aa01db3d8f39b8b387bd6852188dadb8b2ec5304a9edd26e91fa66b82f50a932

Analysis

max time kernel
120s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 02:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa01db3d8f39b8b387bd6852188dadb8b2ec5304a9edd26e91fa66b82f50a932N.exe
Size

468KB
MD5

7235a48f4311736bfc8b3e675d84c670
SHA1

3cebbdc6f43359ba664de6bb72a39cb00e73d589
SHA256

aa01db3d8f39b8b387bd6852188dadb8b2ec5304a9edd26e91fa66b82f50a932
SHA512

7ba0cc48e1b2f8155a21d6f625531b3900cec655638e08331c2e7e005a76183a148208dd3bd20a694dccbde1959c79b9df7844e8260d098c60c632dfcef826d9
SSDEEP

3072:HbYZog5OP08UAaY8PziFff8/ECWA/4+RBdH5ZVaUK0F3bIqcuSab:Hbeox5UAUPeFffE/TnK01Mqcu

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 64 IoCs

pid	Process
2260	Unicorn-60038.exe
3192	Unicorn-42374.exe
3660	Unicorn-22508.exe
1944	Unicorn-4904.exe
2084	Unicorn-50768.exe
2824	Unicorn-46726.exe
3048	Unicorn-56055.exe
4232	Unicorn-43753.exe
4604	Unicorn-11272.exe
3852	Unicorn-22931.exe
4332	Unicorn-9388.exe
1120	Unicorn-9928.exe
4496	Unicorn-7660.exe
4184	Unicorn-27526.exe
4764	Unicorn-27453.exe
4432	Unicorn-56553.exe
1812	Unicorn-21996.exe
4048	Unicorn-61161.exe
2600	Unicorn-39759.exe
4572	Unicorn-45126.exe
2840	Unicorn-27648.exe
588	Unicorn-52521.exe
1108	Unicorn-31315.exe
1992	Unicorn-4965.exe
1068	Unicorn-17353.exe
4440	Unicorn-50217.exe
2224	Unicorn-34950.exe
3052	Unicorn-26211.exe
4792	Unicorn-63600.exe
2440	Unicorn-11798.exe
4540	Unicorn-63600.exe
2620	Unicorn-27270.exe
4532	Unicorn-23631.exe
536	Unicorn-28230.exe
3784	Unicorn-19603.exe
4752	Unicorn-58790.exe
4016	Unicorn-39116.exe
2288	Unicorn-59750.exe
2484	Unicorn-25846.exe
3420	Unicorn-17286.exe
4416	Unicorn-17478.exe
2164	Unicorn-27462.exe
1072	Unicorn-35276.exe
4124	Unicorn-12869.exe
3892	Unicorn-10108.exe
1060	Unicorn-10373.exe
3332	Unicorn-43430.exe
920	Unicorn-26409.exe
4300	Unicorn-26601.exe
4776	Unicorn-24524.exe
3788	Unicorn-60653.exe
748	Unicorn-60653.exe
4772	Unicorn-14981.exe
1444	Unicorn-14716.exe
4276	Unicorn-38031.exe
5024	Unicorn-15942.exe
3260	Unicorn-31017.exe
3696	Unicorn-28713.exe
5052	Unicorn-26636.exe
3744	Unicorn-42095.exe
792	Unicorn-55831.exe
456	Unicorn-55831.exe
1864	Unicorn-42662.exe
5092	Unicorn-38255.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1132	7880	WerFault.exe	339

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33324.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38258.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-20978.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23550.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-55352.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39759.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-23996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36588.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-1650.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11438.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36004.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-19593.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4357.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14990.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-38476.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28981.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13205.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-13531.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9161.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28815.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14158.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39343.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-10290.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36172.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-46330.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-60653.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-58925.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-42927.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5612.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-6873.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-36245.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63788.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-63005.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-16761.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-34267.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48076.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-35151.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15884.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-9333.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-39215.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-14440.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-21996.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28713.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57530.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-28230.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22021.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-50294.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-22357.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-15285.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-33301.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-4379.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-57174.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-11362.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-48413.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-43311.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56812.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-47683.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-17826.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-56553.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49487.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-5038.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Unicorn-49981.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	dwm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	dwm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	dwm.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	dwm.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dwm.exe

Modifies data under HKEY_USERS 18 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	dwm.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft	dwm.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeCreateGlobalPrivilege	7444	dwm.exe
Token: SeChangeNotifyPrivilege	7444	dwm.exe
Token: 33	7444	dwm.exe
Token: SeIncBasePriorityPrivilege	7444	dwm.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
2800	aa01db3d8f39b8b387bd6852188dadb8b2ec5304a9edd26e91fa66b82f50a932N.exe
2260	Unicorn-60038.exe
3192	Unicorn-42374.exe
3660	Unicorn-22508.exe
1944	Unicorn-4904.exe
2084	Unicorn-50768.exe
3048	Unicorn-56055.exe
2824	Unicorn-46726.exe
4232	Unicorn-43753.exe
4604	Unicorn-11272.exe
4332	Unicorn-9388.exe
3852	Unicorn-22931.exe
4496	Unicorn-7660.exe
1120	Unicorn-9928.exe
4764	Unicorn-27453.exe
4184	Unicorn-27526.exe
4432	Unicorn-56553.exe
1812	Unicorn-21996.exe
4048	Unicorn-61161.exe
2600	Unicorn-39759.exe
2840	Unicorn-27648.exe
4572	Unicorn-45126.exe
588	Unicorn-52521.exe
4440	Unicorn-50217.exe
1108	Unicorn-31315.exe
1068	Unicorn-17353.exe
1992	Unicorn-4965.exe
2440	Unicorn-11798.exe
2224	Unicorn-34950.exe
3052	Unicorn-26211.exe
4792	Unicorn-63600.exe
4540	Unicorn-63600.exe
2620	Unicorn-27270.exe
536	Unicorn-28230.exe
4532	Unicorn-23631.exe
4016	Unicorn-39116.exe
4752	Unicorn-58790.exe
3784	Unicorn-19603.exe
2288	Unicorn-59750.exe
2484	Unicorn-25846.exe
3420	Unicorn-17286.exe
4416	Unicorn-17478.exe
2164	Unicorn-27462.exe
1072	Unicorn-35276.exe
4124	Unicorn-12869.exe
3332	Unicorn-43430.exe
1060	Unicorn-10373.exe
3892	Unicorn-10108.exe
4300	Unicorn-26601.exe
4772	Unicorn-14981.exe
920	Unicorn-26409.exe
3788	Unicorn-60653.exe
4276	Unicorn-38031.exe
748	Unicorn-60653.exe
5024	Unicorn-15942.exe
4776	Unicorn-24524.exe
1444	Unicorn-14716.exe
792	Unicorn-55831.exe
5052	Unicorn-26636.exe
3260	Unicorn-31017.exe
3696	Unicorn-28713.exe
456	Unicorn-55831.exe
3744	Unicorn-42095.exe
1864	Unicorn-42662.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 2260	2800	aa01db3d8f39b8b387bd6852188dadb8b2ec5304a9edd26e91fa66b82f50a932N.exe	82
PID 2800 wrote to memory of 2260	2800	aa01db3d8f39b8b387bd6852188dadb8b2ec5304a9edd26e91fa66b82f50a932N.exe	82
PID 2800 wrote to memory of 2260	2800	aa01db3d8f39b8b387bd6852188dadb8b2ec5304a9edd26e91fa66b82f50a932N.exe	82
PID 2800 wrote to memory of 3660	2800	aa01db3d8f39b8b387bd6852188dadb8b2ec5304a9edd26e91fa66b82f50a932N.exe	83
PID 2800 wrote to memory of 3660	2800	aa01db3d8f39b8b387bd6852188dadb8b2ec5304a9edd26e91fa66b82f50a932N.exe	83
PID 2800 wrote to memory of 3660	2800	aa01db3d8f39b8b387bd6852188dadb8b2ec5304a9edd26e91fa66b82f50a932N.exe	83
PID 2260 wrote to memory of 3192	2260	Unicorn-60038.exe	84
PID 2260 wrote to memory of 3192	2260	Unicorn-60038.exe	84
PID 2260 wrote to memory of 3192	2260	Unicorn-60038.exe	84
PID 3192 wrote to memory of 1944	3192	Unicorn-42374.exe	89
PID 3192 wrote to memory of 1944	3192	Unicorn-42374.exe	89
PID 3192 wrote to memory of 1944	3192	Unicorn-42374.exe	89
PID 2260 wrote to memory of 2084	2260	Unicorn-60038.exe	90
PID 2260 wrote to memory of 2084	2260	Unicorn-60038.exe	90
PID 2260 wrote to memory of 2084	2260	Unicorn-60038.exe	90
PID 3660 wrote to memory of 2824	3660	Unicorn-22508.exe	91
PID 3660 wrote to memory of 2824	3660	Unicorn-22508.exe	91
PID 3660 wrote to memory of 2824	3660	Unicorn-22508.exe	91
PID 2800 wrote to memory of 3048	2800	aa01db3d8f39b8b387bd6852188dadb8b2ec5304a9edd26e91fa66b82f50a932N.exe	92
PID 2800 wrote to memory of 3048	2800	aa01db3d8f39b8b387bd6852188dadb8b2ec5304a9edd26e91fa66b82f50a932N.exe	92
PID 2800 wrote to memory of 3048	2800	aa01db3d8f39b8b387bd6852188dadb8b2ec5304a9edd26e91fa66b82f50a932N.exe	92
PID 1944 wrote to memory of 4232	1944	Unicorn-4904.exe	94
PID 1944 wrote to memory of 4232	1944	Unicorn-4904.exe	94
PID 1944 wrote to memory of 4232	1944	Unicorn-4904.exe	94
PID 2084 wrote to memory of 4604	2084	Unicorn-50768.exe	95
PID 2084 wrote to memory of 4604	2084	Unicorn-50768.exe	95
PID 2084 wrote to memory of 4604	2084	Unicorn-50768.exe	95
PID 2260 wrote to memory of 3852	2260	Unicorn-60038.exe	96
PID 2260 wrote to memory of 3852	2260	Unicorn-60038.exe	96
PID 2260 wrote to memory of 3852	2260	Unicorn-60038.exe	96
PID 3192 wrote to memory of 4332	3192	Unicorn-42374.exe	97
PID 3192 wrote to memory of 4332	3192	Unicorn-42374.exe	97
PID 3192 wrote to memory of 4332	3192	Unicorn-42374.exe	97
PID 2824 wrote to memory of 1120	2824	Unicorn-46726.exe	98
PID 2824 wrote to memory of 1120	2824	Unicorn-46726.exe	98
PID 2824 wrote to memory of 1120	2824	Unicorn-46726.exe	98
PID 3660 wrote to memory of 4496	3660	Unicorn-22508.exe	99
PID 3660 wrote to memory of 4496	3660	Unicorn-22508.exe	99
PID 3660 wrote to memory of 4496	3660	Unicorn-22508.exe	99
PID 3048 wrote to memory of 4184	3048	Unicorn-56055.exe	100
PID 3048 wrote to memory of 4184	3048	Unicorn-56055.exe	100
PID 3048 wrote to memory of 4184	3048	Unicorn-56055.exe	100
PID 2800 wrote to memory of 4764	2800	aa01db3d8f39b8b387bd6852188dadb8b2ec5304a9edd26e91fa66b82f50a932N.exe	101
PID 2800 wrote to memory of 4764	2800	aa01db3d8f39b8b387bd6852188dadb8b2ec5304a9edd26e91fa66b82f50a932N.exe	101
PID 2800 wrote to memory of 4764	2800	aa01db3d8f39b8b387bd6852188dadb8b2ec5304a9edd26e91fa66b82f50a932N.exe	101
PID 4232 wrote to memory of 4432	4232	Unicorn-43753.exe	104
PID 4232 wrote to memory of 4432	4232	Unicorn-43753.exe	104
PID 4232 wrote to memory of 4432	4232	Unicorn-43753.exe	104
PID 1944 wrote to memory of 1812	1944	Unicorn-4904.exe	105
PID 1944 wrote to memory of 1812	1944	Unicorn-4904.exe	105
PID 1944 wrote to memory of 1812	1944	Unicorn-4904.exe	105
PID 4604 wrote to memory of 4048	4604	Unicorn-11272.exe	106
PID 4604 wrote to memory of 4048	4604	Unicorn-11272.exe	106
PID 4604 wrote to memory of 4048	4604	Unicorn-11272.exe	106
PID 2084 wrote to memory of 2600	2084	Unicorn-50768.exe	107
PID 2084 wrote to memory of 2600	2084	Unicorn-50768.exe	107
PID 2084 wrote to memory of 2600	2084	Unicorn-50768.exe	107
PID 3852 wrote to memory of 4572	3852	Unicorn-22931.exe	108
PID 3852 wrote to memory of 4572	3852	Unicorn-22931.exe	108
PID 3852 wrote to memory of 4572	3852	Unicorn-22931.exe	108
PID 2260 wrote to memory of 2840	2260	Unicorn-60038.exe	109
PID 2260 wrote to memory of 2840	2260	Unicorn-60038.exe	109
PID 2260 wrote to memory of 2840	2260	Unicorn-60038.exe	109
PID 4332 wrote to memory of 588	4332	Unicorn-9388.exe	110

C:\Users\Admin\AppData\Local\Temp\aa01db3d8f39b8b387bd6852188dadb8b2ec5304a9edd26e91fa66b82f50a932N.exe
"C:\Users\Admin\AppData\Local\Temp\aa01db3d8f39b8b387bd6852188dadb8b2ec5304a9edd26e91fa66b82f50a932N.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Users\Admin\AppData\Local\Temp\Unicorn-60038.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-60038.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2260
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42374.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42374.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4904.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4904.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1944
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43753.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43753.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        Suspicious use of WriteProcessMemory
        
        PID:4232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56553.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56553.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:4432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27270.exe
        7⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42662.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42662.exe
        8⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1864
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28815.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28815.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:5656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35020.exe
        10⤵
        
        PID:6900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15884.exe
        11⤵
        System Location Discovery: System Language Discovery
        
        PID:9288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63763.exe
        11⤵
        
        PID:13316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5692.exe
        11⤵
        
        PID:15748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15141.exe
        11⤵
        
        PID:15852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46555.exe
        11⤵
        
        PID:16372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27792.exe
        11⤵
        
        PID:6444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4284.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4284.exe
        10⤵
        
        PID:9640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17157.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17157.exe
        10⤵
        
        PID:14000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7529.exe
        10⤵
        
        PID:14852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8050.exe
        9⤵
        
        PID:6448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47500.exe
        10⤵
        
        PID:1452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54083.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54083.exe
        10⤵
        
        PID:15936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32618.exe
        10⤵
        
        PID:5260
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38394.exe
        9⤵
        
        PID:9476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4652.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4652.exe
        9⤵
        
        PID:14244
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54419.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54419.exe
        8⤵
        
        PID:5952
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20780.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20780.exe
        9⤵
        
        PID:8236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31043.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31043.exe
        10⤵
        
        PID:5172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26261.exe
        9⤵
        
        PID:13100
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1177.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1177.exe
        9⤵
        
        PID:15552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39867.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39867.exe
        9⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11545.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11545.exe
        8⤵
        
        PID:8044
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5669.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5669.exe
        8⤵
        
        PID:11552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64182.exe
        8⤵
        
        PID:4800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63020.exe
        8⤵
        
        PID:11116
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38255.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38255.exe
        7⤵
        Executes dropped EXE
        
        PID:5092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31311.exe
        8⤵
        
        PID:5632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49565.exe
        9⤵
        
        PID:7760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14234.exe
        10⤵
        
        PID:6348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41005.exe
        9⤵
        
        PID:11060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47826.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47826.exe
        9⤵
        
        PID:2732
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe
        9⤵
        
        PID:15704
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7282.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7282.exe
        8⤵
        
        PID:6420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25551.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25551.exe
        9⤵
        
        PID:11476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10101.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10101.exe
        9⤵
        
        PID:15572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17532.exe
        8⤵
        
        PID:8328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4357.exe
        8⤵
        
        PID:11288
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17731.exe
        8⤵
        
        PID:6028
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8860.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8860.exe
        7⤵
        
        PID:5008
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36588.exe
        8⤵
        
        PID:7628
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38639.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38639.exe
        9⤵
        
        PID:11228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3714.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3714.exe
        9⤵
        
        PID:15508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40397.exe
        9⤵
        
        PID:2132
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64659.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64659.exe
        8⤵
        
        PID:10280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31484.exe
        8⤵
        
        PID:14392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49763.exe
        8⤵
        
        PID:6228
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32812.exe
        8⤵
        
        PID:8464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64582.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64582.exe
        7⤵
        
        PID:7780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38701.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38701.exe
        7⤵
        
        PID:10440
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29281.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29281.exe
        7⤵
        
        PID:16120
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23631.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31020.exe
        7⤵
        
        PID:1868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15125.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15125.exe
        8⤵
        
        PID:4652
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2158.exe
        9⤵
        
        PID:10368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45523.exe
        9⤵
        
        PID:14048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20988.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20988.exe
        9⤵
        
        PID:14496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46979.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46979.exe
        9⤵
        
        PID:15476
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34267.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34267.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:15164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14764.exe
        9⤵
        
        PID:7436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35677.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35677.exe
        8⤵
        
        PID:8872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22021.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22021.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:11968
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28236.exe
        8⤵
        
        PID:13660
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3827.exe
        8⤵
        
        PID:3280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-626.exe
        7⤵
        
        PID:448
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17394.exe
        9⤵
        
        PID:11832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9957.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9957.exe
        9⤵
        
        PID:4380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28634.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28634.exe
        9⤵
        
        PID:8624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60381.exe
        8⤵
        
        PID:13152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13531.exe
        8⤵
        
        PID:5796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9916.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9916.exe
        7⤵
        
        PID:8568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47683.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47683.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38045.exe
        6⤵
        
        PID:1604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57263.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57263.exe
        7⤵
        
        PID:6016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
        8⤵
        
        PID:7552
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52563.exe
        8⤵
        
        PID:10984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12185.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12185.exe
        8⤵
        
        PID:15264
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-926.exe
        8⤵
        
        PID:6768
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13269.exe
        7⤵
        
        PID:7984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34588.exe
        7⤵
        
        PID:11348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48621.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48621.exe
        7⤵
        
        PID:15396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14725.exe
        6⤵
        
        PID:3032
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50511.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50511.exe
        7⤵
        
        PID:7772
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15541.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15541.exe
        7⤵
        
        PID:10384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16025.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16025.exe
        7⤵
        
        PID:14340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50694.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50694.exe
        7⤵
        
        PID:4648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40397.exe
        7⤵
        
        PID:5800
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55917.exe
        6⤵
        
        PID:7808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63795.exe
        6⤵
        
        PID:11484
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40801.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40801.exe
        6⤵
        
        PID:13688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21996.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:1812
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28230.exe
        6⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30444.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30444.exe
        7⤵
        
        PID:2776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58550.exe
        8⤵
        
        PID:5992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44111.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44111.exe
        9⤵
        
        PID:7992
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28565.exe
        9⤵
        
        PID:12316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7628.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7628.exe
        8⤵
        
        PID:9916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39029.exe
        8⤵
        
        PID:13452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63020.exe
        8⤵
        
        PID:3384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54097.exe
        8⤵
        
        PID:10152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33749.exe
        7⤵
        
        PID:5916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39343.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:6640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35663.exe
        9⤵
        
        PID:9160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36245.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:12172
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58947.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58947.exe
        9⤵
        
        PID:16140
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23122.exe
        8⤵
        
        PID:9616
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42906.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42906.exe
        8⤵
        
        PID:13432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62787.exe
        8⤵
        
        PID:796
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47453.exe
        7⤵
        
        PID:7844
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64292.exe
        8⤵
        
        PID:8488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54731.exe
        8⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33606.exe
        7⤵
        
        PID:10444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63277.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63277.exe
        7⤵
        
        PID:14740
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24309.exe
        6⤵
        
        PID:2192
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42764.exe
        7⤵
        
        PID:6060
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        8⤵
        
        PID:8780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44118.exe
        8⤵
        
        PID:11760
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1650.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1650.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:8160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19129.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19129.exe
        7⤵
        
        PID:11452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47853.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47853.exe
        7⤵
        
        PID:4328
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17731.exe
        7⤵
        
        PID:5028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34563.exe
        6⤵
        
        PID:6856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58415.exe
        7⤵
        
        PID:11824
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61317.exe
        7⤵
        
        PID:436
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50643.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50643.exe
        6⤵
        
        PID:7040
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8565.exe
        6⤵
        
        PID:11716
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33121.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33121.exe
        6⤵
        
        PID:2464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19603.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19603.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33516.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33516.exe
        6⤵
        
        PID:4788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53423.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53423.exe
        7⤵
        
        PID:5852
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        8⤵
        System Location Discovery: System Language Discovery
        
        PID:8816
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12441.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12441.exe
        8⤵
        
        PID:13292
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13077.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13077.exe
        7⤵
        
        PID:7868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64573.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64573.exe
        7⤵
        
        PID:11360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32969.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32969.exe
        7⤵
        
        PID:3404
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12914.exe
        6⤵
        
        PID:872
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54351.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54351.exe
        7⤵
        
        PID:7912
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38421.exe
        7⤵
        
        PID:10480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50618.exe
        7⤵
        
        PID:14712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7042.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7042.exe
        7⤵
        
        PID:15536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14142.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14142.exe
        7⤵
        
        PID:1752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15385.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15385.exe
        6⤵
        
        PID:8084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-567.exe
        7⤵
        
        PID:5720
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39686.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39686.exe
        6⤵
        
        PID:10900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64182.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64182.exe
        6⤵
        
        PID:4856
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51199.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51199.exe
        6⤵
        
        PID:16352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47750.exe
        5⤵
        
        PID:4208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35084.exe
        6⤵
        
        PID:5376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31151.exe
        7⤵
        
        PID:8352
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50294.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50294.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:12780
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63174.exe
        7⤵
        
        PID:16252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59725.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59725.exe
        7⤵
        
        PID:16296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45563.exe
        7⤵
        
        PID:6808
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17234.exe
        6⤵
        
        PID:8296
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33149.exe
        7⤵
        
        PID:9972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5497.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5497.exe
        6⤵
        
        PID:11532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3765.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3765.exe
        6⤵
        
        PID:1636
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7433.exe
        5⤵
        
        PID:6632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53647.exe
        6⤵
        
        PID:10176
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37525.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37525.exe
        6⤵
        
        PID:13900
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63155.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63155.exe
        5⤵
        
        PID:7896
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5438.exe
        5⤵
        
        PID:12412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29152.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29152.exe
        5⤵
        
        PID:6216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9388.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9388.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52521.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52521.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:588
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26601.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26601.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52982.exe
        7⤵
        
        PID:5900
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46892.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46892.exe
        8⤵
        
        PID:3456
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16245.exe
        8⤵
        
        PID:12196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38197.exe
        7⤵
        
        PID:9868
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23163.exe
        7⤵
        
        PID:13936
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10433.exe
        7⤵
        
        PID:15636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29717.exe
        6⤵
        
        PID:5444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46959.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46959.exe
        7⤵
        
        PID:8048
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34031.exe
        8⤵
        
        PID:12068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40314.exe
        8⤵
        
        PID:14776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54099.exe
        7⤵
        
        PID:10640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63005.exe
        7⤵
        
        PID:14520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23846.exe
        7⤵
        
        PID:14600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13531.exe
        7⤵
        
        PID:16112
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17283.exe
        7⤵
        
        PID:7116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42490.exe
        6⤵
        
        PID:7292
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-19618.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19618.exe
        6⤵
        
        PID:12108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47570.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47570.exe
        6⤵
        
        PID:15596
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60653.exe
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:748
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35151.exe
        6⤵
        
        PID:5340
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61807.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61807.exe
        7⤵
        
        PID:6452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47055.exe
        8⤵
        
        PID:10884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50653.exe
        8⤵
        
        PID:14396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43567.exe
        8⤵
        
        PID:8092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-338.exe
        7⤵
        
        PID:9148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49981.exe
        7⤵
        
        PID:12124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9952.exe
        7⤵
        
        PID:6076
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23509.exe
        6⤵
        
        PID:6696
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42348.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42348.exe
        7⤵
        
        PID:14580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55352.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55352.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15708
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3033.exe
        6⤵
        
        PID:9500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48771.exe
        6⤵
        
        PID:13400
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-54122.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54122.exe
        6⤵
        
        PID:15844
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55478.exe
        6⤵
        
        PID:15932
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe
        6⤵
        
        PID:5216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54973.exe
        5⤵
        
        PID:5428
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16940.exe
        6⤵
        
        PID:6468
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8427.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8427.exe
        7⤵
        
        PID:10620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49270.exe
        7⤵
        
        PID:14496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7833.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7833.exe
        7⤵
        
        PID:15496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30096.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30096.exe
        7⤵
        
        PID:3736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-338.exe
        6⤵
        
        PID:9168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49981.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11312
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31061.exe
        6⤵
        
        PID:16140
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59363.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59363.exe
        5⤵
        
        PID:6492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18764.exe
        6⤵
        
        PID:11460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-920.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-920.exe
        6⤵
        
        PID:15644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43311.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5136
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14732.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14732.exe
        5⤵
        
        PID:8020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44693.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44693.exe
        5⤵
        
        PID:13220
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26672.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26672.exe
        5⤵
        
        PID:13616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31315.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31315.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1108
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12869.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12869.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38799.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38799.exe
        6⤵
        
        PID:3368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7310.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7310.exe
        7⤵
        
        PID:5640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63788.exe
        8⤵
        
        PID:8012
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5390.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5390.exe
        9⤵
        
        PID:13236
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54099.exe
        8⤵
        
        PID:10632
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63005.exe
        8⤵
        
        PID:14504
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15141.exe
        8⤵
        
        PID:15976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26258.exe
        7⤵
        
        PID:7840
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62269.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62269.exe
        7⤵
        
        PID:12128
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11699.exe
        7⤵
        
        PID:6224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53395.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53395.exe
        6⤵
        
        PID:6688
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8235.exe
        7⤵
        
        PID:10592
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49270.exe
        7⤵
        
        PID:14480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47171.exe
        7⤵
        
        PID:2268
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43311.exe
        7⤵
        
        PID:5156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16953.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16953.exe
        6⤵
        
        PID:6972
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14341.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14341.exe
        6⤵
        
        PID:12608
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40754.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40754.exe
        5⤵
        
        PID:2852
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39023.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39023.exe
        6⤵
        
        PID:5700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34703.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34703.exe
        7⤵
        
        PID:8212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26261.exe
        7⤵
        
        PID:12384
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55795.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55795.exe
        7⤵
        
        PID:16260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33017.exe
        6⤵
        
        PID:9240
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36172.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51731.exe
        6⤵
        
        PID:15372
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-926.exe
        6⤵
        
        PID:4196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47037.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47037.exe
        5⤵
        
        PID:5980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49164.exe
        6⤵
        
        PID:10132
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22933.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22933.exe
        6⤵
        
        PID:13784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5529.exe
        6⤵
        
        PID:15892
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49283.exe
        6⤵
        
        PID:14256
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-133.exe
        5⤵
        
        PID:8988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58925.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:13260
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe
        5⤵
        
        PID:5936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10108.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41295.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41295.exe
        5⤵
        
        PID:5160
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56812.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:1672
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61708.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61708.exe
        7⤵
        
        PID:7640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36245.exe
        7⤵
        
        PID:11544
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21019.exe
        7⤵
        
        PID:11108
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38194.exe
        6⤵
        
        PID:8960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15388.exe
        6⤵
        
        PID:11948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56080.exe
        6⤵
        
        PID:16268
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-18034.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18034.exe
        5⤵
        
        PID:5440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35663.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35663.exe
        6⤵
        
        PID:7572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-28757.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28757.exe
        6⤵
        
        PID:12332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29413.exe
        6⤵
        
        PID:15504
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59805.exe
        5⤵
        
        PID:6816
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34534.exe
        5⤵
        
        PID:404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20978.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20978.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5126.exe
        5⤵
        
        PID:5612
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34025.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34025.exe
      4⤵
      PID:5512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-235.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-235.exe
        5⤵
        
        PID:7048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38476.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38476.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:14320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10726.exe
        6⤵
        
        PID:5672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8981.exe
        5⤵
        
        PID:8812
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41370.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41370.exe
        5⤵
        
        PID:12004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34723.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34723.exe
        5⤵
        
        PID:16092
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46453.exe
        5⤵
        
        PID:4320
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21874.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21874.exe
      4⤵
      PID:7308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39295.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39295.exe
      4⤵
      PID:9628
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35756.exe
        5⤵
        
        PID:15992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30819.exe
        5⤵
        
        PID:16248
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53028.exe
      4⤵
      PID:14064
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-50768.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-50768.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11272.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11272.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:4604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61161.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58790.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58790.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33324.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:3284
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39692.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39692.exe
        8⤵
        
        PID:5776
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43119.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:7656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28207.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28207.exe
        10⤵
        
        PID:14692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-567.exe
        10⤵
        
        PID:1680
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34773.exe
        9⤵
        
        PID:8536
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50717.exe
        9⤵
        
        PID:14640
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40411.exe
        9⤵
        
        PID:6000
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54966.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54966.exe
        8⤵
        
        PID:7700
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48509.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48509.exe
        8⤵
        
        PID:11256
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37283.exe
        8⤵
        
        PID:14856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39768.exe
        8⤵
        
        PID:4348
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6770.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6770.exe
        7⤵
        
        PID:5452
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39215.exe
        8⤵
        
        PID:12724
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60189.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60189.exe
        8⤵
        
        PID:16164
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38197.exe
        7⤵
        
        PID:8404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23163.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23163.exe
        7⤵
        
        PID:13860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37332.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37332.exe
        7⤵
        
        PID:4824
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-45939.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45939.exe
        6⤵
        
        PID:2380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49583.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49583.exe
        7⤵
        
        PID:5368
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19375.exe
        8⤵
        
        PID:7584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46330.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46330.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:9436
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14581.exe
        8⤵
        
        PID:10300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25433.exe
        8⤵
        
        PID:13960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24038.exe
        8⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32137.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32137.exe
        8⤵
        
        PID:16124
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31058.exe
        7⤵
        
        PID:7748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9099.exe
        8⤵
        
        PID:13596
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5372.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5372.exe
        7⤵
        
        PID:10492
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7490.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7490.exe
        7⤵
        
        PID:13396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27228.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27228.exe
        6⤵
        
        PID:6524
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15150.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15150.exe
        7⤵
        
        PID:11300
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17980.exe
        7⤵
        
        PID:1940
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27314.exe
        7⤵
        
        PID:2396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2917.exe
        6⤵
        
        PID:9208
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47181.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47181.exe
        6⤵
        
        PID:12192
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39116.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39116.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4016
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60563.exe
        6⤵
        
        PID:5588
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38802.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38802.exe
        7⤵
        
        PID:6212
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10059.exe
        8⤵
        
        PID:13376
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55190.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55190.exe
        8⤵
        
        PID:16156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62426.exe
        7⤵
        
        PID:10196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57126.exe
        7⤵
        
        PID:13908
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57914.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57914.exe
        6⤵
        
        PID:6580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16812.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16812.exe
        7⤵
        
        PID:11988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51510.exe
        7⤵
        
        PID:14928
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        7⤵
        
        PID:15452
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41763.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41763.exe
        6⤵
        
        PID:9560
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40106.exe
        6⤵
        
        PID:13528
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33436.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33436.exe
        5⤵
        
        PID:2232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14990.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14990.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:2344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19311.exe
        7⤵
        
        PID:8748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51084.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51084.exe
        8⤵
        
        PID:3636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44118.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44118.exe
        7⤵
        
        PID:11788
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39818.exe
        7⤵
        
        PID:1460
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13205.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13205.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:14392
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30552.exe
        7⤵
        
        PID:6256
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-882.exe
        6⤵
        
        PID:1224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9212.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9212.exe
        6⤵
        
        PID:10356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55651.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55651.exe
        6⤵
        
        PID:4960
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37222.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37222.exe
        5⤵
        
        PID:6244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-10638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10638.exe
        6⤵
        
        PID:7580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34773.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34773.exe
        6⤵
        
        PID:10232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17468.exe
        6⤵
        
        PID:14684
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-15141.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15141.exe
        6⤵
        
        PID:1636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46555.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46555.exe
        6⤵
        
        PID:15580
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-489.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-489.exe
        5⤵
        
        PID:8468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22482.exe
        5⤵
        
        PID:11548
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39759.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39759.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:2600
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59750.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59750.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:2288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32556.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32556.exe
        6⤵
        
        PID:4876
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34837.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34837.exe
        7⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17394.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17394.exe
        8⤵
        
        PID:11748
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40314.exe
        8⤵
        
        PID:14396
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44742.exe
        8⤵
        
        PID:16344
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52806.exe
        7⤵
        
        PID:9996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40106.exe
        7⤵
        
        PID:13512
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7430.exe
        7⤵
        
        PID:14864
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50870.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50870.exe
        6⤵
        
        PID:6280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5038.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5038.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10148
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64054.exe
        7⤵
        
        PID:14332
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51421.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51421.exe
        7⤵
        
        PID:15364
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17353.exe
        7⤵
        
        PID:16092
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63236.exe
        7⤵
        
        PID:7148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2428.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2428.exe
        6⤵
        
        PID:8980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36739.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36739.exe
        6⤵
        
        PID:12036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16233.exe
        6⤵
        
        PID:5356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37682.exe
        5⤵
        
        PID:4920
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61615.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61615.exe
        6⤵
        
        PID:6432
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15884.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15884.exe
        7⤵
        
        PID:9096
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52022.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52022.exe
        7⤵
        
        PID:12832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63174.exe
        7⤵
        
        PID:16240
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6261.exe
        7⤵
        
        PID:15388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-338.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-338.exe
        6⤵
        
        PID:9140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49981.exe
        6⤵
        
        PID:12260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-53347.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53347.exe
        6⤵
        
        PID:4680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64781.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64781.exe
        6⤵
        
        PID:16292
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10233.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10233.exe
        5⤵
        
        PID:6592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58415.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58415.exe
        6⤵
        
        PID:11492
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27314.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27314.exe
        6⤵
        
        PID:15916
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22819.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22819.exe
        5⤵
        
        PID:8024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50580.exe
        6⤵
        
        PID:15472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4908.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4908.exe
        5⤵
        
        PID:12432
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25846.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-25846.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:2484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48015.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48015.exe
        5⤵
        
        PID:4756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40367.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40367.exe
        6⤵
        
        PID:5716
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36588.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36588.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7564
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14581.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14581.exe
        7⤵
        
        PID:10308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25433.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25433.exe
        7⤵
        
        PID:13888
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15817.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15817.exe
        7⤵
        
        PID:1488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26354.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26354.exe
        7⤵
        
        PID:15860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31058.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31058.exe
        6⤵
        
        PID:7756
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-58342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58342.exe
        6⤵
        
        PID:11380
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13493.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13493.exe
        5⤵
        
        PID:6536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57004.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57004.exe
        6⤵
        
        PID:12736
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40397.exe
        6⤵
        
        PID:4672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47130.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47130.exe
        5⤵
        
        PID:9204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55846.exe
        5⤵
        
        PID:11444
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63020.exe
        5⤵
        
        PID:6164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39302.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39302.exe
      4⤵
      PID:4236
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1259.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1259.exe
        5⤵
        
        PID:5288
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43919.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43919.exe
        6⤵
        
        PID:9108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38383.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38383.exe
        7⤵
        
        PID:15232
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36245.exe
        6⤵
        
        PID:4580
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21019.exe
        6⤵
        
        PID:6932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2325.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2325.exe
        5⤵
        
        PID:8276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39514.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39514.exe
        5⤵
        
        PID:10540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38911.exe
        5⤵
        
        PID:15568
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47882.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47882.exe
      4⤵
      PID:2880
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26220.exe
        5⤵
        
        PID:11764
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51510.exe
        5⤵
        
        PID:13660
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        5⤵
        
        PID:15460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6261.exe
        5⤵
        
        PID:3668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32594.exe
      4⤵
      PID:8940
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13118.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13118.exe
      4⤵
      PID:1568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-22931.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-22931.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3852
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45126.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4572
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17478.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17478.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:4416
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57548.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57548.exe
        6⤵
        
        PID:1404
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59062.exe
        7⤵
        
        PID:6980
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36172.exe
        8⤵
        
        PID:4004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25810.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25810.exe
        8⤵
        
        PID:2960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56771.exe
        7⤵
        
        PID:9568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9452.exe
        7⤵
        
        PID:13636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17731.exe
        7⤵
        
        PID:5532
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39762.exe
        6⤵
        
        PID:6644
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65327.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-65327.exe
        7⤵
        
        PID:11972
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51510.exe
        7⤵
        
        PID:13480
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        7⤵
        
        PID:15444
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6261.exe
        7⤵
        
        PID:4168
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17532.exe
        6⤵
        
        PID:8316
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37606.exe
        6⤵
        
        PID:13196
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40749.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40749.exe
        6⤵
        
        PID:15956
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38258.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48076.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48076.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5131.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5131.exe
        7⤵
        
        PID:10068
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38252.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38252.exe
        8⤵
        
        PID:16016
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35848.exe
        8⤵
        
        PID:15988
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50580.exe
        8⤵
        
        PID:8856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6005.exe
        7⤵
        
        PID:13964
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54851.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54851.exe
        7⤵
        
        PID:16316
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5612.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5612.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:7320
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31481.exe
        6⤵
        
        PID:10004
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64230.exe
        6⤵
        
        PID:13520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28981.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27261.exe
        7⤵
        
        PID:5044
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-926.exe
        6⤵
        
        PID:16024
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53498.exe
        5⤵
        
        PID:6544
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39215.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39215.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:11896
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27792.exe
        6⤵
        
        PID:1820
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23398.exe
        5⤵
        
        PID:7940
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9161.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9161.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:10352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-498.exe
        5⤵
        
        PID:16336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17731.exe
        5⤵
        
        PID:2724
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35276.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35276.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7854.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7854.exe
        5⤵
        
        PID:3112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11563.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11563.exe
        6⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25775.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25775.exe
        7⤵
        
        PID:9656
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44630.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44630.exe
        7⤵
        
        PID:13488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40397.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40397.exe
        7⤵
        
        PID:1572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-2450.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2450.exe
        6⤵
        
        PID:8476
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30105.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30105.exe
        6⤵
        
        PID:12600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5126.exe
        6⤵
        
        PID:16100
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44371.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44371.exe
        5⤵
        
        PID:6660
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44876.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44876.exe
        6⤵
        
        PID:12248
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64602.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64602.exe
        6⤵
        
        PID:12012
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-40411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40411.exe
        6⤵
        
        PID:3600
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27792.exe
        6⤵
        
        PID:2692
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3033.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3033.exe
        5⤵
        
        PID:9512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43794.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43794.exe
        5⤵
        
        PID:14536
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38911.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38911.exe
        5⤵
        
        PID:14864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49114.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-49114.exe
      4⤵
      PID:1000
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57580.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57580.exe
        5⤵
        
        PID:5552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49932.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49932.exe
        6⤵
        
        PID:7200
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-18236.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18236.exe
        6⤵
        
        PID:13628
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1097.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1097.exe
        6⤵
        
        PID:4500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30747.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30747.exe
        5⤵
        
        PID:8364
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41818.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41818.exe
        5⤵
        
        PID:11672
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64106.exe
        5⤵
        
        PID:15664
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14440.exe
        5⤵
        
        PID:2816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17442.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17442.exe
      4⤵
      PID:6508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51788.exe
        5⤵
        
        PID:11920
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3481.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3481.exe
        5⤵
        
        PID:15412
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43567.exe
        5⤵
        
        PID:2308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59597.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59597.exe
      4⤵
      PID:9180
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30645.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30645.exe
      4⤵
      PID:12168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42073.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42073.exe
      4⤵
      PID:15484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27648.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27648.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2840
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17286.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3420
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14766.exe
        5⤵
        
        PID:4528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8846.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8846.exe
        6⤵
        
        PID:5424
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43020.exe
        7⤵
        
        PID:10508
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36882.exe
        7⤵
        
        PID:14760
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-61053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61053.exe
        6⤵
        
        PID:7768
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-418.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-418.exe
        6⤵
        
        PID:12352
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63379.exe
        5⤵
        
        PID:6500
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20133.exe
        5⤵
        
        PID:10020
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-40106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40106.exe
        5⤵
        
        PID:13388
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52758.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52758.exe
      4⤵
      PID:1012
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34508.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34508.exe
        5⤵
        
        PID:5520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-42796.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42796.exe
        6⤵
        
        PID:9632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29170.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29170.exe
        6⤵
        
        PID:13496
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16761.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16761.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15948
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-64921.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64921.exe
        6⤵
        
        PID:3004
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17234.exe
        5⤵
        
        PID:8300
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20188.exe
        5⤵
        
        PID:11336
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47468.exe
        6⤵
        
        PID:14828
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16512.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16512.exe
        6⤵
        
        PID:6276
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62771.exe
        5⤵
        
        PID:14604
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56700.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56700.exe
        5⤵
        
        PID:3988
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14440.exe
        5⤵
        
        PID:2168
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14361.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14361.exe
      4⤵
      PID:5372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        5⤵
        
        PID:8800
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6368
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-51638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51638.exe
        5⤵
        
        PID:14828
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9610.exe
        5⤵
        
        PID:15744
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13531.exe
        5⤵
        
        PID:5816
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15781.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15781.exe
      4⤵
      PID:8576
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39018.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39018.exe
      4⤵
      PID:11620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5947.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5947.exe
      4⤵
      PID:8380
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27462.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27462.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2164
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57548.exe
      4⤵
      PID:5076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15695.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15695.exe
        5⤵
        
        PID:6984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35535.exe
        6⤵
        
        PID:12156
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-51510.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51510.exe
        6⤵
        
        PID:14636
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36730.exe
        6⤵
        
        PID:15472
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-62054.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62054.exe
        5⤵
        
        PID:10844
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55789.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55789.exe
        5⤵
        
        PID:14912
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37961.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37961.exe
        5⤵
        
        PID:8152
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42933.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-42933.exe
      4⤵
      PID:7324
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7882.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7882.exe
        5⤵
        
        PID:6876
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-41565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-41565.exe
      4⤵
      PID:9424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2466.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-2466.exe
      4⤵
      PID:14108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6712.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6712.exe
      4⤵
      PID:5208
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29778.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29778.exe
    3⤵
    PID:4424
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-38831.exe
      4⤵
      PID:5748
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49487.exe
        5⤵
        
        PID:8836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59411.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59411.exe
        5⤵
        
        PID:11836
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39768.exe
        5⤵
        
        PID:15744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33017.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33017.exe
      4⤵
      PID:9232
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17826.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17826.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17033.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17033.exe
      4⤵
      PID:16312
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44767.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44767.exe
    3⤵
    PID:6208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3502.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-3502.exe
      4⤵
      PID:9196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32917.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-32917.exe
      4⤵
      PID:14188
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55427.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55427.exe
      4⤵
      PID:1132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-36004.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-36004.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26925.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26925.exe
    3⤵
    PID:13088
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-61971.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-61971.exe
    3⤵
    PID:16228
- C:\Users\Admin\AppData\Local\Temp\Unicorn-22508.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-22508.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3660
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-46726.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-46726.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9928.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9928.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1120
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17353.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17353.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1068
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26409.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26409.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:920
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35151.exe
        7⤵
        
        PID:5308
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16364.exe
        8⤵
        
        PID:6624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31567.exe
        9⤵
        
        PID:10156
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22357.exe
        9⤵
        System Location Discovery: System Language Discovery
        
        PID:13752
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27792.exe
        9⤵
        
        PID:3608
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40429.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-40429.exe
        8⤵
        
        PID:11152
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20149.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-20149.exe
        8⤵
        
        PID:13664
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11699.exe
        8⤵
        
        PID:6976
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39762.exe
        7⤵
        
        PID:6400
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3502.exe
        8⤵
        
        PID:8004
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32917.exe
        8⤵
        
        PID:14208
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9275.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9275.exe
        8⤵
        
        PID:3516
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17532.exe
        7⤵
        
        PID:7956
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36172.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36172.exe
        7⤵
        
        PID:14184
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51731.exe
        7⤵
        
        PID:4196
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23550.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:15504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24434.exe
        6⤵
        
        PID:5568
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16271.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16271.exe
        7⤵
        
        PID:7080
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42924.exe
        8⤵
        
        PID:13740
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27261.exe
        8⤵
        
        PID:1784
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19593.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19593.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:11636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15710.exe
        7⤵
        
        PID:3380
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7836.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7836.exe
        6⤵
        
        PID:6600
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4046.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4046.exe
        7⤵
        
        PID:12668
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-8898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8898.exe
        6⤵
        
        PID:9592
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-55565.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55565.exe
        6⤵
        
        PID:13440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56080.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56080.exe
        6⤵
        
        PID:2336
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60653.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60653.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3788
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52982.exe
        6⤵
        
        PID:5884
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43020.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43020.exe
        7⤵
        
        PID:10520
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49270.exe
        7⤵
        
        PID:14488
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13377.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13377.exe
        7⤵
        
        PID:5084
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43567.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43567.exe
        7⤵
        
        PID:11100
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38197.exe
        6⤵
        
        PID:10244
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6849.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6849.exe
        6⤵
        
        PID:14780
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39981.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39981.exe
        6⤵
        
        PID:16212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-60822.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60822.exe
        6⤵
        
        PID:3212
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-56283.exe
        6⤵
        
        PID:2856
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-2617.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2617.exe
        5⤵
        
        PID:5960
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-23052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23052.exe
        6⤵
        
        PID:7252
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23180.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23180.exe
        7⤵
        
        PID:11464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36917.exe
        7⤵
        
        PID:9644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33045.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33045.exe
        6⤵
        
        PID:10912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-57053.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57053.exe
        6⤵
        
        PID:14984
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-47309.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47309.exe
        6⤵
        
        PID:15488
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3151.exe
        6⤵
        
        PID:6584
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17410.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17410.exe
        5⤵
        
        PID:7968
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
        5⤵
        
        PID:11496
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15710.exe
        5⤵
        
        PID:3772
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24726.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24726.exe
        5⤵
        
        PID:15412
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63600.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-63600.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4540
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31017.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31017.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:3260
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-52982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52982.exe
        6⤵
        
        PID:5820
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10507.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10507.exe
        7⤵
        
        PID:9692
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14764.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14764.exe
        8⤵
        
        PID:15984
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30930.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30930.exe
        8⤵
        
        PID:14496
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57530.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57530.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:13092
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-1381.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1381.exe
        6⤵
        
        PID:8332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41997.exe
        6⤵
        
        PID:12616
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29052.exe
        5⤵
        
        PID:4504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21679.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21679.exe
        6⤵
        
        PID:7928
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-4379.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4379.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:10548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63005.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15048
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12069.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12069.exe
        6⤵
        
        PID:15644
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27792.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27792.exe
        6⤵
        
        PID:15996
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36518.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36518.exe
        5⤵
        
        PID:8000
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-37504.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37504.exe
        6⤵
        
        PID:8700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6412.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6412.exe
        5⤵
        
        PID:10840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15710.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15710.exe
        5⤵
        
        PID:3608
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55831.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55831.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:456
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52982.exe
        5⤵
        
        PID:5924
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34540.exe
        6⤵
        
        PID:9804
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-7452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7452.exe
        6⤵
        
        PID:14236
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-22502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22502.exe
        6⤵
        
        PID:15572
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21019.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21019.exe
        6⤵
        
        PID:16296
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44483.exe
        5⤵
        
        PID:8372
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11362.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11362.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:11400
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42927.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42927.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2556
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53350.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-53350.exe
      4⤵
      PID:5904
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63788.exe
        5⤵
        
        PID:8028
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24938.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24938.exe
        6⤵
        
        PID:6084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54099.exe
        5⤵
        
        PID:10648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-540.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-540.exe
        5⤵
        
        PID:14696
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39314.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39314.exe
      4⤵
      PID:8668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39548.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-39548.exe
      4⤵
      PID:11648
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5098.exe
      4⤵
      PID:15672
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-65063.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-65063.exe
      4⤵
      PID:1764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7660.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7660.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4496
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4965.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4965.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:1992
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15942.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15942.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:5024
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35151.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35151.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:5324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59062.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59062.exe
        7⤵
        
        PID:6996
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4366.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4366.exe
        8⤵
        
        PID:14572
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53171.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53171.exe
        8⤵
        
        PID:15648
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35898.exe
        7⤵
        
        PID:9580
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64230.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64230.exe
        7⤵
        
        PID:13584
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51638.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-51638.exe
        7⤵
        
        PID:7832
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26631.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26631.exe
        7⤵
        
        PID:16160
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39768.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39768.exe
        7⤵
        
        PID:6116
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39674.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39674.exe
        6⤵
        
        PID:7472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61647.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-61647.exe
        7⤵
        
        PID:13976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41286.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41286.exe
        6⤵
        
        PID:9520
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9452.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9452.exe
        6⤵
        
        PID:13552
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14440.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14440.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:6304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24434.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24434.exe
        5⤵
        
        PID:5540
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33484.exe
        6⤵
        
        PID:7108
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10731.exe
        7⤵
        
        PID:10532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7328.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-7328.exe
        8⤵
        
        PID:11960
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49270.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49270.exe
        7⤵
        
        PID:14464
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1369.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1369.exe
        7⤵
        
        PID:15624
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3407.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3407.exe
        7⤵
        
        PID:6036
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46070.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46070.exe
        6⤵
        
        PID:8900
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50106.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50106.exe
        6⤵
        
        PID:12340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-41162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-41162.exe
        6⤵
        
        PID:16112
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13531.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:15936
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23996.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23996.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:7340
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-24140.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-24140.exe
        6⤵
        
        PID:13144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29813.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29813.exe
        6⤵
        
        PID:15976
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43311.exe
        6⤵
        
        PID:15084
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47430.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-47430.exe
        5⤵
        
        PID:9484
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8492.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-8492.exe
        5⤵
        
        PID:14052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9952.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9952.exe
        5⤵
        
        PID:6272
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-26636.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-26636.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:5052
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-42956.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42956.exe
        5⤵
        
        PID:5500
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39343.exe
        6⤵
        
        PID:6728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-27061.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27061.exe
        6⤵
        
        PID:9276
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48803.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48803.exe
        6⤵
        
        PID:14880
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39719.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39719.exe
        6⤵
        
        PID:16148
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36873.exe
        6⤵
        
        PID:2240
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33717.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33717.exe
        5⤵
        
        PID:7860
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6873.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6873.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4736
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3641.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3641.exe
        5⤵
        
        PID:10464
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45613.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-45613.exe
        5⤵
        
        PID:4524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47293.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47293.exe
      4⤵
      PID:5840
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63788.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63788.exe
        5⤵
        
        PID:8060
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-54099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-54099.exe
        5⤵
        
        PID:10656
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63005.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63005.exe
        5⤵
        
        PID:14512
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17410.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17410.exe
      4⤵
      PID:7924
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-63133.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63133.exe
        5⤵
        
        PID:9716
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14793.exe
      4⤵
      PID:11516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30450.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30450.exe
      4⤵
      PID:14728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34268.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34268.exe
      4⤵
      PID:15428
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-11798.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-11798.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2440
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43430.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-43430.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:3332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25644.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25644.exe
        5⤵
        
        PID:5144
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12523.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12523.exe
        6⤵
        
        PID:6380
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50924.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50924.exe
        7⤵
        
        PID:7800
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57174.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-57174.exe
        7⤵
        System Location Discovery: System Language Discovery
        
        PID:10472
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1625.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1625.exe
        7⤵
        
        PID:14620
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25699.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25699.exe
        7⤵
        
        PID:16348
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50483.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50483.exe
        6⤵
        
        PID:8392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-29251.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29251.exe
        6⤵
        
        PID:12728
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30857.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30857.exe
        6⤵
        
        PID:14776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39762.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39762.exe
        5⤵
        
        PID:6392
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6098.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6098.exe
        6⤵
        
        PID:16360
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17532.exe
        5⤵
        
        PID:8232
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4357.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4357.exe
        5⤵
        
        PID:13096
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37973.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37973.exe
        5⤵
        
        PID:16204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43968.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43968.exe
        5⤵
        
        PID:6108
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15285.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-15285.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:5316
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23564.exe
        5⤵
        
        PID:6140
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-31343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31343.exe
        6⤵
        
        PID:6440
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17237.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17237.exe
        6⤵
        
        PID:12396
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-50787.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-50787.exe
        6⤵
        
        PID:15536
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39059.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39059.exe
        6⤵
        
        PID:16280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-12099.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12099.exe
        6⤵
        
        PID:4308
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38194.exe
        5⤵
        
        PID:8948
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15388.exe
        5⤵
        
        PID:11936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47037.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47037.exe
      4⤵
      PID:3356
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3502.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3502.exe
        5⤵
        
        PID:8728
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32917.exe
        5⤵
        
        PID:14196
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34937.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34937.exe
        5⤵
        
        PID:4012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-133.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-133.exe
      4⤵
      PID:8860
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8463.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8463.exe
      4⤵
      PID:13308
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-45828.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-45828.exe
      4⤵
      PID:4856
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6760.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-6760.exe
      4⤵
      PID:5764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14716.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14716.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:1444
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61103.exe
      4⤵
      PID:5480
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31823.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31823.exe
        5⤵
        
        PID:6652
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16684.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16684.exe
        6⤵
        
        PID:8448
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-46317.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-46317.exe
        6⤵
        
        PID:15504
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34752.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34752.exe
        6⤵
        
        PID:2712
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14611.exe
        6⤵
        
        PID:6868
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34374.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34374.exe
        5⤵
        
        PID:10332
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22633.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22633.exe
        5⤵
        
        PID:13916
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-7474.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-7474.exe
      4⤵
      PID:6552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-32364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32364.exe
        5⤵
        
        PID:2476
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17980.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17980.exe
        5⤵
        
        PID:14756
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-48315.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48315.exe
        5⤵
        
        PID:2136
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17532.exe
      4⤵
      PID:8416
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-4357.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-4357.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:13208
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47292.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47292.exe
      4⤵
      PID:4500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-5126.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-5126.exe
      4⤵
      PID:4836
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-65354.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-65354.exe
    3⤵
    PID:5968
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-34028.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-34028.exe
      4⤵
      PID:8792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9333.exe
      4⤵
      PID:11888
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7669.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7669.exe
    3⤵
    PID:7960
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-6942.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-6942.exe
    3⤵
    PID:10328
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-21517.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-21517.exe
    3⤵
    PID:4912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37931.exe
    3⤵
    PID:4824
- C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27526.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27526.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4184
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-50217.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-50217.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4440
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10373.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10373.exe
        5⤵
        Executes dropped EXE
        Suspicious use of SetWindowsHookEx
        
        PID:1060
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17964.exe
        6⤵
        
        PID:5220
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23564.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23564.exe
        7⤵
        
        PID:5944
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55756.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55756.exe
        8⤵
        
        PID:8324
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60278.exe
        8⤵
        
        PID:12636
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59305.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59305.exe
        8⤵
        
        PID:15860
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12039.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-12039.exe
        8⤵
        
        PID:2856
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53435.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53435.exe
        8⤵
        
        PID:7072
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37426.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37426.exe
        7⤵
        
        PID:8908
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15388.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15388.exe
        7⤵
        
        PID:11916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5126.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5126.exe
        7⤵
        
        PID:5280
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-33301.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-33301.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4204
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31375.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31375.exe
        7⤵
        
        PID:9604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42258.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-42258.exe
        7⤵
        
        PID:13420
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4645.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-4645.exe
        7⤵
        
        PID:15532
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3404.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3404.exe
        7⤵
        
        PID:15712
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18866.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-18866.exe
        7⤵
        
        PID:6052
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59805.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59805.exe
        6⤵
        
        PID:8916
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49586.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49586.exe
        7⤵
        
        PID:15372
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36506.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36506.exe
        7⤵
        
        PID:1460
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-34534.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-34534.exe
        6⤵
        
        PID:12408
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-21915.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-21915.exe
        6⤵
        
        PID:14632
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-14611.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14611.exe
        6⤵
        
        PID:10700
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15285.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15285.exe
        5⤵
        
        PID:5332
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-16364.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16364.exe
        6⤵
        
        PID:6604
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30031.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30031.exe
        7⤵
        
        PID:9280
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2290.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-2290.exe
        7⤵
        
        PID:14360
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44829.exe
        7⤵
        
        PID:15576
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49568.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49568.exe
        7⤵
        
        PID:4816
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-3218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3218.exe
        6⤵
        
        PID:8356
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-39997.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39997.exe
        6⤵
        
        PID:12376
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-17731.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-17731.exe
        6⤵
        
        PID:1488
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-53498.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-53498.exe
        5⤵
        
        PID:3528
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-43852.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43852.exe
        6⤵
        
        PID:13868
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-44342.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-44342.exe
        6⤵
        
        PID:3204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23398.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-23398.exe
        5⤵
        
        PID:8204
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28940.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-28940.exe
        5⤵
        
        PID:11284
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe
        5⤵
        
        PID:1132
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-24524.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-24524.exe
      4⤵
      Executes dropped EXE
      Suspicious use of SetWindowsHookEx
      PID:4776
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52982.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-52982.exe
        5⤵
        
        PID:5680
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-38319.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38319.exe
        6⤵
        
        PID:7180
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-63772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-63772.exe
        6⤵
        
        PID:10884
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-9337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-9337.exe
        6⤵
        
        PID:11752
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-62771.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-62771.exe
        6⤵
        
        PID:15388
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-30468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30468.exe
        6⤵
        
        PID:15716
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59626.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59626.exe
        5⤵
        
        PID:10160
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31925.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-31925.exe
        5⤵
        
        PID:13892
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35050.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35050.exe
        5⤵
        
        PID:5068
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29964.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29964.exe
        5⤵
        
        PID:1516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47485.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47485.exe
      4⤵
      PID:5888
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14158.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14158.exe
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6912
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5998.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5998.exe
        6⤵
        
        PID:10136
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-32917.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-32917.exe
        6⤵
        
        PID:14224
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-25898.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25898.exe
        6⤵
        
        PID:7676
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22162.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22162.exe
        5⤵
        
        PID:9552
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58365.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-58365.exe
        5⤵
        
        PID:13472
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17090.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17090.exe
      4⤵
      PID:7404
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1550.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-1550.exe
        5⤵
        
        PID:13240
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16393.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16393.exe
      4⤵
      PID:7728
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58454.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58454.exe
      4⤵
      PID:13620
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-55532.exe
      4⤵
      PID:3348
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63600.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63600.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28713.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28713.exe
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3696
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-6002.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6002.exe
        5⤵
        
        PID:5784
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-49164.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-49164.exe
        6⤵
        
        PID:9688
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-26965.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-26965.exe
        6⤵
        
        PID:13876
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-5529.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-5529.exe
        6⤵
        
        PID:14428
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-38197.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-38197.exe
        5⤵
        
        PID:10252
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13755.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13755.exe
        5⤵
        
        PID:14376
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-25316.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-25316.exe
        5⤵
        
        PID:15516
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-60220.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-60220.exe
        5⤵
        
        PID:4040
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59987.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59987.exe
      4⤵
      PID:5688
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39343.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39343.exe
        5⤵
        
        PID:3884
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-22453.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-22453.exe
        5⤵
        
        PID:9304
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36108.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36108.exe
        5⤵
        
        PID:15012
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47453.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47453.exe
      4⤵
      PID:7852
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3278.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3278.exe
        5⤵
        
        PID:13116
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-597.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-597.exe
        5⤵
        
        PID:1300
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33606.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33606.exe
      4⤵
      PID:10452
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46098.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46098.exe
      4⤵
      PID:14616
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8827.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8827.exe
      4⤵
      PID:15996
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55831.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55831.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:792
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-61103.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-61103.exe
      4⤵
      PID:5468
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-878.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-878.exe
        5⤵
        
        PID:6556
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-11438.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11438.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:9124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-36245.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-36245.exe
        6⤵
        
        PID:10980
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-13531.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-13531.exe
        6⤵
        
        PID:5940
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-6944.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-6944.exe
        6⤵
        
        PID:6848
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-3218.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-3218.exe
        5⤵
        
        PID:8560
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43261.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43261.exe
        5⤵
        
        PID:12684
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19337.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19337.exe
        5⤵
        
        PID:14392
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9797.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9797.exe
      4⤵
      PID:7508
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29772.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-29772.exe
        5⤵
        
        PID:14824
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-9580.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-9580.exe
      4⤵
      PID:10944
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58387.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58387.exe
      4⤵
      PID:15248
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-53158.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-53158.exe
    3⤵
    PID:5832
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-46959.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-46959.exe
      4⤵
      PID:8076
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59468.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59468.exe
        5⤵
        
        PID:1460
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14234.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-14234.exe
        5⤵
        
        PID:6196
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-59283.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-59283.exe
      4⤵
      PID:10812
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-58589.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-58589.exe
      4⤵
      PID:14932
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57286.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57286.exe
      4⤵
      PID:15384
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-21019.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-21019.exe
      4⤵
      PID:6568
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-24012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-24012.exe
    3⤵
    PID:7880
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 7880 -s 568
      4⤵
      Program crash
      PID:1132
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-45429.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-45429.exe
    3⤵
    PID:11424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-26852.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-26852.exe
    3⤵
    PID:14896
- C:\Users\Admin\AppData\Local\Temp\Unicorn-27453.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-27453.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4764
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:2224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23733.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23733.exe
      4⤵
      PID:3980
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-39535.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-39535.exe
        5⤵
        
        PID:6548
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-35848.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-35848.exe
        6⤵
        
        PID:15512
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-55318.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-55318.exe
        5⤵
        
        PID:4132
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-19740.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-19740.exe
        5⤵
        
        PID:14040
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16194.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-16194.exe
        5⤵
        
        PID:15516
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-1817.exe
      4⤵
      PID:7788
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-35142.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-35142.exe
      4⤵
      PID:10404
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-13225.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-13225.exe
      4⤵
      PID:14172
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-17138.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-17138.exe
      4⤵
      PID:2960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-14440.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-14440.exe
      4⤵
      PID:6072
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-42095.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-42095.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:3744
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-28815.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-28815.exe
      4⤵
      PID:5648
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-37324.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-37324.exe
        5⤵
        
        PID:7124
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-59055.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-59055.exe
        6⤵
        
        PID:10568
      - C:\Users\Admin\AppData\Local\Temp\Unicorn-48413.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-48413.exe
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:13932
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30610.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-30610.exe
        5⤵
        
        PID:8832
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-64029.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-64029.exe
        5⤵
        
        PID:13168
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-926.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-926.exe
        5⤵
        
        PID:688
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-31890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-31890.exe
      4⤵
      PID:7380
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-47642.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-47642.exe
      4⤵
      PID:10224
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-52518.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-52518.exe
      4⤵
      PID:14216
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-30226.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-30226.exe
      4⤵
      PID:1572
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-926.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-926.exe
      4⤵
      PID:5668
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-47293.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-47293.exe
    3⤵
    PID:5864
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-12043.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-12043.exe
      4⤵
      PID:9524
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-29170.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-29170.exe
      4⤵
      PID:13424
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-17410.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-17410.exe
    3⤵
    PID:8104
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-29484.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-29484.exe
    3⤵
    PID:11384
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-33500.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-33500.exe
    3⤵
    PID:4012
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37332.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37332.exe
    3⤵
    PID:14392
- C:\Users\Admin\AppData\Local\Temp\Unicorn-26211.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-26211.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:3052
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14981.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14981.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetWindowsHookEx
    PID:4772
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-44300.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-44300.exe
      4⤵
      PID:5556
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-15820.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-15820.exe
        5⤵
        
        PID:7216
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-27829.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-27829.exe
        5⤵
        
        PID:9976
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11292.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11292.exe
        5⤵
        
        PID:14072
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11087.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-11087.exe
        5⤵
        
        PID:8960
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10290.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-10290.exe
      4⤵
      System Location Discovery: System Language Discovery
      PID:7972
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-10827.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-10827.exe
        5⤵
        
        PID:14432
    - - C:\Users\Admin\AppData\Local\Temp\Unicorn-43311.exe
        
        C:\Users\Admin\AppData\Local\Temp\Unicorn-43311.exe
        5⤵
        
        PID:4192
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-36890.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-36890.exe
      4⤵
      PID:10500
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-56483.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-56483.exe
      4⤵
      PID:14768
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33929.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33929.exe
      4⤵
      PID:15484
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-55290.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-55290.exe
    3⤵
    PID:4936
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-23244.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-23244.exe
      4⤵
      PID:7296
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-33045.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-33045.exe
      4⤵
      PID:10904
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-57053.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-57053.exe
      4⤵
      PID:14976
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-37411.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-37411.exe
    3⤵
    PID:8408
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-2697.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-2697.exe
    3⤵
    PID:11368
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-44820.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-44820.exe
    3⤵
    PID:6328
- C:\Users\Admin\AppData\Local\Temp\Unicorn-38031.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-38031.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4276
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-52982.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-52982.exe
    3⤵
    PID:4668
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-16108.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-16108.exe
      4⤵
      PID:9228
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-11698.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-11698.exe
      4⤵
      PID:13924
  - - C:\Users\Admin\AppData\Local\Temp\Unicorn-8565.exe
      C:\Users\Admin\AppData\Local\Temp\Unicorn-8565.exe
      4⤵
      PID:14472
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-7628.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-7628.exe
    3⤵
    PID:9912
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58163.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58163.exe
    3⤵
    PID:13324
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-51012.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-51012.exe
    3⤵
    PID:436
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54431.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54431.exe
  2⤵
  PID:5740
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-63788.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-63788.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:8068
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-59283.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-59283.exe
    3⤵
    PID:10804
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-58589.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-58589.exe
    3⤵
    PID:14920
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-38499.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-38499.exe
    3⤵
    PID:4800
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-27792.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-27792.exe
    3⤵
    PID:7916
- C:\Users\Admin\AppData\Local\Temp\Unicorn-44900.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-44900.exe
  2⤵
  PID:7692
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-15560.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-15560.exe
    3⤵
    PID:16228
- - C:\Users\Admin\AppData\Local\Temp\Unicorn-14234.exe
    C:\Users\Admin\AppData\Local\Temp\Unicorn-14234.exe
    3⤵
    PID:6344
- C:\Users\Admin\AppData\Local\Temp\Unicorn-19181.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-19181.exe
  2⤵
  PID:11232
- C:\Users\Admin\AppData\Local\Temp\Unicorn-54229.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-54229.exe
  2⤵
  PID:14832
- C:\Users\Admin\AppData\Local\Temp\Unicorn-14910.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-14910.exe
  2⤵
  PID:16300
- C:\Users\Admin\AppData\Local\Temp\Unicorn-3941.exe
  C:\Users\Admin\AppData\Local\Temp\Unicorn-3941.exe
  2⤵
  PID:15628

C:\Windows\system32\dwm.exe
"dwm.exe"
1⤵
- Checks SCSI registry key(s)
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:7444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Unicorn-11272.exe

Filesize
468KB

MD5
04cff6efd0680fec1a76a34277720631

SHA1
ad3b57eed744d910137d637d7db0062a089597c3

SHA256
f0bb7293dd783add404733618015d8eda5508cb755740671485cdd0217a164da

SHA512
6aa083527fc5047ece7718abff32d957c53413ec1ef68412cfed6f5f3d71b61ca22ce1669ce9598ec64678f162ed7b191a0556cadaefae3fd1b50a8ab81dc5ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-11798.exe

Filesize
468KB

MD5
3c4bde3611565b25c111805aed7e0613

SHA1
ff218a99168598a16fc9442192808185b9162ab1

SHA256
c55d6981eff91b4b39cfebe470c9bbdaa726de1d3d7b247ddb1e004e5c4c7ee7

SHA512
926c3430e38fd54ad895845862bfde7ad2a3c74040f04b6a891ac8692f533fa94a8a71088932a5d71d95936a3c94228db7e217990f018fc0d2d50a58fffc148d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-17353.exe

Filesize
468KB

MD5
3fa75acdbc66e7230836bea65b6180fd

SHA1
00a2935fd4b25d36d97d256e7427102ab4a0a21d

SHA256
12de4f7ef47878ceda2aecb905aa36e3c9d6e37c62fad895c16eb038b42f3b1e

SHA512
1da791c0d35461e2efff2b10ef776f5cae67b61aff1c707676c37221b1922c579e5cefa355a38abed7c4d54203f9edd43c0bb2a513d3c4c906a6a23b6c68aadf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-21996.exe

Filesize
468KB

MD5
6182b5c99f8f027debce87dd85a0f3f4

SHA1
d4f429a97e2dfcc59c031aca819f4fa4bfaabc80

SHA256
6b162a391167e3dfff78678d0dbf129df9e7f7fe0b52155ec4c55b08300c09fa

SHA512
cb5b7d8fc604ee6f12975cd2a70e4a76512ff02d417decb21cd3f5ab2bc0e2095e9286611945b8a9a883ba82c20c30ded0e1f0662ec808a3210032e780955998

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22508.exe

Filesize
468KB

MD5
856da1cb49b3d0645815e011fbb42c5b

SHA1
c8b5ca138bbc3dc4cb46d7d2d5cb040028910e5a

SHA256
9b77ac78fddfe028e2a61ba855161e89c36c37bcd2e305d61656a9b9da0e4328

SHA512
1e989303860d45fe6f1b63aa1e3be2454c9658180454a1374e863aac6467906485025f7d3f70089c4a57b5d5b9cfed142668d1a1855193dd7824bacf8145a895

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-22931.exe

Filesize
468KB

MD5
02d8795ef4b7ab9e920be6c6dc19a28a

SHA1
43060ec57d123393e1cd5c99be3f03b71126f190

SHA256
6ba09a0533157179122333203b0db35daf9bedd2a75d02cf6b2a2fe87697d3a4

SHA512
2508b2ac2a495c99187e89be9a4df61bbbc8db5b9b68c261ca8da999036bce1e7f2a9e1ffb00a07703d7bffd34f26c39a7e7fb7cc468f4f8961616e2313f9f4f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-23631.exe

Filesize
468KB

MD5
8a23b361d9df6f97d78f44f1d45eb69a

SHA1
f7e864c48b748bdb1dca8b71cb931776d2abbbb1

SHA256
b22b2c9c090078f5f5e48ced001abeffe745d0e67160a8f8d3e9ce1ee61c4457

SHA512
e826fa0a4ae70dc51a8f19d142fce41dcffdc6313ec679bbde8c394aef5c6a9ba6c21ca9c807883639fa627e69ff95e60eb4210b6d9c5f0eccc919531a64fda5

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-25644.exe

Filesize
468KB

MD5
f17870104474ce5064f088fcfa539a82

SHA1
3b7938431c5e99d812a7eee54ebc63dfecb30a9b

SHA256
91637e009813ba00a53772264b32e2f247b0ecb6a973cb7d8217644f6ba0a567

SHA512
3de7902601942285be745fafdcf260e825917374275cfe24de842ad78626ac8b91bd63d06d59aee462465e86c23c025081e41c7a9b6e52fbc67c803eb15d0351

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-26211.exe

Filesize
468KB

MD5
8c252fa61558c433083a461dcd0e9c9d

SHA1
3136d66dddc89c7f1a8aa33820271746865730a2

SHA256
4140d9fef336c4ed9483ca8441ccefb172af19c1c090932ef6666d9bd2fa26ef

SHA512
c135f366a7512e133d6a799cd87306e7e63e247c2b5956a6c003414460524499f625fa84b55ef30c72bfa46ab64f63f550a161023188df54c35d7f8e65b68ab7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27270.exe

Filesize
468KB

MD5
d5449f2464bb85551bbafeaf89d72c5a

SHA1
c0596c05be79f301ea07d918a2cba8c8c3cfd4af

SHA256
f1699b77b006bbfa59be842f52a06c6171dce32fcfa026c0e846b7cc548881b6

SHA512
7f01f87328caddb64c3e34f70e45ec610c5e9f19540d9762d09342c04b64efa3c11b0621138b0e8a40439b1f665b0310b3fb4844e6c36829ef5dde735c46034a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27453.exe

Filesize
468KB

MD5
bbbd237be3b7448fab864149c605b9cc

SHA1
c6efc25229b4048a3175d773f9582602a221651c

SHA256
9d1f9ab147b29596d18312271f05355e74bb30441584e12d57b743bc104cc40c

SHA512
134f2881f4dfc28cc62e0de6fe4af952a9f8204ff0266fe2b77b18595779d4763fafe454e95bf38326f15c7339399698dc488cc7b3bfa2333d7934d2fe1a9ccf

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27526.exe

Filesize
468KB

MD5
412adf86a02737ec6db70b7377861dd4

SHA1
267d937c0adc48d74d265c94dc3061c0853ea9fd

SHA256
57d655a2a1a4cec3896e7034f198bd7ae2bb11e6306c00b5e4860b1572401292

SHA512
65002dff27da2a075aca33981cabcaf5666b7d86dba9b043852f844d3a85918bd5ac594bc081782b9e4393d9a1a809f82e543252f8f2533226e7e6ef77c1f696

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-27648.exe

Filesize
468KB

MD5
10229a7fe8200b4b320c69c50270b9f9

SHA1
d008716e1f4ccfcbaf3870c88eb6f9e60f656422

SHA256
e90e0002a6c11d72235302051bb75db7eb6cee0e04b66c17cd2db8ba8f23792e

SHA512
14be6a45003e7142ea4df8a2daf2de572f350a618d3d27fcb908c2601f3138f29315af4ccfa95f0ef11c1c423e8b0a83361887205a35870cf3d81281d564a104

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-31315.exe

Filesize
468KB

MD5
4e4299a30fb5947499602effe1c6a6c1

SHA1
83a8447120e1d5d321ce41c5c3a5456aae426891

SHA256
5f6adefce5b8329d22185fc146947ba9ab5b8402b3c0e7ac59b8620ef41e0b75

SHA512
88166185a33beeaf8b0230f9b450ba5d89f6e9913b5244d6cd417256750895caa0ccd81603fa7ea69f2ee000a1d3f10fba0b2b65db042e7abf5fa8138986679d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-32556.exe

Filesize
468KB

MD5
add9d8d170cf33555d63cd7fa90c7fd0

SHA1
5130f51f7776d30634593e99982a72044f3fc9f9

SHA256
b41d15e4c04c760997150d068ced458ab5469d44f6fa97f6bbf4c9d21fb40a9e

SHA512
0a2c8c09890e67d11af4dd4088b410d892df6fe0af9b8607c8834363b058324b5750fbefce26a21788b4325e088f99f77e356c44aa78953575931a2a3a75046d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-34950.exe

Filesize
468KB

MD5
9489c7fbb6e59b03d870a46ac2abb75a

SHA1
7901f47e33cd4163278a35e7d8528390b0af4bad

SHA256
8ea290797a644736fc11e69d4db399db74108b4558521304bb51127d5210998e

SHA512
ee2c68fa87cdc13bdd385762f6fe2857e489d33e41e8074029b95a99b76b15141ec4489549c0c7f33a730e884216ae016872e088130e7e3fdc29ecc9d7ea3705

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-35395.exe

Filesize
468KB

MD5
93cd344c560e39a7552751c09130cdad

SHA1
7cacbfaa72b53a136ed12e6400c5efa8a2d930d2

SHA256
b8b160b74530ff4fa1eaa6a9739e348cfd83eadfc5d7d0275a7d45c16cb23666

SHA512
0555686ab65603182659b3422c3c1b7cbdc2fd337204283e6afe15defc0248f3266d97b48e0460b4ee2781c87c491cf6642e1997bf5a6cbd7b975f53e464cd9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-39759.exe

Filesize
468KB

MD5
2b4121907b2a35da6447a6fa211a3e0d

SHA1
dfecaa240a1d4a9e92a1a577a67d7b78771de226

SHA256
8b3a3ca31280869d2a6129e905ce82e853f5627dda88e281d4a15f54fc1b224b

SHA512
8693c2015015e211c561194c13e7c088ac860cda392c829ca2d6fc7208a2061b984f2b798513819898a5fa3432a27d3ba4f47bcbbbed6c58e8ac51f721cb9ebd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-42374.exe

Filesize
468KB

MD5
63bd64b4e95de531607a167bc7b578e9

SHA1
c2c43d21fd392b71916fef4d478f2367f7444956

SHA256
ac5c4a37ff4419e4dcb7e8ff729b29a6a0e62f0b5bdd13281db7784e02fc6276

SHA512
a01f546d2fa3cfe3c0220fd758152edd35bfc2207394dc26ec7b54cd7902231954b1dd79a632a96462564fa32523d20f5ab510f245b2786655341c7d608cd808

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-43753.exe

Filesize
468KB

MD5
88fc966fd9cc2109164f2fa9ccc8aa14

SHA1
752ebb3f0fe944f435baad353ac020f6a25da3da

SHA256
9a77be4ce36f015bf9be218ff6c7cca6d491c08532c4de785120d5628b8f4a79

SHA512
d00382261bf52352d77ba2d5e989b28b7c0bd9b6753cf1e7dae10c0a634d80ffb05e98b06b42a60ba8254d0d81113faa8da15bd0d480bd38d3fbba0ddee3d04c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-45126.exe

Filesize
468KB

MD5
41f59790703b0511627081e2291f10e3

SHA1
167da705fa7bd290cc3be5a35db13ca632ed5f2e

SHA256
7d4c1a486fb9d20ae653e71df3c9df04ff1c1dc6f74c9da980969e415d723e8e

SHA512
a6026f6ea969146f91a516d69a05b844861f518d143cf5520f05cbac1c5b120e7e08d455108de646cca9658cb01cfab9e032f76b0b8d2aaf6668ac6ba8e6c8d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-46726.exe

Filesize
468KB

MD5
c4d3ea8abaa3b142daeda312d9edb1ff

SHA1
6cb968fa485079f0ce65d16d3ce374ab7517c57f

SHA256
c3ee99aeb55d01f9e69c9a2856fa0f912c0deb72bb3dcc5e33d05897f206944c

SHA512
b21617f89eefe5d745ff65b46315199539e7ef1cb4819c2ea04ee8c79a2a2a2b689949ba1e24c1454a54e7b7396fa40334e45d6bdaa4dffc8d8ae61818b37d96

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4904.exe

Filesize
468KB

MD5
9999695374d36dcad2650cdef5c5ecb3

SHA1
9a2ecc3ff7718b60ff861845296082df300aa6d8

SHA256
d3b8f928c009ef5c1f817577ed31c98d7c305e175d8ce927c7d46ea39c34ec23

SHA512
36c6882a2e88fae041af9770a58b978f1267170ddf9b59fcc91909bd2f25911f75b60b856ede12bbd670ec3e15d598dbeffb1fd1b4e064e1d0babc4bdebfd898

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-4965.exe

Filesize
468KB

MD5
44bdeb7ff51d14f7e188df613f7a831a

SHA1
cef396471161d89f4915e2c3c19da64c3b620e72

SHA256
e6eac2b52c4a7d20852a163c8bc07806c5f6f2e1adb52034753074c70119c172

SHA512
57eacb3e80422413383f16c1e3175acf7deb1078a6cdb4052eec1bc9e42e5d206724a55487d0bf891c38adaca8977ed7cb69bf9bcfe1b703ddb9f09632e81b16

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50217.exe

Filesize
468KB

MD5
6d25d4f562c867041622d8da247f67c4

SHA1
e8a51a117901b4971683cdf8d59be0f4247ad945

SHA256
1359f6f73072fd90d65496f384bd060fd998d6fb6eeb27393ebf1367624be0c1

SHA512
ef6246246b02c1747dc6de876c353e406ea61013f050efcb2d2d4e87aa04b0f5ab42ac69da3fb35463f82574b7f6fd3c3c2ac9aaf07c845a730a5451de298a7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-50768.exe

Filesize
468KB

MD5
fb3b08b09bb0065d773f47f061ae5c96

SHA1
df97ca5ddbb726d7cb76b48ea16355bc653165f9

SHA256
a79014fa360f3e2e8992d058682e60eb156753430b1db5ab0ed5f2d2926029bb

SHA512
dfbc61fa73d7b1b972deba1519f482f0473ea40e8ad78d61e1bf8e55ba3127e4c83034548b060f62ee47c413b3c98cdbb6369788a0d48be7ce4855f938d36eb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-52521.exe

Filesize
468KB

MD5
fa9e01239c28fbe812b216bfe4343692

SHA1
4edb4138381660c120f81acc18f9d62d24228e48

SHA256
84a9eee8f6bd95d8e0725489008b0c7536309570ff612073598e899eae020488

SHA512
a7fbd98e5e33e809da26f3eb3f8019dd89ba842fefc15dccd40574e8ac9a72eeb1897dd938d59ed12f933c9dbc23d958a7eb9040cd4fc9cc0d932cbf3060364c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56055.exe

Filesize
468KB

MD5
d69707bc0eb7d517d4ab91c1c5ec2f62

SHA1
e8f386cddc4ad8f3b77da0c01418ac58b32ec446

SHA256
3d00223281d5eff488b2f0bf94e780e781d8a6feed5b1bb96c2203d80efa4b8f

SHA512
98fff7657f642c72d3c377b0d5286bb3aa3d1e39256e61991c6fc217323f7deef1c05fdf8b42f5c48ce3a6cc4541f299f5bd2ef7dbaf9c1e1209158180eeca55

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-56553.exe

Filesize
468KB

MD5
0eef75a072d6d5c67eb752180369dcf5

SHA1
34999a5b7fc5ce0229c0046b6c0192b1b5ff008a

SHA256
f574821aadbdc20bb5aadbaa4e4f187c7607775b1f11ed776ec234da146042f0

SHA512
0e412020e3f0ba05d6bce874957c9f8e60908918db829ec3ac2bda0239bddd69f975914f5b132fe009d78003f6e0fd991555b649d14f9c803c5915dc64df6e16

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-60038.exe

Filesize
468KB

MD5
80e5d622bae776e2076e4b68f6b96786

SHA1
2a07b41f4e3fcd82532a4d92d48af91591f5d275

SHA256
1949ca6a8da723b7e506d653111f743e1d7d6d23080e834682e75d89cf78301a

SHA512
e2bbb7d3e0d463a476ff724436ad237466fe3c9a225acb6eb3029871e35594fbb72eaebf33af040fa0155f37c600918db97982dff49629e1f2f33105d9c73241

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-6098.exe

Filesize
468KB

MD5
99629a7767054014fe1994fb16b0832d

SHA1
1d15c856945b530dd8e9b1f9dd70a4f19786fa3e

SHA256
baba5b8f6b41d98b5fd34a36e26deaead6f224f326f17d1373d13e62fc01b9c7

SHA512
a8143a705c3962f6f12c3040c9e635c1b1f0092b94ea29d89a76f60df9d387ccb72d4077e1b5e0a8ea3bcc8a88226276745f7d2da308c5d15a58732809a5a3d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-61161.exe

Filesize
468KB

MD5
93136af2b5b860885c5439221283a3a3

SHA1
3eb217c641682e1bb273e4d9a9f0786076d3c425

SHA256
59851bad469f8b62fc530d45a963a7635fbb844c9dded87b993ce5373141aeb4

SHA512
668a06fc3935693baa1e7d58897165152c92007b64503c620546627e3814a34416b4ba980967797524e7e54dd836960e8718bd6d08b28eb0cddd64aca5750e55

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-63600.exe

Filesize
468KB

MD5
c4869e8d47c4a9f5e0f6154cc0f03fdb

SHA1
1084f51f04e498ff739a5fb90f1d736fa3b23e3d

SHA256
4f8c29bf1be357a26f4e2a02ef005e9321374a76dc7c7064d228d487eaf80fa4

SHA512
ee32ffec54442615928907686d919afcd8c9bc0d47aa43cdd68dd983d4822c7cdc2c12993989d9246fac485eefa3caf27fb147a6bc201dc8f6c232300f4c73f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-7660.exe

Filesize
468KB

MD5
de4aa55de8995c3f2cacde8de9fff480

SHA1
d90c568e934989565a5b31bd29b7aae2451b5ca6

SHA256
70b66dabe484f0d7ff973273e478ceeb6b51cf76aca7cdd9c82265c4f648c120

SHA512
7544523e6c12a18351e8e9fc6f2b7e80dc39327c63e30f8a851aef90e48bc17b158136d9fa90c56e425446e44f76a10fa4336dbcb6cc1f2c4c9891aca65001ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9388.exe

Filesize
468KB

MD5
06a400d985e43cc4ee80af86ee08eb64

SHA1
61b3d9e5f6a189a5c77ee8158c1a641d0858938e

SHA256
fee5cc1013a6fa3a85b406c728797d199f5feeabf2199eb787aa394a6ace02f0

SHA512
c2d9cd84e9768cb7d30e745fc93aa992c5a021f192c1cd23693a8771b14b47272d89a07cb16a317498d2b38014c2bde00c1b8d0964b9123b40d57157a2a6c39e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Unicorn-9928.exe

Filesize
468KB

MD5
a199f221047d3a4734c237d9b1a0e6e5

SHA1
17b4b3203fb8bf69129a0e3174a2cd2f9ab44178

SHA256
3a82ef2fcbd276cded70d2d0a29aa7cfc6f059fc690517d6c428b8e9ad8980fc

SHA512
8dcb54b314884bd4bdb0f8315b862c44c6f957d52a7bf45dab9c3f06766e222987652019f5973bb4651b3ac61a5b42294cdb11ba7d560e0146848e4a8be2a183

Download Submit
memory/456-351-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/536-228-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/588-2952-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/588-178-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/920-316-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1000-462-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1012-443-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1060-290-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1068-180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1072-275-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1108-184-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1120-93-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1404-444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1444-320-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1460-3623-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1604-394-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1812-119-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1864-369-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1868-387-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1944-27-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/1992-179-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2084-35-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2136-4456-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2164-269-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2192-393-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2224-185-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2232-441-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2260-6-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2268-3537-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2288-250-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2380-440-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2440-202-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2484-257-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2600-133-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2620-218-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2692-4444-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2776-380-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2800-3164-0x0000000075DC0000-0x0000000075E35000-memory.dmp

Filesize
468KB

Download
memory/2800-0-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2824-43-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2840-145-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/2852-482-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3048-48-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3052-194-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3112-445-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3192-16-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3260-352-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3284-395-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3332-295-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3368-468-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3420-262-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3516-4180-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3600-4145-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3660-18-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3680-446-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3696-344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3744-350-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3784-239-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3788-318-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3852-72-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3892-289-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/3980-484-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4012-3188-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4016-248-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4048-126-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4124-280-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4184-94-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4208-437-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4232-55-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4232-3368-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4236-442-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4276-324-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4300-317-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4332-75-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4416-264-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4424-447-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4432-111-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4440-182-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4496-95-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4528-434-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4532-227-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4572-144-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4604-63-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4752-240-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4756-436-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4764-98-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4772-319-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4776-322-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4788-402-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4792-195-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4876-435-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/4920-467-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5024-342-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5052-358-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5092-375-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5144-485-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5160-488-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5220-489-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5308-500-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5316-499-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5324-912-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5332-501-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5340-913-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5428-918-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5468-919-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/5480-923-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/11100-4457-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/13616-4455-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15476-3538-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15568-3345-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15596-2885-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15644-3960-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15708-4991-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15712-3344-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/15892-3201-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16164-3080-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16296-3493-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download
memory/16344-3343-0x0000000000400000-0x0000000000475000-memory.dmp

Filesize
468KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads