exe
        7⤵
        
        PID:14532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30467.exe
        7⤵
        
        PID:7564
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63614.exe
        6⤵
        
        PID:9824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11765.exe
        6⤵
        
        PID:14736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59080.exe
        6⤵
        
        PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39525.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21587.exe
        6⤵
        
        PID:5264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60019.exe
        7⤵
        
        PID:6672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-214.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-214.exe
        8⤵
        
        PID:8532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe
        9⤵
        
        PID:17700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10245.exe
        8⤵
        
        PID:11256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59047.exe
        8⤵
        
        PID:17200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21624.exe
        7⤵
        
        PID:9908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47334.exe
        7⤵
        
        PID:13412
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39282.exe
        7⤵
        
        PID:16500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42221.exe
        6⤵
        
        PID:7540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3743.exe
        7⤵
        
        PID:13116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24262.exe
        7⤵
        
        PID:16472
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34262.exe
        6⤵
        
        PID:9988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3604.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3604.exe
        6⤵
        
        PID:14864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41822.exe
        6⤵
        
        PID:4516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46157.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1620
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51851.exe
        6⤵
        
        PID:6992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1283.exe
        7⤵
        
        PID:8524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58206.exe
        8⤵
        
        PID:14876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21110.exe
        8⤵
        
        PID:4540
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        7⤵
        
        PID:14256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13938.exe
        7⤵
        
        PID:17632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14749.exe
        6⤵
        
        PID:8296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41705.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41705.exe
        6⤵
        
        PID:14948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1366.exe
        6⤵
        
        PID:16912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62118.exe
        5⤵
        
        PID:6820
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2710.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:12228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35886.exe
        6⤵
        
        PID:2020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47078.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47078.exe
        5⤵
        
        PID:9828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36999.exe
        5⤵
        
        PID:14764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-801.exe
        5⤵
        
        PID:16660
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28129.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28129.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5073.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5073.exe
        5⤵
        
        PID:5464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54207.exe
        6⤵
        
        PID:4508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41247.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41247.exe
        7⤵
        
        PID:8268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        7⤵
        
        PID:5812
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17830.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17830.exe
        7⤵
        
        PID:19132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13130.exe
        6⤵
        
        PID:7116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24164.exe
        7⤵
        
        PID:13368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35170.exe
        7⤵
        
        PID:6868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2024.exe
        6⤵
        
        PID:11984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63323.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63323.exe
        6⤵
        
        PID:16412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32508.exe
        5⤵
        
        PID:6348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24719.exe
        6⤵
        
        PID:8544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22519.exe
        7⤵
        
        PID:13552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46655.exe
        7⤵
        
        PID:5492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14329.exe
        6⤵
        
        PID:11104
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13938.exe
        6⤵
        
        PID:17536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9269.exe
        5⤵
        
        PID:8640
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21180.exe
        5⤵
        
        PID:12188
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53831.exe
        5⤵
        
        PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54804.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54804.exe
        5⤵
        
        PID:7100
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4060.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7673.exe
        5⤵
        
        PID:6572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1283.exe
        6⤵
        
        PID:8508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        6⤵
        
        PID:14228
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13738.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13738.exe
        6⤵
        
        PID:4228
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28593.exe
        5⤵
        
        PID:8844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55419.exe
        5⤵
        
        PID:12204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25302.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25302.exe
        5⤵
        
        PID:18672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4549.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4549.exe
      4⤵
      PID:6172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:9056
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2506.exe
        6⤵
        
        PID:17620
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38435.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6640
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24065.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24065.exe
      4⤵
      PID:8288
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16897.exe
      4⤵
      PID:11032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49809.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49809.exe
      4⤵
      PID:17584
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17412.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17412.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52079.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52079.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:6024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13667.exe
        6⤵
        
        PID:5688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        7⤵
        
        PID:7392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57836.exe
        8⤵
        
        PID:18608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1397.exe
        7⤵
        
        PID:11196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62569.exe
        7⤵
        
        PID:15888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26759.exe
        7⤵
        
        PID:2164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15377.exe
        6⤵
        
        PID:7764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1640.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1640.exe
        6⤵
        
        PID:11640
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39675.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39675.exe
        6⤵
        
        PID:14924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14585.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14585.exe
        6⤵
        
        PID:17004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59422.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59422.exe
        5⤵
        
        PID:6540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54075.exe
        6⤵
        
        PID:9108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        6⤵
        
        PID:14224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50503.exe
        6⤵
        
        PID:18656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7104.exe
        5⤵
        
        PID:8876
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60205.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49999.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49999.exe
        5⤵
        
        PID:17868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15456.exe
      4⤵
      PID:4920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49856.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49856.exe
        5⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
        6⤵
        
        PID:8988
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        6⤵
        
        PID:13328
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13938.exe
        6⤵
        
        PID:17604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28885.exe
        5⤵
        
        PID:9568
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57037.exe
        5⤵
        
        PID:13868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38435.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6600
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8314.exe
      4⤵
      PID:7460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58206.exe
        5⤵
        
        PID:14892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65250.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65250.exe
        5⤵
        
        PID:17844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24444.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24444.exe
      4⤵
      PID:9424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65050.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65050.exe
      4⤵
      PID:14712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58888.exe
      4⤵
      PID:16176
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64066.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64066.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5420
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22717.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22717.exe
      4⤵
      PID:6124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14902.exe
        5⤵
        
        PID:6796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2710.exe
        6⤵
        
        PID:8964
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        6⤵
        
        PID:12216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31801.exe
        6⤵
        
        PID:14948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38293.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38293.exe
        5⤵
        
        PID:9140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2778.exe
        6⤵
        
        PID:16136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22734.exe
        6⤵
        
        PID:18740
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28064.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28064.exe
        5⤵
        
        PID:12196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13494.exe
        5⤵
        
        PID:14916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-997.exe
        5⤵
        
        PID:18636
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31556.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31556.exe
      4⤵
      PID:6956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3743.exe
        5⤵
        
        PID:13152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61019.exe
        5⤵
        
        PID:16736
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4246.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4246.exe
      4⤵
      PID:9744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17480.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17480.exe
      4⤵
      PID:13720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59503.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59503.exe
      4⤵
      PID:16864
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-10772.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-10772.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44887.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44887.exe
      4⤵
      PID:5396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9778.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9778.exe
        5⤵
        
        PID:4944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32917.exe
        5⤵
        
        PID:11112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62569.exe
        5⤵
        
        PID:15880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63131.exe
        5⤵
        
        PID:4572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56218.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56218.exe
      4⤵
      PID:7748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55959.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:12124
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23110.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23110.exe
        5⤵
        
        PID:16516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55973.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55973.exe
      4⤵
      PID:11248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29239.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29239.exe
      4⤵
      PID:16272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21801.exe
      4⤵
      PID:17180
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28549.exe
    3⤵
    PID:6180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54075.exe
      4⤵
      PID:9116
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14329.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14329.exe
      4⤵
      PID:3608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13746.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13746.exe
      4⤵
      PID:18768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24595.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24595.exe
    3⤵
    PID:6812
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43760.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43760.exe
    3⤵
    PID:11992
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-40574.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-40574.exe
    3⤵
    PID:16840
- C:\Users\Admin\AppData\Local\Temp\Unicorn-46194.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-46194.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:5168
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-13215.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-13215.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1368
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23543.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23543.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:5156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61316.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46983.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46983.exe
        6⤵
        
        PID:2452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51851.exe
        7⤵
        
        PID:7000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
        8⤵
        
        PID:8976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14329.exe
        8⤵
        
        PID:4604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7629.exe
        8⤵
        
        PID:2804
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9662.exe
        8⤵
        
        PID:19016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14749.exe
        7⤵
        
        PID:2872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22564.exe
        8⤵
        
        PID:17752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36233.exe
        7⤵
        
        PID:10760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13494.exe
        7⤵
        
        PID:15288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52222.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:18216
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39917.exe
        6⤵
        
        PID:6728
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64371.exe
        7⤵
        
        PID:10108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3021.exe
        7⤵
        
        PID:1616
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63614.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63614.exe
        6⤵
        
        PID:9884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18690.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18690.exe
        6⤵
        
        PID:15584
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 15584 -s 464
        7⤵
        Program crash
        
        PID:15796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-801.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:16928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23626.exe
        5⤵
        
        PID:3756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38455.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38455.exe
        6⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25088.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25088.exe
        7⤵
        
        PID:13472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2506.exe
        7⤵
        
        PID:17656
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50567.exe
        6⤵
        
        PID:10136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46477.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46477.exe
        6⤵
        
        PID:3612
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26183.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26183.exe
        6⤵
        
        PID:6300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45150.exe
        5⤵
        
        PID:7844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2098.exe
        6⤵
        
        PID:13488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59875.exe
        6⤵
        
        PID:17516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48230.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10808
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9754.exe
        5⤵
        
        PID:14504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53786.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53786.exe
        5⤵
        
        PID:16996
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8586.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8586.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52567.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1916
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22355.exe
        6⤵
        
        PID:1236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6145.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6145.exe
        7⤵
        
        PID:6528
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58206.exe
        8⤵
        
        PID:15272
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3797.exe
        8⤵
        
        PID:17980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-109.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-109.exe
        7⤵
        
        PID:10192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52342.exe
        7⤵
        
        PID:14460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23730.exe
        7⤵
        
        PID:7480
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22097.exe
        6⤵
        
        PID:7048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48704.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48704.exe
        7⤵
        
        PID:8956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14630.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13301.exe
        7⤵
        
        PID:16920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5097.exe
        6⤵
        
        PID:10444
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57657.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57657.exe
        6⤵
        
        PID:15220
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46312.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46312.exe
        6⤵
        
        PID:8172
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32037.exe
        5⤵
        
        PID:3652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49472.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49472.exe
        6⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45907.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45907.exe
        7⤵
        
        PID:8248
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        7⤵
        
        PID:14232
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49394.exe
        7⤵
        
        PID:5132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7318.exe
        6⤵
        
        PID:10556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4180.exe
        6⤵
        
        PID:14140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41822.exe
        6⤵
        
        PID:1956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3736.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3736.exe
        5⤵
        
        PID:5604
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
        6⤵
        
        PID:14424
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36050.exe
        6⤵
        
        PID:1596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48678.exe
        5⤵
        
        PID:10112
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43677.exe
        5⤵
        
        PID:14380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45906.exe
        5⤵
        
        PID:6192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21356.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21356.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36719.exe
        5⤵
        
        PID:1532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46239.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
        7⤵
        
        PID:9020
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14329.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14329.exe
        7⤵
        
        PID:10660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5578.exe
        7⤵
        
        PID:17796
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28885.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28885.exe
        6⤵
        
        PID:9580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16388.exe
        6⤵
        
        PID:13456
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34543.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34543.exe
        6⤵
        
        PID:16788
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54251.exe
        5⤵
        
        PID:7468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64371.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20893.exe
        6⤵
        
        PID:16236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27244.exe
        5⤵
        
        PID:9472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38773.exe
        5⤵
        
        PID:15552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53831.exe
        5⤵
        
        PID:3240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22331.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22331.exe
        5⤵
        
        PID:6604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37030.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37030.exe
      4⤵
      PID:4984
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1418.exe
        5⤵
        
        PID:888
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56691.exe
        6⤵
        
        PID:14364
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55599.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55599.exe
        6⤵
        
        PID:17052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20665.exe
        5⤵
        
        PID:9704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1692.exe
        5⤵
        
        PID:15140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe
        5⤵
        
        PID:16336
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26312.exe
      4⤵
      PID:7884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17512.exe
        5⤵
        
        PID:1792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47841.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47841.exe
      4⤵
      PID:11620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31540.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31540.exe
      4⤵
      PID:16344
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33657.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33657.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:16548
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7761.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7761.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:5848
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47995.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47995.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32147.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5296
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51711.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51711.exe
        6⤵
        
        PID:4452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10463.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10463.exe
        7⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-467.exe
        8⤵
        
        PID:17820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1397.exe
        7⤵
        
        PID:11236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23373.exe
        7⤵
        
        PID:16284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61838.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61838.exe
        7⤵
        
        PID:8240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56218.exe
        6⤵
        
        PID:7756
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22519.exe
        7⤵
        
        PID:13536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35170.exe
        7⤵
        
        PID:6196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39637.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39637.exe
        6⤵
        
        PID:11224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29239.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29239.exe
        6⤵
        
        PID:16376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21801.exe
        6⤵
        
        PID:17432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34149.exe
        5⤵
        
        PID:1528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1283.exe
        6⤵
        
        PID:8516
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        6⤵
        
        PID:14200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46603.exe
        6⤵
        
        PID:1516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14697.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14697.exe
        5⤵
        
        PID:9156
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21948.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21948.exe
        5⤵
        
        PID:13420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63587.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63587.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15456.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15456.exe
      4⤵
      PID:4900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10037.exe
        5⤵
        
        PID:6960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23204.exe
        6⤵
        
        PID:13932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24070.exe
        6⤵
        
        PID:17152
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23544.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23544.exe
        5⤵
        
        PID:8904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41513.exe
        5⤵
        
        PID:14404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53831.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53831.exe
        5⤵
        
        PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65534.exe
        5⤵
        
        PID:5196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45782.exe
      4⤵
      PID:6696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7194.exe
        5⤵
        
        PID:10796
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26789.exe
        5⤵
        
        PID:16016
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20893.exe
        5⤵
        
        PID:15672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39821.exe
      4⤵
      PID:9604
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42854.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42854.exe
      4⤵
      PID:13812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35728.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35728.exe
      4⤵
      PID:16460
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22321.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22321.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3052
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22635.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22635.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1550.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4384
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36911.exe
        6⤵
        
        PID:5760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18995.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18995.exe
        7⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22047.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22047.exe
        8⤵
        
        PID:15312
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52222.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:3144
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50650.exe
        7⤵
        
        PID:8920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50178.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50178.exe
        7⤵
        
        PID:14776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13433.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:5308
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42465.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42465.exe
        6⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55383.exe
        7⤵
        
        PID:13372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22150.exe
        7⤵
        
        PID:1508
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11013.exe
        6⤵
        
        PID:10716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50375.exe
        6⤵
        
        PID:16652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38425.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38425.exe
        5⤵
        
        PID:4672
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
        6⤵
        
        PID:7824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56950.exe
        6⤵
        
        PID:10920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12970.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12970.exe
        6⤵
        
        PID:2928
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26865.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26865.exe
        5⤵
        
        PID:8216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7889.exe
        5⤵
        
        PID:12028
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18093.exe
        5⤵
        
        PID:15208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47990.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47990.exe
      4⤵
      PID:5452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27141.exe
        5⤵
        
        PID:7060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35300.exe
        6⤵
        
        PID:8400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        6⤵
        
        PID:11232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44054.exe
        6⤵
        
        PID:1220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58573.exe
        5⤵
        
        PID:9864
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45405.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45405.exe
        5⤵
        
        PID:15196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18623.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18623.exe
        5⤵
        
        PID:3616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11905.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11905.exe
      4⤵
      PID:7816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
        5⤵
        
        PID:14392
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34986.exe
        5⤵
        
        PID:18576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43277.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43277.exe
      4⤵
      PID:10788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
      4⤵
      PID:14500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36589.exe
      4⤵
      PID:2756
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31882.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31882.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2894.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2894.exe
      4⤵
      PID:1696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48644.exe
        5⤵
        
        PID:3512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
        6⤵
        
        PID:9028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26935.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26935.exe
        6⤵
        
        PID:14800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5266.exe
        6⤵
        
        PID:7524
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40213.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40213.exe
        5⤵
        
        PID:8924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39741.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39741.exe
        5⤵
        
        PID:11948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37667.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37667.exe
        5⤵
        
        PID:4904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26181.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26181.exe
      4⤵
      PID:6704
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1859.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1859.exe
        5⤵
        
        PID:9080
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63005.exe
        5⤵
        
        PID:14468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42519.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42519.exe
        5⤵
        
        PID:1272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-381.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-381.exe
      4⤵
      PID:10944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58610.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58610.exe
      4⤵
      PID:15632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1527.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1527.exe
      4⤵
      PID:18724
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27788.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27788.exe
    3⤵
    PID:5720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31247.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31247.exe
      4⤵
      PID:372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58206.exe
        5⤵
        
        PID:14856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24217.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24217.exe
        5⤵
        
        PID:17948
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6602.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6602.exe
      4⤵
      PID:8872
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50178.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50178.exe
      4⤵
      PID:15120
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50190.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50190.exe
      4⤵
      PID:7008
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15978.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15978.exe
    3⤵
    PID:7924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57028.exe
      4⤵
      PID:11940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59675.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59675.exe
      4⤵
      PID:11544
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-32432.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-32432.exe
    3⤵
    PID:10856
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-57652.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-57652.exe
    3⤵
    PID:5048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52826.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52826.exe
    3⤵
    PID:3440
- C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:1880
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60164.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60164.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51332.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5512
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57419.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16875.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16875.exe
        7⤵
        
        PID:6044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25937.exe
        8⤵
        
        PID:8056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34701.exe
        8⤵
        
        PID:10892
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14490.exe
        8⤵
        
        PID:15028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49222.exe
        8⤵
        
        PID:3212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34297.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34297.exe
        7⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58206.exe
        8⤵
        
        PID:15252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3797.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3797.exe
        8⤵
        
        PID:17908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11013.exe
        7⤵
        
        PID:10996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32886.exe
        7⤵
        
        PID:3248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30404.exe
        6⤵
        
        PID:6520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31891.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31891.exe
        7⤵
        
        PID:10676
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7629.exe
        7⤵
        
        PID:3136
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47371.exe
        7⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48486.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48486.exe
        6⤵
        
        PID:9636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59390.exe
        6⤵
        
        PID:13836
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34038.exe
        6⤵
        
        PID:16956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-605.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-605.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2792
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5900.exe
        6⤵
        
        PID:6500
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2710.exe
        7⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15097.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7105.exe
        7⤵
        
        PID:5692
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57723.exe
        6⤵
        
        PID:9532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13588.exe
        6⤵
        
        PID:13772
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49222.exe
        6⤵
        
        PID:4652
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59369.exe
        5⤵
        
        PID:5064
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54703.exe
        6⤵
        
        PID:7056
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
        7⤵
        
        PID:14448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30902.exe
        7⤵
        
        PID:18908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58241.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58241.exe
        6⤵
        
        PID:11432
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4305.exe
        6⤵
        
        PID:14388
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64910.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64910.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10900.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10900.exe
        5⤵
        
        PID:11720
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27878.exe
        5⤵
        
        PID:14708
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14163.exe
        5⤵
        
        PID:17676
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34481.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34481.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61503.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5268
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48779.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48779.exe
        6⤵
        
        PID:3468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16499.exe
        7⤵
        
        PID:6240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35300.exe
        8⤵
        
        PID:8420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:12236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3021.exe
        8⤵
        
        PID:4608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23352.exe
        7⤵
        
        PID:9480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31538.exe
        7⤵
        
        PID:14516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21801.exe
        7⤵
        
        PID:17016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23249.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23249.exe
        6⤵
        
        PID:7332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43899.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43899.exe
        7⤵
        
        PID:14080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27578.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27578.exe
        7⤵
        
        PID:16596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11100.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11100.exe
        6⤵
        
        PID:9336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41513.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41513.exe
        6⤵
        
        PID:4240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24718.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24718.exe
        6⤵
        
        PID:3964
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46018.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46018.exe
        5⤵
        
        PID:3952
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13685.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13685.exe
        6⤵
        
        PID:8144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26424.exe
        6⤵
        
        PID:11016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2897.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2897.exe
        6⤵
        
        PID:15904
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37753.exe
        6⤵
        
        PID:19104
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1572.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1572.exe
        5⤵
        
        PID:7876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58206.exe
        6⤵
        
        PID:15244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44638.exe
        6⤵
        
        PID:18888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40567.exe
        5⤵
        
        PID:10884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5825.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5825.exe
        5⤵
        
        PID:15000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59503.exe
        5⤵
        
        PID:16756
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14340.exe
      4⤵
      Executes dropped EXE
      PID:3588
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44311.exe
        5⤵
        
        PID:5388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36727.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36727.exe
        6⤵
        
        PID:6440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57775.exe
        7⤵
        
        PID:8340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22497.exe
        7⤵
        
        PID:10704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46419.exe
        7⤵
        
        PID:19028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15517.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15517.exe
        6⤵
        
        PID:8824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24748.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24748.exe
        6⤵
        
        PID:13120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48138.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48138.exe
        6⤵
        
        PID:18208
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32761.exe
        5⤵
        
        PID:7440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34963.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34963.exe
        6⤵
        
        PID:13356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24262.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24262.exe
        6⤵
        
        PID:16432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27244.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27244.exe
        5⤵
        
        PID:9444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24714.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:14696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36646.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36646.exe
      4⤵
      PID:3340
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31268.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31268.exe
        5⤵
        
        PID:7148
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20665.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20665.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62569.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62569.exe
        5⤵
        
        PID:15872
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50687.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50687.exe
        5⤵
        
        PID:6836
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26312.exe
      4⤵
      PID:7920
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5758.exe
      4⤵
      PID:13648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1753.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1753.exe
      4⤵
      PID:17080
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43313.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43313.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51332.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-51332.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61503.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61503.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7673.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7673.exe
        6⤵
        
        PID:6564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1283.exe
        7⤵
        
        PID:8496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        7⤵
        
        PID:14240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17822.exe
        7⤵
        
        PID:1144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7104.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7104.exe
        6⤵
        
        PID:8864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33930.exe
        6⤵
        
        PID:12180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21218.exe
        6⤵
        
        PID:18700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46402.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46402.exe
        5⤵
        
        PID:6164
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32036.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32036.exe
        6⤵
        
        PID:7796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
        7⤵
        
        PID:14432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2506.exe
        7⤵
        
        PID:17764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-458.exe
        6⤵
        
        PID:10624
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34735.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34735.exe
        6⤵
        
        PID:6508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47753.exe
        5⤵
        
        PID:8208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35731.exe
        6⤵
        
        PID:14188
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19986.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19986.exe
        6⤵
        
        PID:17136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7889.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7889.exe
        5⤵
        
        PID:12040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50766.exe
        5⤵
        
        PID:1800
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13926.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25235.exe
        5⤵
        
        PID:1132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34283.exe
        6⤵
        
        PID:7280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
        7⤵
        
        PID:14416
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47615.exe
        7⤵
        
        PID:3312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14193.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14193.exe
        6⤵
        
        PID:11168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-221.exe
        6⤵
        
        PID:3044
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15377.exe
        5⤵
        
        PID:7976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55959.exe
        6⤵
        
        PID:13172
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6774.exe
        6⤵
        
        PID:16816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37821.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37821.exe
        5⤵
        
        PID:11064
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57590.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57590.exe
        5⤵
        
        PID:5824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49997.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49997.exe
      4⤵
      PID:6608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54075.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54075.exe
        5⤵
        
        PID:9100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
        5⤵
        
        PID:14328
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20997.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25222.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25222.exe
      4⤵
      PID:8888
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25264.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25264.exe
      4⤵
      PID:12084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53831.exe
      4⤵
      PID:3084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58888.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58888.exe
      4⤵
      PID:16148
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48217.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48217.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4712
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32448.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32448.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57632.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57632.exe
        5⤵
        
        PID:6132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43499.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43499.exe
        6⤵
        
        PID:7112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19447.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19447.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44054.exe
        7⤵
        
        PID:4028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62902.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62902.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9596
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14298.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14298.exe
        6⤵
        
        PID:15368
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49222.exe
        6⤵
        
        PID:1204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-89.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-89.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15851.exe
        6⤵
        
        PID:14408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63767.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63767.exe
        6⤵
        
        PID:18748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54053.exe
        5⤵
        
        PID:10912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26743.exe
        5⤵
        
        PID:13892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21801.exe
        5⤵
        
        PID:16764
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28202.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28202.exe
      4⤵
      PID:6272
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
        5⤵
        
        PID:9072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35818.exe
        5⤵
        
        PID:10960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7629.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7629.exe
        5⤵
        
        PID:2944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30467.exe
        5⤵
        
        PID:6968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8557.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8557.exe
      4⤵
      PID:8576
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55959.exe
        5⤵
        
        PID:12116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2498.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6408
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29846.exe
      4⤵
      PID:12104
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35197.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35197.exe
      4⤵
      PID:16440
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-54139.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-54139.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48779.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-48779.exe
      4⤵
      PID:5140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18720.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18720.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6764
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64371.exe
        6⤵
        
        PID:8816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-20893.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20893.exe
        6⤵
        
        PID:15724
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5725.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10224
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51985.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51985.exe
        5⤵
        
        PID:15492
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-751.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-751.exe
        5⤵
        
        PID:3032
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56327.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56327.exe
      4⤵
      PID:7632
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37821.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-37821.exe
      4⤵
      PID:11184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4305.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4305.exe
      4⤵
      PID:5112
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45085.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45085.exe
    3⤵
    PID:6152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2378.exe
      4⤵
      PID:7792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19691.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19691.exe
        5⤵
        
        PID:16024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43538.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43538.exe
        5⤵
        
        PID:7572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33322.exe
      4⤵
      PID:10868
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19528.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19528.exe
      4⤵
      PID:16132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45782.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45782.exe
      4⤵
      PID:18732
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-28417.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-28417.exe
    3⤵
    PID:7476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59312.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59312.exe
      4⤵
      PID:1160
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65291.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65291.exe
    3⤵
    PID:12020
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58161.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58161.exe
    3⤵
    PID:15808
- C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52079.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52079.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1332
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7450.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22111.exe
        5⤵
        
        PID:6468
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35300.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35300.exe
        6⤵
        
        PID:8464
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58678.exe
        6⤵
        
        PID:10712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36846.exe
        6⤵
        
        PID:16396
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55206.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55206.exe
        5⤵
        
        PID:8628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23980.exe
        5⤵
        
        PID:12128
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13494.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13494.exe
        5⤵
        
        PID:3088
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5273.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5273.exe
        5⤵
        
        PID:17644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25029.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25029.exe
      4⤵
      PID:6452
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3743.exe
        5⤵
        
        PID:12260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7734.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7734.exe
        5⤵
        
        PID:17088
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26284.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26284.exe
      4⤵
      PID:9512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22253.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22253.exe
      4⤵
      PID:13476
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21985.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21985.exe
      4⤵
      PID:16768
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65374.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65374.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:5432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34917.exe
      4⤵
      PID:6476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47635.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47635.exe
        5⤵
        
        PID:8836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11013.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11013.exe
        5⤵
        
        PID:13136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57266.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57266.exe
        5⤵
        
        PID:15824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60773.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60773.exe
      4⤵
      PID:8592
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3743.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3743.exe
        5⤵
        
        PID:11956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63759.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63759.exe
        5⤵
        
        PID:3092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29846.exe
      4⤵
      PID:12148
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54275.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54275.exe
      4⤵
      PID:17452
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-19597.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-19597.exe
    3⤵
    PID:1896
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13685.exe
      4⤵
      PID:8152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22340.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22340.exe
      4⤵
      PID:11000
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2897.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2897.exe
      4⤵
      PID:15912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21801.exe
      4⤵
      PID:16836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53898.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53898.exe
    3⤵
    PID:7984
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3743.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3743.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:12092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61019.exe
      4⤵
      PID:16728
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-31901.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-31901.exe
    3⤵
    PID:10840
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-62118.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-62118.exe
    3⤵
    PID:14848
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-9887.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-9887.exe
    3⤵
    PID:17560
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19521.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19521.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:5060
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22443.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22443.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2318.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2318.exe
      4⤵
      PID:2400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2458.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2458.exe
        5⤵
        
        PID:6740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45523.exe
        6⤵
        
        PID:8348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21781.exe
        6⤵
        
        PID:4728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53307.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53307.exe
        6⤵
        
        PID:16352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21624.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21624.exe
        5⤵
        
        PID:9916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47334.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47334.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13408
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18669.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:16988
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22097.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22097.exe
      4⤵
      PID:6648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2710.exe
        5⤵
        
        PID:4844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14630.exe
        5⤵
        
        PID:9528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31801.exe
        5⤵
        
        PID:2876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42621.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42621.exe
      4⤵
      PID:9624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2518.exe
      4⤵
      PID:13844
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25685.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25685.exe
      4⤵
      PID:6416
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2489.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2489.exe
    3⤵
    PID:3644
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36343.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36343.exe
      4⤵
      PID:6824
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5886.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5886.exe
        5⤵
        
        PID:5920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9373.exe
        5⤵
        
        PID:9616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10052.exe
        5⤵
        
        PID:16356
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32760.exe
      4⤵
      PID:5400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17771.exe
        5⤵
        
        PID:14688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63951.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63951.exe
        5⤵
        
        PID:6624
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60205.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-60205.exe
      4⤵
      PID:11276
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49991.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49991.exe
      4⤵
      PID:1336
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11905.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11905.exe
    3⤵
    PID:7808
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1823.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1823.exe
      4⤵
      PID:12036
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39454.exe
      4⤵
      PID:15400
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-43277.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-43277.exe
    3⤵
    PID:10800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58226.exe
    3⤵
    PID:5948
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22331.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22331.exe
    3⤵
    PID:7364
- C:\Users\Admin\AppData\Local\Temp\Unicorn-59774.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-59774.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4880
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51903.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51903.exe
    3⤵
    PID:3404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16499.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16499.exe
      4⤵
      PID:6436
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47355.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47355.exe
        5⤵
        
        PID:10636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59467.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59467.exe
        5⤵
        
        PID:512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24601.exe
        5⤵
        
        PID:16720
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-19217.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:9496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5518.exe
        5⤵
        
        PID:14792
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14950.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14950.exe
        5⤵
        
        PID:16692
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17265.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17265.exe
      4⤵
      PID:13620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22291.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-22291.exe
      4⤵
      PID:6100
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-64474.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-64474.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:7216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58206.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58206.exe
      4⤵
      PID:15260
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31801.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31801.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:1480
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2348.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2348.exe
    3⤵
    PID:10908
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1903.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1903.exe
    3⤵
    PID:2864
- C:\Users\Admin\AppData\Local\Temp\Unicorn-39227.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-39227.exe
  2⤵
  PID:2088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27983.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27983.exe
    3⤵
    PID:6912
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54075.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-54075.exe
      4⤵
      PID:9092
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9720.exe
      4⤵
      PID:14124
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13738.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13738.exe
      4⤵
      PID:4320
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22776.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22776.exe
    3⤵
    PID:10036
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-48258.exe
    3⤵
    PID:13708
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21801.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21801.exe
    3⤵
    PID:7668
- C:\Users\Admin\AppData\Local\Temp\Unicorn-16116.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-16116.exe
  2⤵
  PID:6712
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-41823.exe
    3⤵
    PID:9032
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14329.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14329.exe
    3⤵
    PID:11308
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7629.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7629.exe
    3⤵
    PID:15568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-1678.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-1678.exe
    3⤵
    PID:3672
- C:\Users\Admin\AppData\Local\Temp\Unicorn-13485.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-13485.exe
  2⤵
  PID:9560
- C:\Users\Admin\AppData\Local\Temp\Unicorn-37254.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-37254.exe
  2⤵
  PID:13824
- C:\Users\Admin\AppData\Local\Temp\Unicorn-33567.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-33567.exe
  2⤵
  PID:2456

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4768,i,2904906934812054273,11716976550456127484,262144 --variations-seed-version --mojo-platform-channel-handle=948 /prefetch:8
1⤵
PID:2936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 4240 -ip 4240
1⤵
PID:15740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 604 -p 14948 -ip 14948
1⤵
PID:15752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 632 -p 14184 -ip 14184
1⤵
PID:15760

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:3224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-10698.exe

Filesize
468KB

MD5
abe9fa8bcb219ceef697c9e30017710c

SHA1
e129287e211e8d9e107bf8d29da8716f437fa0b6

SHA256
61c0f519a5478bb9b4afa0f924c25097051005102e55e1ef2068e30b456ea8e4

SHA512
2d875cc63576548a788b685d20400ca7b8b3822e25c089a6eb387f6e5415ef147f8c46921d070bcddcddc66c98108bfac6aeb43c9638f5bb7e15243df849d3c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-12893.exe

Filesize
468KB

MD5
ca0f2564cf4afdac6c61925d586242dd

SHA1
78886b9e04a45b05bfb4fe2bea5511e8d6759686

SHA256
1cd05497f288efe05e3547aeef0ca27687179867ddf7c70cb02a8ccf986aa050

SHA512
2a4cece2ac336ec59201c22bdf470b108a4f365568590ca1d21f529ba45ae967f1c31271bb714cad3822fda8626adb50d7da4c3d1d4eb4624ca9543db1cd1457

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-13215.exe

Filesize
468KB

MD5
8a2f94e2c2f9e41c448c01128e905fa1

SHA1
c50d0126af04527119f0f7501b1f593f114db5d3

SHA256
9c7d9c407aeafba6f497878fdc539663e2fd01223da3b33a12594998c0adc62b

SHA512
8d3d48b858f64cd183e4d0e9d59aeaffabd3c0e375bf363d394da235b7b9fe43cdce54a5294e0f0056adda7880afcb68404d0e185cb7ef352073d82f09a15006

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17412.exe

Filesize
468KB

MD5
2ac7ebf56ee6a4208fd47782c0b30874

SHA1
6f33212f1bc39dfa88322c699e88b2e022af188b

SHA256
b9875aae2f19405c94375e15297d4652fc47b055fabcffb8e70136ec1794f33d

SHA512
326225a53e9d577c28ae9c09db948127b20bb7bcd67b5589a29348d2ad04496fb6f8a7f8457e5a39710bae82524653c6dd1de8cfdf470a58ef096d4ddfd4fa3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17871.exe

Filesize
468KB

MD5
5203a8b1b69dbf68335378fd5a1372f9

SHA1
1c900c1f250e251242c91950ed66c80379db4a2d

SHA256
44f2d952678474c6278850d326d6f0f23fba178d15da5bc83c61725941c69952

SHA512
c11cf8d921707b92c6b552dd5087465af88f144faea322421bc22bde93d2955aef85cfc0ccd57ed0685b567de94dfe319e17d84e0a6c823b8b3c714a24d912a7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-1901.exe

Filesize
468KB

MD5
36197b167df0ab671088798b59ceaee9

SHA1
f2be3897ae94ae233dfdd91f246b344e03b7e749

SHA256
89e80a65327882718d6c801722cd9847658e6130daa83aea364a2abd39f2ffdb

SHA512
42875a9fc302aedb4c59a1ad2129d2beeeaa4e53de67c5b635e4fe917899eccaa5cf2471c00a0085cf2e518da63f3b5141fc7af108f7c0529bc63001b51bb258

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-19521.exe

Filesize
468KB

MD5
2a852068ebfc702fe31609b1f231a229

SHA1
9687488f58d08ca765099a0b175ea5ab313ce088

SHA256
ff0aa5fec5dbe1f7c11f720a880fe7d47e53a6916084b9335c894091ceb8203a

SHA512
84c59ab188c08e07c03282e0799db6996c456bc16886305979042252bd0a9dc71217b30b1af1958543d3b1ae59e84f99ecbb429e7be50880a854227dcc2f6528

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22321.exe

Filesize
468KB

MD5
bdc6dd22863466f65a94242a866f443f

SHA1
61a301edec906797d17c28bfe5002cb093ad3c2d

SHA256
dd610485b6efc906e9d90cef48c3557ba1243fa1d025bc027b0e65fc45927c75

SHA512
228b904174b690aad68c517901078d602b031b8df5e386574fa67733e913d41fb7844c708db6b6c0f4a30ee5605cb5104aa9d5b814a58d67e46518251bb07804

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23278.exe

Filesize
468KB

MD5
e917641e44565deffecaf53c59a2b2a5

SHA1
77b8fa54d4b9396723806320b2797e2cf38af71d

SHA256
c8014c7475f85c59406c60fe103a1650261fb4ffe097a4001f4024c011c41ca0

SHA512
66e989708160a2b40b80d18ddf27f5a7dc2d37b9b50dc371089051a5b9e8f94c32c5088bd07e849c6cdc84445394b6cdc42e7cf2be3bf9a99f76d0e34c5ae64f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23543.exe

Filesize
468KB

MD5
10a23300b31887d91d59468762f542b6

SHA1
5666c625659ace601be2085bfefa5c99b9addfc1

SHA256
745c9ffdbdab401913157a52fb58c84a2adba3940d0b837ec15c4eb13c7a2321

SHA512
b2a21e119f65bb19fd1409ff4b33086d2435a387f1b8096e6a3a4710bf70f11955227f0a42429a5db1f94c2e4761c6b0392d0a9fdc8b9750f127a575b21ca8e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27108.exe

Filesize
468KB

MD5
f41ad42c3237fd3615cbcaa7737bdb8c

SHA1
874c5a584d18f09467ac21dc75b7bc55d72a5fec

SHA256
8d8fb209626f482beba84c3dcbee575b5e4623da556deee2d36653807cf6fafe

SHA512
fcb692b84ee5affb371f22552d502a1c9194033a1178ac6c20b70a73a5d88bc3432eed201ec78b0f3f7b4f3716f3982c630aae63f4f5c096a9998dca05687c2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-28129.exe

Filesize
468KB

MD5
87ece687055f730519d11abd80feab87

SHA1
8542d1beb5611618846e40a8b0365183fe18757d

SHA256
9ae26f03058c8fd464843e68c111f67894db79930d1784419ada99be94b8f19c

SHA512
b72366a4dfda6f94d79ba554d640c58ef2145f2459c5790331528a0d7bef0a5d30e9e2df2412961d2641e46873173e5217dc7bab7e94b4fffb0ff6ad5aec1705

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-33828.exe

Filesize
468KB

MD5
d818988de5a5e5c0554b212b1b07a8c5

SHA1
3b8b6f5bffed25f66972e07a5d4c295404342798

SHA256
95429f2a6f791cd442fc6f931eb4a813a90e8cec5f0d59d7e90f540dbbb51c12

SHA512
d4aa5b077ddf8199df38ba05b9ded38e464a78f150c75c4965ef79307689b3bf07edc934f403862ac17855fff180729d97c2c626d25556718fbdf61b7244cb2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34481.exe

Filesize
468KB

MD5
3912e83b5e5f76dfc8dd12e2e169cdc4

SHA1
b9248f92763616248d1905d2a05a3d14f7234530

SHA256
0edbfbda638935113ae240b70acb2a1bf065c8261ffaa37ff7b34c022461db41

SHA512
8586ff4e7a9fe96e1ce0b0bc8ba69ddc7091f4968b0072e53e0aba4c0c73cd9dcde368a96c2e219a6aad234bb8264b13ac4360d0f4f17bf819ef3a38d03c7298

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-3677.exe

Filesize
468KB

MD5
47ad8af5690649883724dfd2a7161148

SHA1
9e51b10a1dad8d33a38d45fce7db30464eb38b1a

SHA256
7114ceec23f0cb7427577971dc1b47a7e69ef47e8e19b2252e5b38c24b48be84

SHA512
766c6431469d88bea58f543d7abc2bc1cca2a317fedd03dde10463a392ad7ffa8b6cc3ee9f395da4cdb377e8c896eefe638f8242c23a473a54be0b33523a49fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39360.exe

Filesize
468KB

MD5
1d87e28ba6467db87f03e4884c7c3efa

SHA1
c73b180801c8c69c47dae517d26e87cab23c17dd

SHA256
a4408afb0f2c8b2e102c24e09078e553f216e1eb3b1c887b52ceb7316f72b5d7

SHA512
7dbcfdaa2dc0d62cbf9139f446280733b807edbf9ed3f316dc384c682ebb2e7ceb3a15ff95af6e07ea48d23695e4e5ce34c9a557204f89cccf4c5e03eaf27832

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4191.exe

Filesize
468KB

MD5
98d00e88fc7bacc733f1965f19a30b3f

SHA1
6029e242abb65b0cb7612494334c786c88d709e9

SHA256
a9bc62acf40090c4edfbf9fc09e80b9885327caa323bae702ff9367f68dc6e93

SHA512
2e6e8e588b249b11b53f779d26063a84e8b03e12b0d6f93c18cb4d253cae40dae5ddecfedf797c59b664d79eac1ac06f0299f1bec7f717802ef1aa728a2991aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43313.exe

Filesize
468KB

MD5
64501af58496294a4348c0992e93954f

SHA1
82ea2ca9373fd3c1154fa9e0ca864f7c666812dc

SHA256
bc47da68ded407004bff4bc3d08d89aa67bb8b833286ef4ba2f64707c8173aef

SHA512
324af761b66fd543150897d48413518c050400a0ca4185f1476b1d34684dcfce600cee62c212766a4877e54b8fa9708e3f7dce13a6f0f7db47ca493ffd4e0a3f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46194.exe

Filesize
468KB

MD5
ab8638ab4df5bf7c35412a42711aabbe

SHA1
115b8f457bc6ad0c1d84c3e43c5bdc3cf0a77b38

SHA256
bf61582ce9e46e737c5028023c5a912cff9dd7cdd7c833283ebb54c32b5a3865

SHA512
98a91043564c3b03a020c412eec3588dee5a6e4f9db7c95e78dbdecb25d1c98303e98bacbc91cabfe87540f70b451ef38a401698aae3223e14a79823fa588aa2

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-47995.exe

Filesize
468KB

MD5
c004420605346e8ab202927e80afffba

SHA1
4ef6115dbeb3f03339b4973455d84669645fe1cb

SHA256
64ca0051586d8e756a8d76f35c1c6f01b9b267198778dcaa866085143bada2be

SHA512
05b936d9bfe9864bdc0d31bd89b2007669fdcc3cbd8d2a0a52d7308c6b10c09d686f6414231bd2fd6e7df71946dd1f089b8f1374d3a8ea8083d21470aa315354

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-51332.exe

Filesize
468KB

MD5
91602312c200e5f0be3993c8e0358ae5

SHA1
d570fd0d2d7785f6c09425fa95a7fda567d32b25

SHA256
6349fd286a7390d878ed9e940620f8039673f59a62f72f226909c8fa775e2553

SHA512
995855246ac9a9387e40007af32156ac2451800ba435eee4d92c36179b665e4364d1f1e3a8cade83446a8ab5cee90895f5b113d29c996b1389d0eb26227bb06d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52079.exe

Filesize
468KB

MD5
db4773e1bc9cecc99e6969926d2f6c42

SHA1
e6ea8e3959905b2f9aacfe419dfc4cabd4c637e2

SHA256
afe9973fbcc71bf40dcc28272ec0011d4915e4efc659f6272c965abd90f6b284

SHA512
4847c4d0290a852703100495e35f07e50b6f5965614eeaaf507fa837dfb89fcaf0c95207ee2eabecd68233bc5046611dbc2bfaff26995e8d500fbcd2fec690f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-5266.exe

Filesize
468KB

MD5
a152583b9d6a6a51afda7dec328b5874

SHA1
218117d3ebb0e0a15e9155484ce3f14aaaf99537

SHA256
ffeb185fdf34f1fc67a42fc996c38cfa92ab8a862effe59d3b9518b181e213b6

SHA512
ff0cdb3bc56c2f3ceb8d03823020e8440261f3c6d53c9f27e5a2baade92d048566aac935f8ff86173f981cabc87d9d622d33bb49775f4c928c8fedc243123396

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60164.exe

Filesize
468KB

MD5
bd48037384a4b9c4cdd5145595e2c3af

SHA1
d73e269c6a382eb0a9bb65184c80bda797d79feb

SHA256
9adc7374b41dbff57f29bde063525b1cec70b72958ee11119442c2e8de3679e9

SHA512
3fcffc5243aaa613875d8b14c13fe0b8dcd1e871ff8b2f3905838eec7e067a337d1b7646400da82e570883729e217c5b407499d3a4196d8037b07ff675ef94c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61316.exe

Filesize
468KB

MD5
8b8c9ef5666fead6adbde1d9668df3b1

SHA1
e5e0a64f9e6ca4520b52a95adba3b78bcde5ef28

SHA256
8626f727248b0e3f955415b398592de2b25e60657a1d9b6126b48d106863c3db

SHA512
fef9aa4127b470df38c8420bee7b31511f5850f9ea0498286427feb6027ff6dfabdb181b775ca843df8b9576be8ed9b063b3bddda51c87115171a7e53251b383

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-64066.exe

Filesize
468KB

MD5
574c8570b287b8f7b2614ad2b0c8007f

SHA1
76e79eb291b2f472572b732c8180bea08edcb879

SHA256
1262ddddf533ebdead60ba2012ca1d93b5c79fc04f466c71a06c9a0a57e4508f

SHA512
d240c53ea7d5ee92b45353225dd1f13a131307000096268350b7cba71acf13bdb4816ef2a3538181087254fd4ffe7fc31429a133fbab8f377301e8f2a622ef86

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7085.exe

Filesize
468KB

MD5
7ecabce607f1d69950abe3409eb92383

SHA1
74233a8d5cec6d4227c9edacf58fa962a5f3e42c

SHA256
f05a4ffd1d5ceb5effb23d3e8554b73721437c6ed8f1be25c23ddd66536168b5

SHA512
ab2c64800278ee63c8569ba82791a88e231340a258a6351b15a872df5e2c7dac7e78cd032966287e9b94f6a4353bc1b84441cb989c8d399b91e0bf5ee637bfbb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7761.exe

Filesize
468KB

MD5
8c5a5f48593571e4b86f575868a91980

SHA1
32b29e54c7db352ff64fb9275ecd7a022c9dec8c

SHA256
927a7540b0a826d226c4e77f6708cd06bd299b08d9b58ee98023b924e2a0e4ee

SHA512
59b3bfde4bcd84d907098d382438adc91a0a3dcaf364aa28a365b8cc30db2b8c6195e81ecf98c2e4434a9ab4c7d3c6ee1fdc59ed3aed15686c465357736dfbb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-8586.exe

Filesize
468KB

MD5
e13d5a96c95d75f1df5401e229d55ca1

SHA1
8d2b0240f57efb48173459f6e512b1b279e087f2

SHA256
1dc018510c98a16b54450eda83a028205af2034216ad78e46f8c60762d423a71

SHA512
abef75c847043522293ce1a15889e2db822a58caa73880d26d64868bc5b29c099fd95f43174198c59b21c42d3c17226ac4dd06bfb81694b2947dd9d2bddc8906

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9759.exe

Filesize
468KB

MD5
3ab800062f20cd9c1c13d42af8801ad1

SHA1
9e73425adae1a44f4622fb7f54439c897d9ba7dc

SHA256
4aa7dc87c0e2cc166c332065895bb8ed03de039a76cb4b739c6b45ab98a6ea62

SHA512
ae497c524fcc7408872c012ac9aa2a22e403c33dc4a59ad374d8294473bbf409d278c660da13394308b9bd2bafd86be6c0dc7137e3d274435dab905c1c7434da

Download Submit
memory/320-146-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1132-592-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1136-349-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1236-456-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1332-186-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1368-51-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1372-593-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1532-526-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1580-344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1620-459-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1676-48-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1696-465-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1716-570-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1880-59-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1916-293-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1968-145-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2088-494-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2104-73-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2108-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2128-305-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2400-433-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2436-370-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2448-253-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2452-386-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2508-575-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2512-286-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2532-285-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2580-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2684-282-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2792-357-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2804-2536-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2896-7-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2976-374-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3052-190-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3076-33-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3084-2535-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3088-2534-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3112-248-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3120-85-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3176-120-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3260-284-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3404-483-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3428-237-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3436-84-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3468-565-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3472-86-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3484-398-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3588-356-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3632-391-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3644-457-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3652-482-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3712-283-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3756-576-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3772-345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3840-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4048-404-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4156-431-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4316-173-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4328-423-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4384-399-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4444-231-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4452-552-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4536-281-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4712-220-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4744-336-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4848-106-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4876-187-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4880-333-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4900-430-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4912-219-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4940-114-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5036-455-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5060-191-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5092-247-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5140-568-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5156-82-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5168-21-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5264-429-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5268-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5372-189-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5388-591-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5396-551-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5416-334-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5420-188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5424-484-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5432-335-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5436-347-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5452-432-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5464-381-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5540-355-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5572-128-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5700-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5720-529-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5744-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5848-74-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6040-495-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6044-624-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6080-13-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/6124-401-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads